These are research candidates for this profile. Confirm the exact organization and activity before concluding that a rule applies.
Research onlyNIS2 and national transpositions
Directive (EU) 2022/2555 · Commission Implementing Regulation (EU) 2024/2690
Potentially relevant to covered cloud, data-centre, DNS/CDN, managed service and managed security providers with an EU nexus. Confirm service definitions, size rules and exceptions, main establishment, and the applicable national implementing law. Commission Implementing Regulation (EU) 2024/2690 specifies risk-management measures and significant-incident criteria for listed digital providers; it does not replace national applicability review.
Jurisdictions: EU-EEA
Research applicability questions
- Do you operate or provide the relevant service in an EU or EEA member state?
- Do you meet the employee or financial thresholds used by this authority?
- Does your principal activity fall within a sector covered by this authority?
- Do you provide one of the services identified by this authority?
- Are you established, represented, or offering the service in the relevant jurisdiction?
NIST Cybersecurity Framework 2.0
NIST CSWP 29
Voluntary cybersecurity risk-management framework for organizations of any size or sector. Customer contracts may request alignment; it is not a law or a certification. Map the selected profile and desired outcomes; do not score optional framework alignment as a legal violation.
Jurisdictions: GLOBAL
Research applicability questions
- Has your organization or a customer selected a NIST CSF profile or outcomes to evaluate?
- Does a customer contract, regulator or internal policy require a particular CSF profile or outcome set?
HIPAA Security, Privacy, and Breach Notification Rules
45 CFR Parts 160 and 164
Applies to covered entities and business associates handling protected health information. Cloud providers that maintain electronic PHI can be business associates even when data is encrypted and they have no decryption key. Check the actual data/service role and business-associate agreement. A healthcare customer alone does not establish scope. Proposed Security Rule changes must be tracked separately from the currently effective rule.
Jurisdictions: US-FEDERAL
Research applicability questions
- Are you a HIPAA covered entity, or do you create, receive, maintain or transmit PHI for a covered entity or another business associate?
- Which protected health information does the service handle, and under whose business-associate agreement?
- Does your service handle electronic PHI, including encrypted information for which you do not hold the decryption key?
- What size, complexity, capabilities and risk factors affect implementation of your HIPAA safeguards?
- For each addressable implementation specification, have you evaluated reasonableness and documented any alternative?
FTC Safeguards Rule
16 CFR Part 314
Certain financial institutions under FTC jurisdiction must safeguard customer information; activities and regulator routing determine coverage. Banks supervised under other GLBA regulators must be routed to their own rules. An MSP is not automatically a covered financial institution: assess customer-contract duties and any external Qualified Individual role separately from direct institutional duties.
Jurisdictions: US-FEDERAL
Research applicability questions
- Does the organization engage in a financial activity covered by the applicable GLBA rule?
- Is the organization subject to FTC jurisdiction for the activity being assessed?
- Does the organization maintain customer information covered by the rule?
- How many consumers’ customer information records do you maintain, and do any section 314.6 exemptions apply?
CMMC, DFARS, and NIST SP 800-171 contract requirements
32 CFR Part 170 · DFARS 252.204-7012 · NIST SP 800-171 as contractually applicable · DFARS 252.204-7021
Check the actual DoD contract clauses, FCI/CDI/CUI, system boundary, required CMMC level and assessment obligations. DFARS 252.204-7012 covers safeguarding and cyber-incident duties; 252.204-7021 and 32 CFR Part 170 address CMMC. Under 7012(b)(2)(ii)(D), external cloud services handling covered defense information need FedRAMP Moderate-equivalent security and specified incident/evidence duties. This is separate from general FedRAMP scope; ordinary commercial hosting is not automatically covered.
Jurisdictions: US-FEDERAL
Research applicability questions
- Does an applicable contract contain the cited safeguarding or cyber clause?
- Will your systems process, store or transmit federal contract information in contract performance?
- Will the uploaded package contain Controlled Unclassified Information or covered defense information?
- Which CMMC level and assessment type are specified in the solicitation or contract?
- What CMMC assessment level and assessment/affirmation requirements does the actual solicitation or contract specify?
Digital Operational Resilience Act
Regulation (EU) 2022/2554
Distinguish regulated financial entities from their ICT suppliers. A cloud, MSP or security provider may face customer-contract duties; direct EU oversight follows designation as a critical ICT third-party provider. Check the service, EU financial customer, contract and critical-provider designation rather than treating every ICT supplier as a financial entity.
Jurisdictions: EU-EEA
Research applicability questions
- Are you one of the financial-entity types named by the rule?
- Do you supply ICT services to EU financial entities, and which services support their critical or important functions?
- Which DORA security, incident, audit, exit and subcontracting obligations appear in your financial-customer contracts?
- Do you operate or provide the relevant service in an EU or EEA member state?
- Have the European Supervisory Authorities designated your organization as a critical ICT third-party provider?
EU General Data Protection Regulation
Regulation (EU) 2016/679
Check EU establishment, offering goods/services to or monitoring people in the EU, and the controller/processor role. A cloud, MSP or security provider may be a processor with contract and security duties. EU data-subject location alone does not establish every territorial-scope condition; verify Articles 3 and 28 and relevant national rules.
Jurisdictions: EU-EEA
Research applicability questions
- Does processing occur in the context of an EU establishment’s activities?
- Does the organization offer goods/services to people in the EU or monitor their behavior there?
- Do you determine the purposes and means of processing personal data, or process it on a customer’s documented instructions?
- Where are the relevant people located for the processing activity, and which Article 3 scope condition is met?
ISO/IEC 27001:2022
ISO/IEC 27001:2022 · ISO/IEC 27001:2022/Amd 1:2024
ISO/IEC 27001:2022 is an information-security management-system standard, with Amendment 1:2024 also listed by ISO. Certification or alignment may be requested by customers; this is not automatically a legal duty. Assessment content remains mapping-only until reuse rights and specialist review are resolved; AuditReady cannot issue certification.
Jurisdictions: GLOBAL
Research applicability questions
- Has a customer or your organization requested this standard or assurance engagement, and for which system boundary?
- Which services, sites, assets and processes are inside the requested certification boundary?
SOC 2 Trust Services Criteria
Trust Services Criteria
SOC 2 is an AICPA assurance reporting service for service organizations, not a general law or an ISO-style certification. Scope depends on the system, trust-services categories and engagement. Customer requirements can drive the engagement. Content-rights review and CPA expertise are required; AuditReady cannot issue a SOC report.
Jurisdictions: GLOBAL
Research applicability questions
- Has a customer or your organization requested this standard or assurance engagement, and for which system boundary?
- Which trust-services categories and reporting period are in the planned SOC 2 engagement?
FedRAMP federal cloud service scope
44 USC 3607–3616 · OMB Memorandum M-24-15 · FedRAMP Consolidated Rules for 2026 — Scope
Potentially relevant to cloud offerings handling federal information for US agencies. The agency determines whether its use case is in scope; not every government user, internet service, MSP or physical data centre needs FedRAMP. Check the offering boundary and exceptions. This research family does not authorize AuditReady to process CUI or issue a FedRAMP certification.
Jurisdictions: US-FEDERAL
Research applicability questions
- Will a US federal agency use this cloud service for an agency function?
- Will the offering create, collect, process, store or maintain federal information on behalf of the agency?
- Is this an operated IaaS, PaaS or SaaS cloud offering, rather than only consulting or physical colocation?
- Does the agency use a shared cloud offering with a provider/agency responsibility boundary?
- Has the agency assessed any applicable FedRAMP scope exception?