Authority Main Cyber Standards and Regulations

EU Commission Implementing Regulation 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat

October 23, 2024March 6, 2026
Cross-Sector, Government, Cyber Resilience, EU, Law / Regulation, EU, RC - Recover

Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 establishes implementing technical standards for the application of Regulation (EU) 2022/2554 concerning digital operational resilience for the financial sector. Specifically, it… Read More »EU Commission Implementing Regulation 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat

EU Commission Delegated Regulation 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

October 23, 2024February 28, 2026
Cross-Sector, Government, EU, Law / Regulation, Cyber Resilience, EU, RC - Recover

Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplements Regulation (EU) 2022/2554 by establishing regulatory technical standards that specify the content and time limits for reporting major ICT-related incidents… Read More »EU Commission Delegated Regulation 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

EU Regulation 2019/1020 Cyber Resilience Act (CRA)

October 23, 2024March 6, 2026
Cross-Sector, Government, AppSec, EU, Law / Regulation, SoFa, PR - Protect, PS - Platform, EU, IR - Infrastructure

The EU Cyber Resilience Act (CRA) is a regulation aimed at enhancing cybersecurity for hardware and software products with digital elements placed on the EU market. It establishes mandatory cybersecurity… Read More »EU Regulation 2019/1020 Cyber Resilience Act (CRA)

MITRE Att&Ck® version 16.1

October 21, 2024February 28, 2026
Cross-Sector, Threats, ID - Identify, RA - Risks Asst, US, Organization, Tool, MITRE

The MITRE ATT&CK® framework is a globally recognized, continuously updated knowledge base that catalogs the tactics, techniques, and procedures (TTPs) used by cyber adversaries, based on real-world observations. Organized as a… Read More »MITRE Att&Ck® version 16.1

US Cybersecurity Maturity Model Certification (CMMC) 2.0

October 15, 2024March 6, 2026
Government, US Govt, Cross-Sector, DOD, DS - Data Security, Law / Regulation, PR - Protect, US

CMMC 2.0 is a Department of Defense (DoD) framework designed to unify cybersecurity standards across the Defense Industrial Base (DIB) to protect sensitive unclassified information. It streamlines the previous version… Read More »US Cybersecurity Maturity Model Certification (CMMC) 2.0

ANSSI Security Recommendations for a Generative AI System

September 27, 2024March 14, 2026
Cross-Sector, Agency, PS - Platform, Standard, PR - Protect, ANSSI, FR

ANSSI recommends isolating each phase of the generative AI system lifecycle (training, deployment, production) using network segmentation, dedicated hardware, and strict access controls to prevent data leakage and unauthorized access. Secure… Read More »ANSSI Security Recommendations for a Generative AI System

EU Regulation 2024/1689 Artificial Intelligence Act (AI Act)

July 12, 2024March 14, 2026
OC - Org. Context, Cross-Sector, Government, GV - Govern, RM - Risks Mgt, EU, Law / Regulation, EU

The EU AI Act is the first comprehensive legal framework regulating artificial intelligence in Europe, designed to foster trustworthy AI while protecting fundamental rights, safety, and ethical principles. It classifies… Read More »EU Regulation 2024/1689 Artificial Intelligence Act (AI Act)

CIS Critical Security Controls Version 8 ★★★★★

June 25, 2024February 28, 2026
Cross-Sector, ID - Identify, RA - Risks Asst, Standard, Controls, US, CIS, Organization

CIS Critical Security Controls v8 (CIS CSC v8) is a comprehensive cybersecurity framework developed by the Center for Internet Security to help organizations defend against modern cyber threats. Version 8… Read More »CIS Critical Security Controls Version 8 ★★★★★

PCI Data Security Standard (PCI DSS)

June 11, 2024February 28, 2026
GV - Govern, OC - Org. Context, PCI SSC, INT, Finance, Company, Contract

The Payment Card Industry Data Security Standard (PCI DSS) is a comprehensive set of security requirements designed to protect payment card data wherever it is stored, processed, or transmitted. It… Read More »PCI Data Security Standard (PCI DSS)

Swift Customer Security Controls Framework (CSCF)

May 30, 2024February 28, 2026
OC - Org. Context, GV - Govern, INT, Finance, SWIFT SCP, Company, Contract

The SWIFT Customer Security Controls Framework (CSCF) is a set of cybersecurity requirements developed by SWIFT for all institutions using its financial messaging network. The CSCF comprises both mandatory and… Read More »Swift Customer Security Controls Framework (CSCF)