HIPAA Security Rule
Baseline cybersecurity obligation for covered entities and business associates that create, receive, maintain, or transmit ePHI.
Cybersecurity resource map
Industry Cybersecurity Links
Browse by industry first, then jump to the relevant laws, standards, controls, official guidance, free training, and reporting resources.
01
Healthcare and public health.
HHS healthcare cybersecurity guidance
Healthcare-sector threat briefings, practice guides, and operational resources for hospitals, clinics, providers, and health partners.
CISA healthcare and cross-sector guidance
Healthcare-specific CISA resources plus cross-sector goals that help prioritize minimum viable cyber defense practices.
02
Defense contractors and DIB.
FAR and DFARS contract clauses
Start here for federal contract information, covered defense information, cyber incident reporting, and NIST SP 800-171 assessment clauses.
CMMC and DoD documentation
Official DoD CMMC resource library for model guidance, scoping guides, assessment guides, and program references.
NIST CUI security requirements
Core CUI control requirements and assessment procedures used by defense contractors and other nonfederal organizations handling CUI.
DoD hardening and CUI training
DISA STIG baselines and government training resources for teams implementing defense-sector security requirements.
03
U.S. federal government systems.
FISMA, RMF, and system categorization
Federal systems typically start with risk management, impact categorization, and minimum security requirements.
NIST SP 800-53 Rev. 5
Federal control catalog used for security and privacy controls, baselines, assessment planning, and framework mappings.
FedRAMP and federal cloud
Authorization resources for cloud services used by federal agencies and federal data environments.
Federal acquisition and OMB policy
Acquisition and policy references that often sit next to technical control work in federal cybersecurity programs.
04
Cloud and SaaS providers.
ISO/IEC 27000 series
Information security management standards for ISMS requirements, control selection, and security program governance.
CSA STAR and Cloud Controls Matrix
Cloud assurance resources for provider transparency, questionnaire mapping, and cloud-specific control coverage.
CIS cloud benchmarks
Configuration hardening baselines for cloud platforms, operating systems, network devices, containers, and SaaS environments.
Cloud application security
Application verification, API security, and secure development references for cloud-delivered products.
05
Financial services.
FFIEC cybersecurity resources
Supervisory resources for financial institutions, third-party technology risk, cloud, authentication, exercises, and resilience planning.
FTC Safeguards Rule and GLBA
Security program obligations for covered financial institutions under FTC jurisdiction and related customer information safeguards.
DORA and operational resilience
EU digital operational resilience references for financial entities with ICT risk, incident reporting, testing, and third-party exposure.
06
Critical infrastructure and OT.
CISA Cybersecurity Performance Goals
Cross-sector baseline security practices for critical infrastructure owners and operators.
ICS and OT cybersecurity training
Free industrial control system cybersecurity training and CISA resources for operational technology defenders.
Electric sector and NERC CIP
Reliability standards for bulk electric system cybersecurity and electric-sector security operations.
Incident reporting and sector support
CISA and federal reporting entry points for critical infrastructure incidents, vulnerabilities, phishing, malware, and ransomware.
07
Education and public sector.
Student privacy and education data security
Security and privacy references for K-12, higher education, student records, cloud services, and education data handling.
State, local, tribal, and territorial security
Cybersecurity coordination, alerts, and shared services for public-sector organizations outside the federal enterprise.
Public safety and justice systems
References for law enforcement cybercrime reporting, public safety awareness, and criminal justice information security.
08
Software and product security.
OWASP application security
Common application risks, verification requirements, developer guidance, and API security references.
Secure implementation references
Developer-focused cheat sheets and weakness lists for authentication, authorization, crypto, logging, and secure coding review.
NIST Secure Software Development Framework
Secure software development practices for organizing requirements, implementation, verification, release, and response work.
09
Small business and general organizations.
CISA and FTC starter guidance
Practical cybersecurity basics for smaller organizations, general staff awareness, and non-specialist leadership.
CIS Controls and SANS resources
Prioritized controls, hardening benchmarks, templates, and practitioner resources that apply across most industries.
10
Free government training.
CUI Training
Government-wide and DoD training for recognizing, marking, safeguarding, decontrolling, destroying, and reporting CUI incidents.
CISA Learning and NICCS catalog
No-cost cybersecurity training, workforce development courses, and searchable learning paths.
NIST NICE online learning
Free and low-cost cybersecurity learning content aligned to workforce development and practitioner growth.
11
Cyber agencies by region.
North America
U.S. and Canada cyber agencies, standards, cybercrime reporting, and national cybersecurity guidance.
PAC / APAC
Pacific and Asia-Pacific national cyber agencies and CERTs for advisories, reporting, and regional guidance.
LATAM
Latin America and Caribbean coordination, CSIRT networks, and national incident response resources.
European Union
EU cybersecurity agency, institutional CERT, cybercrime support, and resilience regulation references.
12
Alerts, vulnerabilities, and reporting.
CISA advisories and KEV catalog
Federal cybersecurity advisories and known exploited vulnerabilities for remediation prioritization.
NVD, CVE, and MITRE ATT&CK
Vulnerability records, identifiers, scoring references, and adversary technique knowledge base.
Vendor security advisories
Product-specific update portals for tracking security releases and remediation guidance.
Public reporting and recovery
Cybercrime, identity theft, and ransomware reporting or recovery resources for public-facing support situations.