Frameworks for building a security programme and the cybersecurity rules that apply to IT suppliers: NIST CSF, NIST SP 800-53 and 800-171, CIS Controls, NIS2, CMMC, FISMA and Cyber Essentials.
9 guides in this area
Mandatory and voluntary clearly labelled
Official sources in every guide
Where to start
Which one do you need?
Find the line that matches your situation. Many companies need more than one; the guides explain how they overlap.
If this is you
Start with
Type
You want a free, widely recognised way to structure your security programme
The CIS Critical Security Controls are a prioritised set of 18 security controls and 153 specific safeguards that defend against the most common cyber attacks. They are published free by the Center for Internet Security. Implementation Group 1 (IG1) defines essential cyber hygiene for every organisation; IG2 and IG3 add safeguards for more complex and higher-risk environments. They are voluntary and not certifiable.
Voluntary: Voluntary; referenced by some regulators, insurers and contracts
Quick facts
What it covers
Prioritised technical and process safeguards for assets, software, data, configuration, accounts, access, vulnerabilities, logging, email and web, malware, recovery, network, training, suppliers, application security, incident response and penetration testing.
Who needs it
SMBs to enterprises wanting a prioritised control set
Why it matters
They tell a small or busy IT team exactly what to do first, based on how real attacks happen, which makes them one of the fastest ways to raise security.
Key requirements
Inventory of enterprise assets and software (Controls 1 and 2)
Data protection and secure configuration (Controls 3 and 4)
Account and access control management (Controls 5 and 6)
Continuous vulnerability management and audit logs (Controls 7 and 8)
Malware defences and data recovery (Controls 10 and 11)
Security awareness, service provider and application security (Controls 14 to 16)
Incident response and penetration testing (Controls 17 and 18)
Federal Information Security Modernization Act of 2014 (originally the Federal Information Security Management Act of 2002)
FISMA is the US federal law that requires every federal agency to run an information security programme for its information and systems, including those operated by contractors on its behalf. Agencies apply NIST standards, chiefly the Risk Management Framework and SP 800-53 controls, authorise systems to operate, report incidents to CISA and report annually to OMB and Congress. IT companies meet FISMA requirements through their contracts when they build, host or operate systems for federal agencies.
Mandatory: Mandatory for US federal agencies; flows down to contractors operating federal systems
Quick facts
What it covers
Security programmes, risk management, system authorisation, continuous monitoring, incident reporting and annual evaluation for federal information and systems.
Who needs it
Federal agencies, contractors operating federal systems
Why it matters
IT contractors and service providers that build or run systems for US federal agencies inherit FISMA obligations through contract clauses, and must deliver systems that can receive an authority to operate.
Key requirements
Agency-wide information security programme led by the CIO and CISO
Categorise systems (FIPS 199) and apply minimum security requirements (FIPS 200)
Select and implement NIST SP 800-53 controls
Assess, authorise (ATO) and continuously monitor systems under the NIST RMF
Report incidents to CISA and major incidents to Congress
Annual independent evaluation by the agency Inspector General and reporting to OMB
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)
NIS2 is the EU's main cybersecurity law for important sectors. It replaced the 2016 NIS Directive and greatly widened its scope to include cloud providers, data centres, managed service and managed security service providers, online marketplaces and many manufacturers. In-scope medium and large entities must manage cyber risk with at least ten baseline measures, make management accountable, and report significant incidents within 24 hours. Fines reach EUR 10 million or 2% of worldwide turnover.
Mandatory: Mandatory for in-scope entities through national laws
Quick facts
What it covers
Cybersecurity risk management, governance, supply chain security and incident reporting for essential and important entities in 18 sectors.
Who needs it
Essential and important entities incl. cloud, data centres, MSPs, MSSPs, digital providers
Why it matters
Many IT companies are now directly regulated as digital infrastructure or ICT service management providers, and regulated customers will pass NIS2 security requirements down to their suppliers.
Key requirements
Determine whether you are an essential or important entity, and register
Management bodies approve and oversee cyber risk measures and take training
At least the ten measures in Article 21(2), including supply chain security
Early warning within 24 hours of a significant incident
Incident notification within 72 hours and a final report within one month
Supervision, audits and fines up to EUR 10 million or 2% of turnover
The NIST Cybersecurity Framework (CSF) is a voluntary framework for managing cybersecurity risk, published by the US National Institute of Standards and Technology. Version 2.0, released in February 2024, organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It applies to organisations of any size or sector worldwide. There is no certification; organisations use profiles and tiers to measure where they are and plan improvements.
Voluntary: Voluntary; required by some contracts and sector rules
NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the US government's catalogue of security and privacy controls, organised into 20 families such as access control, incident response and supply chain risk. US federal agencies must use it under FISMA, and cloud providers selling to them meet it through FedRAMP. Anyone else can use it voluntarily as a detailed control library. Revision 5 is current, with baselines for low, moderate and high impact systems published in SP 800-53B.
Voluntary: Mandatory for US federal systems under FISMA; voluntary for others, but required for FedRAMP cloud services
Quick facts
What it covers
Technical, operational and management controls for security and privacy across 20 control families, with enhancements for higher-risk systems.
Who needs it
Federal agencies, FedRAMP cloud providers, government contractors
Why it matters
It is the control set behind FISMA, FedRAMP and much US government contracting, and the most detailed free control catalogue available for designing a security programme.
Key requirements
Categorise the system by impact (low, moderate, high)
Select the matching baseline from SP 800-53B and tailor it
FedRAMP is the US government programme that assesses and authorises cloud services for use by federal agencies. Any cloud service that holds federal information generally needs it. In 2026 FedRAMP moved from its document-heavy Rev5 process to the 20x approach with Consolidated Rules, certification classes A to D and more automated, evidence-based validation. The rules become mandatory on 1 January 2027, and existing Rev5 authorizations sunset at the end of 2028.
Mandatory: Required for cloud services used by US federal agencies
Quick facts
What it covers
Security assessment, authorization and continuous monitoring of cloud products and services used by US federal agencies.
Who needs it
Cloud and SaaS providers selling to US federal agencies
Why it matters
Without FedRAMP, a cloud or SaaS company can't sell to most US federal agencies, and many state, local and defence buyers use it as a benchmark.
Key requirements
Meet the security requirements of the applicable class or baseline (built on NIST SP 800-53)
Independent assessment, traditionally by an accredited 3PAO
Machine-readable, reusable evidence under 20x
Continuous monitoring, vulnerability detection and response
Marketplace listing and agency use
Adopt the Consolidated Rules by the applicable deadlines
OWASP Top 10: The Ten Most Critical Web Application Security Risks
The OWASP Top 10 is a free, community-built list of the ten most critical security risks to web applications, published by the OWASP Foundation. The 2025 edition adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, and keeps Broken Access Control at number one. It is an awareness document, not a full standard, but customers, auditors, PCI DSS and penetration testers widely use it as a baseline for secure development.
Voluntary: Voluntary awareness standard; referenced by PCI DSS, customers and pen testers
Quick facts
What it covers
Common web application weaknesses, from access control and misconfiguration to supply chain, cryptography, injection, design, authentication, integrity, logging and error handling.
Who needs it
Web and SaaS development teams
Why it matters
It is the shared baseline developers, testers and customers use to talk about web application security, and most security questionnaires ask how you address it.
CERT-In Directions under Section 70B(6) of the IT Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for safe and trusted Internet (28 April 2022)
The CERT-In Directions of April 2022 require service providers, intermediaries, data centres, body corporates and government organisations in India to report specified cyber incidents to CERT-In within six hours of noticing them, keep ICT system logs for 180 days within India, synchronise clocks to Indian time sources and name a point of contact. Data centres, cloud, VPS and VPN providers must also keep subscriber records for five years. They are issued under Section 70B of the IT Act, and non-compliance can be punished with imprisonment or a fine.
Mandatory: Mandatory for service providers, intermediaries, data centres, body corporates and government organisations in India
Quick facts
What it covers
Cyber incident reporting, log retention, clock synchronisation, points of contact, and record-keeping for hosting, VPN and virtual asset providers.
Who needs it
Indian IT/ITES companies, cloud, VPN, data centre and SaaS providers
Why it matters
Almost every IT, SaaS and hosting company operating in India is covered, and the six-hour deadline is among the strictest incident reporting rules in the world.
Key requirements
Report listed cyber incidents to CERT-In within 6 hours of noticing them
Keep logs of all ICT systems for 180 days, within Indian jurisdiction
Synchronise ICT system clocks with NIC or NPL NTP servers, or sources traceable to them
Designate a point of contact and share it with CERT-In
Data centre, VPS, cloud and VPN providers keep subscriber details for 5 years
Provide information and assistance when CERT-In asks
Information Technology Act, 2000 (as amended in 2008)
The Information Technology Act, 2000 is India's main law on electronic commerce, electronic records and signatures, cybercrime and intermediary liability. Its 2008 amendment added data protection duties (Section 43A), cyber offences such as identity theft, safe harbour for intermediaries (Section 79) and a legal basis for CERT-In (Section 70B). Rules made under it, such as the CERT-In Directions and the IT Intermediary Rules, set many of the obligations Indian IT companies follow today.
Mandatory: Mandatory law in India
Quick facts
What it covers
Legal recognition of electronic records and signatures, cyber offences and penalties, data protection compensation, interception and blocking powers, protected systems, CERT-In, and intermediary liability.
Who needs it
All Indian IT companies, intermediaries, digital businesses
Why it matters
Every IT company operating in India is subject to it: it defines cybercrimes against and by your systems, requires incident reporting through CERT-In, and decides when platforms are liable for user content.
Key requirements
Reasonable security practices for sensitive personal data (Section 43A, until May 2027)
Don't disclose personal information in breach of a lawful contract (Section 72A)
Comply with CERT-In directions, including 6-hour incident reporting (Section 70B)
Intermediary due diligence to keep safe harbour (Section 79 and the Intermediary Rules)
Comply with lawful interception, decryption and blocking orders (Sections 69 and 69A)
Electronic records and signatures valid under Sections 3 to 10A
Where it applies
India (and offences committed outside India involving a computer system in India)
