Cloud + AI Compliance Encyclopedia
Attribute-level compliance scoring across AWS, GCP, Azure, and Kubernetes — including the industry-first productized AI Workload Compliance framework mapping NIST AI-RMF + EU AI Act + ISO/IEC 42001 + MITRE ATLAS to your live K8s AI/ML inventory. Connected accounts swept daily on Free, Starter and Team and hourly on Pro and Enterprise — sooner when the change watcher fires — and re-scored inside a 30-second SLA.
Not sure which frameworks apply to you?
Pick where you operate, or what you sell. No form and no email — every option below is a link.
Where you operate
What you sell
Still unsure? The full catalog below is searchable by name, country, or sector — or read the region guide for where you operate.
AI Workload Compliance — built for the EU AI Act
EU AI Act high-risk obligations (Annex III) apply from 2 December 2027, with up to €15M / 3% of global-turnover penalties for high-risk AI systems lacking risk-management evidence. EchelonGraph's Tier 3 K8s watcher catches shadow AI workloads (KServe · Kubeflow · Argo Rollouts · KubeRay · Seldon · Run:ai) the moment they hit your cluster, then auto-maps them to NIST AI-RMF, EU AI Act Articles 9/15/16/17, ISO/IEC 42001, and MITRE ATLAS. No CSV exports. No quarterly snapshots. No competitor ships this productized today.
Posture-sweep cadence is plan-gated. Free, Starter and Team sweep each connected cloud account daily; Pro and Enterprise carry the continuous-scanning feature and sweep hourly, configurable down to every 15 minutes. On every plan a change watcher polling the provider audit logs pulls the next sweep forward when it sees something move. Once a change lands, a signed webhook re-scores all 3,473 controls inside a 30-second SLA — measured at about 11 seconds on our own estate on 2026-08-07. Compare to traditional CSPM tools running 24-hour crons: an hourly sweep is 24x more often, and roughly8,760x more often than an annual audit. Compliance evidence stays accurate between audits, not just on audit day.
Control-by-control framework guides
Hand-written deep dives — every control with real-world attack scenarios, auditor questions, and Terraform remediation.
AI Governance
NIST AI-RMF
18 controlsNational Institute of Standards and Technology Artificial Intelligence Risk Management Framework (NIST AI-RMF 1.0). Four functions — Govern, Map, Measure, Manage — providing voluntary guidance for trustworthy AI development and deployment. The de-facto reference standard cited by US federal AI Executive Order 14110 and state-level AI laws.
EU AI Act
18 controlsThe world's first comprehensive AI regulation. High-risk AI system obligations under Articles 9-17 were extended by Regulation (EU) 2026/1744 (in force 27 July 2026) and now apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-embedded systems. The Article 50 transparency obligations have applied since 2 August 2026. High-risk breaches carry penalties up to €15M or 3% of global annual turnover; the €35M / 7% maximum is reserved for Article 5 prohibited practices — still more punitive than GDPR. Extraterritorial reach: applies to any provider, deployer, importer, or distributor whose AI output reaches the EU market.
ISO/IEC 42001
15 controlsThe first international management-system standard for artificial intelligence. Provides certifiable framework for organisations developing, providing, or using AI systems. Modelled on ISO/IEC 27001's structure (Clauses 4-10) so organisations with mature ISMS can extend to AI management system with familiar PDCA + continual improvement cadence.
AI Threat Modelling
AI Application Security
Cloud Security
CIS GCP
24 controlsCenter for Internet Security benchmark for Google Cloud Platform. 130+ controls covering IAM, networking, logging, storage, databases, and compute security.
CIS AWS
35 controlsCenter for Internet Security benchmark for Amazon Web Services. 140+ controls covering IAM, storage, logging, monitoring, and networking.
CIS Azure
10 controlsCenter for Internet Security benchmark for Microsoft Azure. 120+ controls covering identity, networking, storage, databases, and logging.
CIS Kubernetes
26 controlsCenter for Internet Security benchmark for Kubernetes Pod Security, RBAC, and NetworkPolicy. EchelonGraph evaluates against the live cluster topology emitted by the Tier 3 K8s watcher (Pods, RBAC, NetworkPolicy CRDs).
Pod Security Standards
10 controlsKubernetes-native policy tiers replacing PodSecurityPolicy. EchelonGraph scores against the live Pod inventory + securityContext attributes captured by the Tier 3 watcher to verify which Pods meet Baseline vs Restricted profiles.
Audit Framework
International Standard
Industry Regulation
HIPAA
21 controlsUS federal law that establishes national standards to protect electronic personal health information (ePHI). Covers administrative, physical, and technical safeguards.
PCI DSS
27 controlsGlobal standard for organizations that handle cardholder data. 12 requirements covering network security, data protection, access control, and monitoring.
Privacy Regulation
GDPR
23 controlsEuropean Union regulation on data protection and privacy. Applies to all organizations processing personal data of EU residents, regardless of where the organization is located.
AI Workload Compliance
9 controlsIndustry-first productized AI governance framework. Maps NIST AI-RMF, EU AI Act Articles 9/15/16/17, ISO/IEC 42001, and MITRE ATLAS to the live Kubernetes AI/ML workload inventory captured by the Tier 3 watcher (KServe InferenceService, Kubeflow Notebook, Argo Rollouts, KubeRay RayCluster, Seldon SeldonDeployment, Run:ai RunaiJob).
DPDP Act
20 controlsIndia's comprehensive data-protection regulation, enacted August 2023. Applies to processing of digital personal data within India + cross-border processing of data principals in India. Penalty up to ₹250 crore per violation. The dominant privacy regulation for the world's most populous market.
ISMS-P
22 controlsKorea's combined information security + privacy certification managed by KISA (Korea Internet & Security Agency). Mandatory for many Korean industries; voluntary for others. Penalty: up to 3% of annual revenue (proposed amendments to 10% to align with GDPR).
Government Standard
Government
FedRAMP Moderate
12 controlsThe FedRAMP Moderate baseline — the NIST 800-53 Rev 5 control set a cloud service must meet to be authorized for U.S. federal use (the most common FedRAMP impact level). EchelonGraph live-scores the technical control set against your actual cloud posture so ConMon is continuous, not annual.
CMMC 2.0 L2
12 controlsCybersecurity Maturity Model Certification 2.0 Level 2 — the controls (derived from NIST SP 800-171) that U.S. defense contractors must meet to handle Controlled Unclassified Information (CUI). EchelonGraph live-scores the technical practices against your cloud posture so you enter the assessment with evidence, not spreadsheets.
Security Baseline
All 330 live-scored frameworks
Filter by region, industry, or category to find the frameworks that apply to you — each scored continuously against your live AWS, GCP, Azure & Kubernetes posture.
20 of these 330 have a written in-depth guide — look for the Guide badge. The rest are live-scored in the product; what you see here is the catalog entry we publish today.
CIS AWS Foundations Benchmark
GuideCIS GCP Foundations Benchmark
GuideCIS Kubernetes Benchmark
GuideUK NCSC Cloud Security Principles
CSA Cloud Controls Matrix
EUCS — European Cybersecurity Certification Scheme for Cloud Services
NSA/CISA Kubernetes Hardening Guide
K-CSAP — Cloud Security Assurance Program (Korea)
MeitY Cloud Services Empanelment & Security (India)
ISO/IEC 27017
Pod Security Standards
GuideANSSI SecNumCloud
BSI C5
CSA STAR
NCA Cloud Cybersecurity Controls
ISO/IEC 27018
EU AI Act
GuideNIST AI Risk Management Framework
GuideISO/IEC 42001:2023
GuideCSA AI Controls Matrix (AICM)
MITRE ATLAS
GuideOWASP Top 10 for LLM Applications
GuideAI Basic Act (Korea)
NIST SP 800-218A (GenAI)
Compliance requirements by region
Who enforces the rules where you operate, how fast you have to report a breach, and what they have actually fined people. 6 regions.
United States
4 business days (SEC, public companies)
The US has sector-specific regulations rather than a single data protection law. Federal agencies follow NIST, healthcare follows HIPAA, and payments follow PCI-DSS. California's CCPA/CPRA is the strongest state privacy law.
Mandatory
Commonly expected
Key facts
- No single federal privacy law — sector-specific approach
- NIST CSF 2.0 widely adopted as voluntary baseline
- FTC Act Section 5 covers unfair/deceptive practices
- CCPA/CPRA: strongest state privacy law, covers 40M residents
- SEC requires cybersecurity incident disclosure within 4 days
First 30 days
- Map data flows by sector — healthcare (HIPAA), payments (PCI-DSS), federal (NIST 800-53)
- Determine state-law exposure — CCPA (CA), CPA (CO), CTDPA (CT), TDPSA (TX), and 15+ others
- Wire SEC incident-disclosure runbook if you're a public company (4-day clock)
Enforcement actions on record
- $5B — Meta (FTC) (2019)
- $700M — Equifax (2019)
- $350M — T-Mobile (2022)
- $115M — Anthem (2018)
Enforced by FTC, SEC, HHS (HIPAA), State AGs. Extraterritorial reach: CCPA/CPRA: applies to any business that collects data on California residents, even if HQ'd outside the US
European Union
72 hours (GDPR Article 33)
The EU leads global data protection with GDPR's extraterritorial reach. NIS2 (2024) expands cybersecurity requirements to 18 sectors. DORA mandates ICT resilience for financial entities.
Mandatory
Commonly expected
Key facts
- GDPR fines: up to €20M or 4% of global revenue
- NIS2 (Oct 2024): 18 essential/important sectors must comply
- DORA (Jan 2025): mandatory for all EU financial entities
- Right to data portability and right to be forgotten
- 72-hour breach notification mandatory
First 30 days
- Map all personal data processing activities (Article 30 ROPA)
- Determine if you're an Essential or Important entity under NIS2 (October 2024 deadline)
- Wire 72-hour breach notification runbook to your supervisory authority
Enforcement actions on record
- €1.2B — Meta (Ireland DPC) (2023)
- €746M — Amazon (CNPD) (2021)
- €225M — WhatsApp (2021)
- €345M — TikTok (2023)
Enforced by National DPAs, EDPB, ENISA. Extraterritorial reach: GDPR: applies to any organization processing personal data of EU residents, regardless of where the organization is headquartered (Article 3)
United Kingdom
72 hours (ICO, UK GDPR)
Post-Brexit, the UK maintains its own version of GDPR (UK GDPR) enforced by the ICO. Cyber Essentials is a government-backed certification scheme increasingly required for public sector contracts.
Mandatory
Commonly expected
Key facts
- UK GDPR mirrors EU GDPR with local adaptations
- ICO can fine up to £17.5M or 4% of global turnover
- Cyber Essentials: mandatory for government contracts handling sensitive data
- NCSC Cyber Assessment Framework for critical infrastructure
- Data adequacy agreement with EU (reviewed every 4 years)
First 30 days
- Self-certify Cyber Essentials Basic if pursuing UK government contracts
- Register with the ICO if you process personal data (most organizations must)
- Map any data transfers to/from EU under the UK-EU adequacy decision
Enforcement actions on record
- £20M — British Airways (2020)
- £18.4M — Marriott (2020)
- £12.7M — TikTok (2023)
- £7.5M — Clearview AI (2022)
Enforced by ICO (Information Commissioner's Office), NCSC. Extraterritorial reach: UK GDPR: applies to any organization offering goods or services to UK residents, mirroring EU GDPR's extraterritorial scope
India
6 hours (CERT-In — the strictest globally)
India's DPDP Act (2023) is the country's first comprehensive data protection law covering 1.4 billion citizens. RBI mandates cybersecurity frameworks for banks, and CERT-In requires 6-hour breach reporting.
Mandatory
Commonly expected
Key facts
- DPDP Act penalties: up to ₹250 crore (~$30M) per violation
- CERT-In: 6-hour incident reporting requirement (strictest globally)
- RBI: mandatory cybersecurity framework for banks and NBFCs
- Data localization requirements for payment data (RBI)
- Significant Data Fiduciaries must appoint DPO and conduct DPIAs
First 30 days
- Map data localization obligations — payment data must reside in India (RBI)
- Wire CERT-In 6-hour incident reporting (cyber.gov.in portal)
- Determine Significant Data Fiduciary status — triggers DPO + DPIA requirements
Enforcement actions on record
- 16M+ — CERT-In incidents/yr (2024)
- ₹50Cr+ — RBI cyber penalties (2023)
- ₹1Cr — ICICI fine (RBI) (2023)
- ₹1.96Cr — Indian Bank (data leak) (2023)
Enforced by Data Protection Board of India, CERT-In, RBI, SEBI. Extraterritorial reach: DPDP Act: applies to any entity processing personal data of Indian citizens, including foreign companies offering goods or services in India
Asia Pacific
Varies — Singapore 72h, Australia 30 days, China promptly (no fixed clock)
APAC has diverse privacy laws: China's PIPL (2021) rivals GDPR in scope, Singapore's PDPA covers cross-border transfers, Japan's APPI was amended in 2022, and Australia is reforming its Privacy Act.
Mandatory
Commonly expected
Key facts
- China PIPL: up to 5% of annual revenue or ¥50M
- Singapore PDPA: fines up to S$1M (~$750K)
- Japan APPI: criminal penalties including imprisonment
- Australia Privacy Act reforms: expected 2025
- APEC Cross-Border Privacy Rules (CBPR) for regional data flows
First 30 days
- Identify jurisdiction-specific obligations — laws differ significantly across APAC
- Wire cross-border data transfer agreements (PIPL, PDPA both require)
- Register DPO with each country's authority if locally required
Enforcement actions on record
- ¥8.026B (~$1.2B) — Didi (China CAC, PIPL) (2022)
- AU$5.7M+ — Optus (Australia) (2024)
- AU$5.7M+ — Medibank (Australia) (2024)
- ¥30M — Yahoo Japan (APPI) (2022)
Enforced by CAC (China), PDPC (Singapore), PPC (Japan), OAIC (Australia). Extraterritorial reach: China PIPL has the broadest extraterritorial reach in APAC; PDPA (Singapore) and APPI (Japan) apply to any organization processing residents' data
Middle East & Africa
72 hours (UAE, Saudi Arabia)
The Middle East and Africa region is rapidly maturing its data protection landscape. UAE's PDPL (2021) and Saudi Arabia's PDPL (2023) introduce GDPR-style protections. South Africa's POPIA (2021) is the continent's most comprehensive privacy law with extraterritorial reach.
Mandatory
Commonly expected
Key facts
- UAE PDPL: fines up to AED 5M (~$1.36M) per violation
- Saudi PDPL: fines up to SAR 5M (~$1.3M) + imprisonment
- South Africa POPIA: fines up to ZAR 10M (~$550K) + 10yr prison
- Bahrain PDPL: up to BHD 20K (~$53K) per violation
- DIFC and ADGM have separate privacy frameworks for free zones
First 30 days
- Confirm whether your operations sit in DIFC, ADGM, or mainland UAE — different frameworks apply
- Map data residency obligations — Saudi PDPL requires localization for sensitive data
- Designate a DPO for Saudi PDPL if processing data of >5000 residents
Enforcement actions on record
- Pending — Saudi PDPL first enforcement (2024)
- AED 100K avg — UAE DIFC privacy fines (2023)
- ZAR 5M — South Africa Info Regulator (2023)
- BHD 20K cap — Bahrain PDPL penalties (2023)
Enforced by UAE Data Office, SDAIA (Saudi), Info Regulator (South Africa), PDP Authority (Bahrain). Extraterritorial reach: South Africa POPIA: applies extraterritorially to processing of personal information by responsible parties not domiciled in South Africa
Compliance requirements by industry
What your sector is actually held to, what it typically costs, and how breaches in it have happened. 5 industries.
Fintech & Banking
$500K–$5M / year (PCI + SOX audits + GLBA)
The most heavily regulated industry for compliance. Banks and fintech companies face overlapping requirements: PCI-DSS for card data, SOX for financial reporting, GLBA for customer privacy, and DORA for EU operational resilience.
Mandatory
Commonly expected
Key risks
- Customer financial data exposure (account numbers, SSNs)
- Payment fraud and unauthorized transactions
- Regulatory fines from multiple agencies simultaneously
- Loss of banking license or charter
- Reputational damage affecting customer deposits
Most common attack vectors
- Account takeover (credential stuffing + MFA bypass)
- BIN attacks on card processors
- Third-party API exposure (open banking)
Typical fine: $5M–$100M (PCI breach) · $50M+ (regulatory). Notable breach: Capital One (2019) — 100M records exposed via misconfigured AWS WAF (SSRF). $190M settlement + $80M OCC fine.
Healthcare
$1M–$10M / year (HIPAA + HITRUST + cyber insurance)
PHI (Protected Health Information) is among the most valuable data on the black market ($250–$1,000 per record). HIPAA violations carry both civil and criminal penalties, including imprisonment.
Mandatory
Commonly expected
Key risks
- PHI exposure (records worth $250+ each on black market)
- Ransomware attacks targeting hospital systems
- Criminal penalties for intentional HIPAA violations
- Loss of Medicare/Medicaid eligibility
- Class-action lawsuits from affected patients
Most common attack vectors
- Ransomware (most-targeted vertical in 2024)
- Phishing leading to EHR account compromise
- Medical device exploits (insulin pumps, imaging)
Typical fine: $1.5M/year per HIPAA category · $250K criminal. Notable breach: Change Healthcare (2024) — ALPHV ransomware. ~190M Americans' PHI exposed. $872M revenue impact + $22M ransom paid. Disrupted US healthcare claims processing nationwide.
SaaS / Technology
$50K–$200K / year (SOC 2 Type II + ISO 27001 + audit fees)
SaaS companies process data for thousands of customers. SOC 2 has become a de-facto requirement — 90% of enterprise buyers require it. The multi-tenant nature of SaaS creates unique compliance challenges.
Mandatory
Commonly expected
Key risks
- Multi-tenant data isolation failures
- Supply chain attacks through CI/CD pipelines
- Shadow IT and unauthorized data processing
- Loss of enterprise deals without SOC 2 ($100K–$10M+)
- GDPR cross-border transfer violations
Most common attack vectors
- Supply chain (CI/CD pipeline compromise, npm typosquats)
- Credential stuffing (compromised customer accounts)
- OAuth token abuse + session-hijack attacks
Typical fine: Revenue loss: $100K–$10M per lost enterprise deal. Notable breach: Okta (2023) — Customer support system breach via stolen session token. 134 customer environments affected. Stock dropped 11% on disclosure.
E-commerce & Retail
$100K–$1M / year (PCI assessments + ASV scans + privacy audits)
E-commerce handles both payment data (PCI-DSS) and consumer privacy data (GDPR/CCPA). Magecart-style attacks and supply chain compromises are the leading threat vectors.
Mandatory
Commonly expected
Key risks
- Credit card skimming (Magecart attacks)
- Customer PII exposure in data breaches
- Supply chain compromise through third-party scripts
- Loss of payment processing ability due to PCI non-compliance
- Consumer class-action lawsuits
Most common attack vectors
- Magecart / digital skimmers on checkout pages
- Account takeover during peak shopping seasons
- Third-party JavaScript supply-chain compromise
Typical fine: $5K–$100K/month (PCI) · $7.5K/violation (CCPA). Notable breach: Target (2013) — 40M cards + 70M customer records. Initial vector: HVAC vendor credentials. Total cost reached $202M including settlements + replacement-card costs.
Government & Defense
$500K–$2M (FedRAMP authorization) + $100K–$500K / year (continuous monitoring)
Government compliance is the most stringent. CMMC 2.0 is now required for all DoD contractors. FedRAMP authorization takes 6-12 months and costs $500K–$2M for cloud providers wanting to serve federal agencies.
Mandatory
Commonly expected
Key risks
- Loss of government contracts (often company's largest revenue)
- National security data exposure
- CUI (Controlled Unclassified Information) mishandling
- Debarment from future government contracting
- Supply chain risks in defense industrial base
Most common attack vectors
- Supply-chain attacks on software vendors
- Spear-phishing of cleared personnel
- Targeted exploitation of edge devices (VPN, firewall)
Typical fine: Contract termination + False Claims Act ($11K+ per violation). Notable breach: SolarWinds (2020) — Supply-chain compromise via SUNBURST backdoor in Orion software updates. ~18,000 customers affected including 9 US federal agencies. SEC charged SolarWinds CISO with fraud — first ever.
What each framework requires — and what it costs to ignore
Plain-language guides to the 14 frameworks we are asked about most: who they apply to, the penalties for falling short, and the steps to get compliant. Every guide links through to the controls EchelonGraph scores for that framework.
SOC 2
Voluntary
SOC 2 is the gold standard for SaaS companies. Customers and enterprise buyers increasingly require SOC 2 reports before signing contracts. It demonstrates your commitment to security, availability, and data privacy.
Applies to
Global, North America · SaaS, Technology, Cloud Services, Fintech
Cost of non-compliance
Not legally required, but losing deals due to lack of SOC 2 compliance can cost $100K–$10M+ in revenue.
Key requirements
- Security policies and procedures
- Access control and authentication
- System monitoring and alerting
- Incident response plan
- Change management process
- Vendor risk management
How to comply
- Define and implement security policies (CC1–CC9)
- Implement continuous monitoring with tools like EchelonGraph
- Conduct annual SOC 2 Type II audit with a CPA firm
- Maintain evidence collection for 12-month observation period
NIST SP 800-53
Legally required
NIST 800-53 is the most comprehensive security control framework in existence. Mandatory for US federal agencies and contractors. Used globally as a baseline for building security programs.
Applies to
United States, Global · Federal Government, Defense, Critical Infrastructure, Healthcare
Cost of non-compliance
Federal contracts can be terminated. CMMC certification (based on NIST) is required for DoD contractors — non-compliance means losing defense contracts worth millions.
Key requirements
- ~300 base controls across 20 families (1,014 including control enhancements)
- Risk assessment (RA) and authorization (CA)
- Access control (AC) and audit (AU)
- System and communications protection (SC)
- Incident response (IR) and contingency planning (CP)
How to comply
- Categorize systems using FIPS 199
- Select baseline controls (Low/Moderate/High)
- Implement controls and document in SSP
- Assess controls and create POA&M for gaps
- Authorize system operation and continuously monitor
CIS Controls v8
Voluntary
CIS Benchmarks provide prescriptive, step-by-step hardening guides for every major platform (AWS, GCP, Azure, Linux, Windows, Kubernetes). They're the most actionable framework for DevOps teams.
Applies to
Global · Technology, SaaS, E-commerce, All Industries
Cost of non-compliance
No direct penalties, but CIS compliance is often required by cyber insurance policies. Failure to comply can increase premiums or void coverage.
Key requirements
- IG1: Essential Cyber Hygiene (56 safeguards)
- IG2: Managed security (130 safeguards)
- IG3: Advanced security (153 safeguards)
- Platform-specific benchmarks (AWS, GCP, Azure, K8s)
- Automated assessment recommended
How to comply
- Start with IG1 (essential hygiene)
- Run automated CIS benchmark scans using EchelonGraph
- Remediate critical findings first (password policies, MFA, logging)
- Progress to IG2/IG3 based on risk profile
PCI DSS 4.0
Legally required
If you store, process, or transmit credit card data, PCI-DSS compliance is non-negotiable. Card brands (Visa, Mastercard) require it, and non-compliance results in fines and potential loss of card processing ability.
Applies to
Global · E-commerce, Fintech, Retail, Banking, Payment Processing
Cost of non-compliance
PCI SSC itself levies no fines — it writes the standard and does not monitor implementation. Financial consequences flow from your acquiring bank under your merchant agreement, and the card brands do not publish a penalty schedule, so any specific dollar range you see quoted (including the widely-repeated $5,000-$100,000 per month) is not traceable to a primary source. What is documented: after a breach you face forensic investigation costs, card-reissuance and fraud liability passed through by your acquirer, and potential loss of the ability to process cards.
Key requirements
- Build and maintain secure network (firewalls, encryption)
- Protect cardholder data (encryption at rest and in transit)
- Vulnerability management program
- Strong access control measures (MFA, least privilege)
- Regular monitoring and testing
- Information security policy
How to comply
- Determine your PCI level (1–4 based on transaction volume)
- Complete SAQ (Self-Assessment Questionnaire) or engage a QSA
- Implement all 12 PCI-DSS requirements
- Conduct quarterly ASV scans and annual penetration tests
HIPAA
Legally required
HIPAA protects patients' health information (PHI). Any organization that handles PHI — from hospitals to health tech startups — must comply. Violations can result in criminal charges.
Applies to
United States · Healthcare, Health Insurance, Health IT, Pharmaceuticals
Cost of non-compliance
Civil penalties are inflation-adjusted annually (45 CFR 102.3). Current per-violation ranges: Tier 1 (no knowledge) $145–$73,011; Tier 2 (reasonable cause) $1,461–$73,011; Tier 3 (wilful neglect, corrected) $14,602–$73,011; Tier 4 (wilful neglect, uncorrected) $73,011–$2,190,294, which is also the annual cap per identical provision. Note the annual caps differ BY TIER ($25,000 / $100,000 / $250,000 / $2,190,294). Criminal penalties reach $250,000 and 10 years, but only where the disclosure was for commercial advantage, personal gain or malicious harm.
Key requirements
- Privacy Rule: limits use/disclosure of PHI
- Security Rule: administrative, physical, technical safeguards
- Breach Notification Rule: 60-day notification requirement
- BAA (Business Associate Agreements) with vendors
- Risk analysis and management
How to comply
- Conduct a comprehensive risk analysis
- Implement required safeguards (access controls, encryption, audit logs)
- Execute BAAs with all vendors handling PHI
- Train workforce on HIPAA requirements annually
- Establish breach notification procedures
ISO/IEC 27001:2022
Voluntary
ISO 27001 is the international gold standard for Information Security Management Systems (ISMS). It's recognized by 170+ countries and increasingly required in enterprise procurement and government tenders.
Applies to
Global, Europe, Asia Pacific · All Industries, Technology, Financial Services, Government
Cost of non-compliance
Not legally mandated (except in some countries), but losing ISO 27001 certification can result in loss of enterprise contracts, government tenders, and customer trust.
Key requirements
- ISMS establishment and scope definition
- Risk assessment and treatment methodology
- 93 controls across 4 themes (Organizational, People, Physical, Technological)
- Statement of Applicability (SoA)
- Management review and continual improvement
How to comply
- Define ISMS scope and information security policy
- Conduct risk assessment using a recognized methodology
- Implement Annex A controls and create SoA
- Conduct internal audit and management review
- Engage accredited certification body for Stage 1 + Stage 2 audit
GDPR
Legally required
GDPR applies to ANY organization processing data of EU residents — even if you're based outside the EU. It's the most consequential data protection law globally, with extraterritorial reach.
Applies to
European Union, EEA, United Kingdom · All Industries processing EU data
Cost of non-compliance
Up to €20 million or 4% of global annual revenue, whichever is higher. Meta was fined €1.2 billion in 2023.
Key requirements
- Lawful basis for processing personal data
- Data Protection Impact Assessments (DPIAs)
- Data Subject Rights (access, deletion, portability)
- 72-hour breach notification
- Data Protection Officer (DPO) appointment
- Data processing agreements with processors
How to comply
- Map all personal data processing activities (ROPA)
- Establish lawful basis for each processing activity
- Implement privacy by design and by default
- Appoint a DPO if required
- Establish data breach response procedures
MITRE ATT&CK
Voluntary
MITRE ATT&CK is the world's most comprehensive knowledge base of adversary tactics and techniques. Security teams use it to build detection rules, conduct red team exercises, and measure security coverage.
Applies to
Global · Cybersecurity, SOC Teams, Threat Intelligence, Incident Response
Cost of non-compliance
No direct penalties. However, SOC teams without ATT&CK coverage mapping are effectively flying blind — unable to measure or communicate defensive capabilities.
Key requirements
- 14 tactics (Reconnaissance → Impact)
- 201+ techniques and sub-techniques
- Enterprise, Mobile, and ICS matrices
- Mapping detection coverage to ATT&CK techniques
- Threat-informed defense strategy
How to comply
- Map existing detections to ATT&CK techniques
- Identify coverage gaps across the kill chain
- Prioritize high-impact techniques relevant to your threat model
- Build detection rules for priority techniques
- Conduct purple team exercises to validate coverage
NIST Cybersecurity Framework 2.0
Voluntary
NIST CSF (Cybersecurity Framework) provides a risk-based approach to managing cybersecurity. Unlike NIST 800-53 (which is control-heavy), CSF focuses on outcomes: Govern, Identify, Protect, Detect, Respond, Recover.
Applies to
United States, Global · All Industries, Critical Infrastructure, Technology
Cost of non-compliance
Not legally mandated for the private sector, but increasingly referenced in insurance underwriting, board governance and regulatory guidance. Note that the SEC's cybersecurity disclosure rules are framework-neutral — they require disclosure of your processes, not alignment with CSF or any named framework.
Key requirements
- 6 core functions: Govern, Identify, Protect, Detect, Respond, Recover
- Risk assessment and prioritization
- Supply chain risk management
- Organizational context and governance
- Continuous improvement process
How to comply
- Create an organizational profile mapping current vs target state
- Identify and assess cyber risks using CSF categories
- Implement priority actions across all 6 functions
- Monitor and measure progress toward target profile
India DPDP Act
Legally required
India's Digital Personal Data Protection Act (2023) is the country's first comprehensive data protection law. With 1.4 billion citizens online, it applies to any entity processing Indian citizens' data — including companies outside India.
Applies to
India · All Industries operating in India, Technology, BPO/IT Services
Cost of non-compliance
NOT YET ENFORCEABLE — the penalty provisions (ss.33-34) commence around May 2027. When they do, the Schedule sets per-breach ceilings, not one flat cap: ₹250 crore (~US$26M) applies specifically to failing to take reasonable security safeguards (s.8(5)); ₹200 crore for breach-notification failure and for children's data; ₹150 crore for Significant Data Fiduciary duties; and ₹50 crore for any other contravention. There is no turnover-based element. What IS live today is the CERT-In direction of 28 April 2022 requiring cyber incidents — including data breaches and leaks — to be reported within 6 hours.
Key requirements
- Consent-based data processing with clear notice
- Data Principal rights (access, correction, erasure, grievance)
- Data Fiduciary obligations (purpose limitation, data minimization)
- Cross-border transfers permitted by default — the Government may notify restricted countries (s.16); none notified to date
- Data Protection Board established Nov 2025 (members not yet appointed)
- Significant Data Fiduciary obligations (DPO, audit, DPIA)
How to comply
- Map all personal data processing activities
- Implement consent management system
- Appoint Data Protection Officer (if Significant Data Fiduciary)
- Establish grievance redressal mechanism
- Meet the CERT-In 6-hour incident report today; prepare for DPDP Rule 7 (Board notice without delay, detailed report within 72 hours) from ~May 2027
ISMS-P (Korea)
Legally required
ISMS-P (Information Security and Personal Information Protection Management System) is South Korea's certification combining ISO 27001-style controls with the Personal Information Protection Act (PIPA). Certification is mandatory for defined categories under Article 47(2) of the Network Act: qualifying ISPs and MVNOs, IDC operators, and entities crossing the Enforcement Decree thresholds (ICT-services revenue of at least KRW 10bn, or a daily average of 1,000,000 users, or revenue of at least KRW 150bn for tertiary hospitals and universities with 10,000+ students). Cloud providers are not named as a category — Korean cloud has its own CSAP scheme.
Applies to
South Korea · Technology, Telecommunications, Financial Services, E-commerce
Cost of non-compliance
Failing to obtain the required certification carries an administrative fine (과태료) of up to KRW 30 million (~US$21,000) under Article 76(1) of the Network Act. Separately, PIPA Article 64-2 allows a surcharge of up to 3% of TOTAL revenue, calculated on total revenue excluding revenue unrelated to the violation — or up to KRW 2 billion where revenue cannot be computed.
Key requirements
- 101 control items across 3 areas and 21 sub-fields (16 management system + 64 protection measures + 21 personal-information lifecycle)
- Management system establishment and operation
- Personal information lifecycle management
- Technical protection measures
- Physical security controls
- Annual certification audit
How to comply
- Establish ISMS scope covering all information assets
- Implement 104 control items across 16 domains
- Conduct risk assessment and treatment
- Apply for certification through KISA-accredited auditor
- Maintain certification with annual surveillance audits
NIS2 Directive
Legally required
NIS2 is the EU's landmark cybersecurity directive effective October 2024, replacing NIS1. It covers 18 essential and important sectors, imposes personal liability on senior management, and requires 24-hour early warning for significant incidents. Non-compliance can result in fines up to €10M or 2% of global turnover.
Applies to
European Union, EEA · Energy, Transport, Banking, Health, Digital Infrastructure, ICT Service Management, Public Administration, Manufacturing
Cost of non-compliance
Essential entities: up to €10M or 2% of global annual turnover. Important entities: up to €7M or 1.4% of turnover. Senior management can be held personally liable and temporarily banned from management roles.
Key requirements
- Risk management measures (technical, operational, organizational)
- 24-hour early warning + 72-hour incident notification
- Supply chain security assessment and management
- Business continuity and crisis management planning
- Senior management accountability and cybersecurity training
- Regular security audits and vulnerability assessments
How to comply
- Determine if your organization is an essential or important entity
- Conduct comprehensive risk assessment across all ICT systems
- Implement risk management measures per Article 21
- Establish incident response and 24-hour reporting capability
- Assess and manage supply chain cybersecurity risks
- Train senior management on cybersecurity governance
DORA (Digital Operational Resilience Act)
Legally required
DORA (Digital Operational Resilience Act) is an EU regulation enforceable since January 2025 that mandates ICT resilience for the entire financial sector. Unlike NIS2 (a directive), DORA is directly applicable in all EU member states without transposition. It introduces oversight of critical ICT third-party providers.
Applies to
European Union · Banking, Insurance, Investment Firms, Payment Institutions, Crypto-Asset Providers, ICT Third-Party Providers
Cost of non-compliance
DORA itself sets no fine amounts for financial entities. Article 50 requires each Member State to lay down 'effective, proportionate and dissuasive' penalties, so the ceiling depends on where you are supervised — check your national implementing law. The one amount fixed in the Regulation applies to designated CRITICAL ICT third-party providers: a periodic penalty payment of up to 1% of average DAILY worldwide turnover, charged daily for up to six months (Article 35(6)–(8)). That is a daily coercive payment to compel compliance, not a one-off fine.
Key requirements
- ICT risk management framework with governance structure
- ICT-related incident classification and reporting
- Digital operational resilience testing (TLPT for systemically important entities)
- ICT third-party risk management and contractual requirements
- Information sharing arrangements between financial entities
- Oversight framework for critical ICT third-party providers
How to comply
- Establish ICT risk management framework with board oversight
- Implement incident classification and reporting to competent authority
- Develop and execute digital resilience testing program
- Review and update all ICT third-party contracts for DORA compliance
- Conduct threat-led penetration testing (TLPT) if systemically important
- Participate in information sharing arrangements
CMMC 2.0 Level 2
Legally required
CMMC 2.0 (Cybersecurity Maturity Model Certification) is now required for all DoD contractors handling CUI (Controlled Unclassified Information) or FCI (Federal Contract Information). The final rule took effect December 2024. Without CMMC certification, organizations cannot bid on DoD contracts — a $400B+ annual market.
Applies to
United States · Defense, Aerospace, Government Contractors, Defense Industrial Base
Cost of non-compliance
Loss of eligibility for the DoD contracts that carry the requirement, plus False Claims Act exposure for misrepresenting your status: $14,308–$28,619 per claim plus treble damages (28 CFR 85.5), and potential debarment. Status as of August 2026: DoD suspended CMMC Phase II on 13 July 2026, so requiring activities may currently designate only Level 1 (Self) or Level 2 (Self) assessment — not third-party certification. Verify the current phase before relying on this.
Key requirements
- Level 1 (Foundational): 15 practices based on FAR 52.204-21 (self-assessment)
- Level 2 (Advanced): 110 practices aligned to NIST SP 800-171r2 (C3PAO assessment)
- Level 3 (Expert): 110+ practices based on NIST SP 800-172 (government-led assessment)
- POA&M (Plan of Action and Milestones) for any gaps
- Annual affirmation of compliance
- Continuous monitoring and incident reporting
How to comply
- Determine required CMMC level based on contract requirements
- Scope your CUI/FCI environment and asset inventory
- Implement NIST SP 800-171r2 controls for Level 2
- Conduct gap assessment and create POA&M
- Engage C3PAO (Certified Third-Party Assessment Organization) for Level 2
- Achieve certification and maintain annual affirmation
How we score compliance
Every score is produced by a pure-function evaluator run against your real cloud state on every scan cycle — never a questionnaire and never a self-assessment. Each control returns one of four verdicts, scored independently per cloud provider:
Compliance questions, answered
What cloud security compliance frameworks does EchelonGraph cover?
How is EchelonGraph's compliance encyclopedia different from other tools?
Which cloud providers does EchelonGraph scan for compliance?
How many security controls does EchelonGraph's compliance encyclopedia include?
What is AI Workload Compliance and why is it unique?
How does live real-time compliance scoring work?
How is EchelonGraph's compliance scoring different from questionnaire-based tools?
What's the difference between SOC 2 and ISO 27001?
How long does SOC 2 Type II certification take?
What are the penalties for a GDPR violation?
Who needs to comply with HIPAA?
When does the EU AI Act apply to my company?
What is NIS2 and which sectors does it cover?
How are CIS Benchmarks different from CIS Controls?
Is NIST Cybersecurity Framework (CSF) mandatory in the United States?
Beyond Documentation — Automated Compliance
EchelonGraph automatically detects compliance violations across your entire cloud infrastructure. 440+ rules running continuously — not just documentation.