Which cybersecurity rules apply to you depends on three things: where you operate, what data you handle and which sector you are in. Regulations are legally binding, standards are contracted or certified against, and frameworks are guidance you adopt. Start by listing which of the three each requirement is.
What is the difference between a regulation, a standard and a framework?
A regulation or law, such as the EU General Data Protection Regulation, is binding. A regulator can fine or sanction you for breaking it.
A standard, such as PCI DSS from the PCI Security Standards Council, is binding through contract. Card brands and acquirers require compliance from businesses that handle payment cards.
A framework, such as the NIST Cybersecurity Framework, is voluntary guidance. Nobody can penalise you for ignoring it, but customers, insurers and regulators often use it as the yardstick for what reasonable looks like.
What do some well known ones require?
GDPR (EU). It covers personal data of people in the EU. Among other duties, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms. Article 32 requires appropriate technical and organisational security measures.
NIS2 (EU). The directive covers essential and important entities across a range of sectors. Its recitals describe an early warning within 24 hours of becoming aware of a significant incident, followed by an incident notification within 72 hours. Member States transpose it into national law, so check the version that applies to you.
PCI DSS. It applies to organisations that store, process or transmit payment card data, and the council publishes related standards for software, encryption and key management.
NIST CSF 2.0. Six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is a common way to organise a program and report to executives.
NIST SP 800-53. A catalogue of security and privacy controls used by US federal systems and widely borrowed elsewhere.
Sector rules also exist, including health, financial services and critical infrastructure rules in many countries. Confirm which apply with the regulator's own pages or with counsel. The HHS page for the US HIPAA security rule refused automated access when I tried to fetch it, so it is not cited here.
How do you find out what applies?
Build a short profile. Where are your customers, staff and servers? What categories of data do you hold: personal, health, payment, government? Which sectors are you in or sell to? Do customer contracts require a specific standard or audit report? Each answer adds or removes rows from your list.
How do you avoid doing the work many times?
Most requirements ask for the same underlying controls: access management, patching, logging, incident response, backups, vendor management. Pick one control set as your base, such as NIST CSF with 800-53 detail, and map each external requirement to it. When a new regulation arrives, you check the mapping and handle the gaps instead of starting again.
A constructed example
A software company in Canada sells to retailers in Germany and takes card payments through a hosted payment page. The profile gives them GDPR, probably NIS2 depending on the customer's sector and how it is transposed, and PCI DSS at a reduced scope because card data never touches their servers. They adopt NIST CSF as the base and map the three to it. Breach notification becomes one runbook with the strictest clock, 24 hours for the early warning where NIS2 applies, with the 72 hour GDPR notice built in.
How to check or apply this
- Write the profile: regions, data types, sectors, contractual obligations.
- List each candidate requirement and mark it as law, contractual standard or framework.
- Confirm applicability with the primary source or counsel, not a summary.
- Choose a base control set and map each requirement to it.
- Note every deadline for incident reporting and use the shortest as your target.
- Assign an owner to each requirement and keep evidence in one place.
- Review the list every six months, since laws and national rules change.
Quick check
Does a framework like NIST CSF make me compliant with a law?
Not by itself. It can structure your program and supply evidence, but each law has its own text. Map to it explicitly.
Which has the tightest breach clock?
Among those above, NIS2's 24 hour early warning for significant incidents. Check the national law that applies to you for exact terms.
Sources
- GDPR, Regulation (EU) 2016/679
- NIS2, Directive (EU) 2022/2555
- PCI Security Standards Council
- NIST Cybersecurity Framework
- NIST SP 800-53 Rev. 5
Last reviewed: 18 October 2026.
