US Cybersecurity Compliance Requirements by Industry

By Chris Turn

Cybersecurity is important for all industries to protect sensitive information and customer data. Different industries have different regulations that they must meet depending on the types of data they use and store. Read on to learn about some of the cybersecurity regulations in a few regulated industries.

Financial Cybersecurity Regulations and Compliance

The financial sector has a few cybersecurity requirements that are set by federal and state regulators. The most common set of requirements are the ones found in the Federal Financial Institution Examination Council handbook, or FFIEC-IT.

This body of rules is made up of a number of booklets that contain resources and requirements that financial institutions are expected to adhere to. There are also several different guidances that are put out by financial regulatory bodies.

An example of this is the Office of the Comptroller of Currency (OCC), which has put out guidance on third-party risk management. This guidance is given to all organizations that come under their jurisdiction.

Retail Cybersecurity Regulations and Compliance: PCI DSS

The retail sector isn’t federally regulated, but it does have regulations set by the Payment Card Industry Security Council’s Data Security Standard (or PCI DSS). This group issues security standards that must be followed by any organization that processes card payments or holds any payment card data, including all retailers making credit card transactions.

A failure to follow PCI DSS compliance may result in fines of anywhere from $5,000 to $100,000 from your credit card company per month, and you could also lose your merchant’s account at your bank.

Healthcare Cybersecurity Regulations and Compliance: HIPAA

The best known standard for cybersecurity compliance in healthcare is the Health Insurance Portability and Accountability Act. HIPAA establishes the cybersecurity standards for healthcare organizations, insurers, and third-party services providers that medical organizations work with.

This standard enforces protection for personal health information (PHI) that patients provide to their medical providers, both digitally and in other forms.

Department of Defense Cybersecurity Regulations and Compliance: DFARS and CMMC

Because of the sensitive information the Department of Defense holds relating to national security, as a condition of providing a service to the US Department of Defense (DOD), businesses in their supply chain are required to meet cyber requirements that have been set up in the Defense Federal Acquisition Regulation Supplement (DFARS) and Procedures Guidance and Information (PGI).

DFARS outlines cybersecurity standards that third-party contractors must meet and comply with before doing business with the DOD in order to protect sensitive defense information. But in addition to DFARS, a new set of regulations called Cybersecurity Maturity Model Certification (CMMC) is currently being rolled out.

Because of the strict guidelines of these federally mandated requirements, many DoD contractors choose to work with a company specializing in IT services for DoD contractors in order to stay on top of changes and remain eligible for DoD contracts.