🇺🇸 Regional guide
United States: compliance context
Federal, state, and sector-specific regulations
Regional regulatory landscape
US obligations are federal, state, and sector-specific. Applicability often depends on the data handled, the service delivered, public-sector contracts, and thresholds rather than geography alone.
20 relevant framework guides across 6 coverage categories.
Mandatory regulations
These requirements apply only when their legal, sector, entity, activity, data, or contract scope is met.
- HIPAA for covered healthcare entities and business associates
- GLBA for covered financial institutions
- CCPA/CPRA for covered businesses meeting California thresholds
- SOX IT controls for covered public-company financial reporting
- FedRAMP or CMMC/NIST requirements where federal contracts apply
Voluntary standards and contractual assurance
These frameworks can support a consistent control baseline but do not replace mandatory legal duties.
- ISO 27001
- SOC 2
- NIST CSF
- NIST Privacy Framework
- PCI DSS where payment brands or acquiring contracts require it
Implementation priorities
- Map data, customers, contracts, and state exposure
- Separate statutory duties from customer assurance requests
- Define federal-contract boundaries and inherited cloud controls
- Maintain evidence owners and incident escalation paths
Frameworks to explore
Information Security
Data Privacy
Financial & Critical Infrastructure
Government & Defence
AI Governance
Business Continuity & Automotive
AssureCore workflows
Manage your controls and evidence together in a workspace.
Official regional references
Keep exploring
Framework coverage is educational and does not determine legal obligations. Confirm scope with qualified professionals and the relevant authority.