DFARS 252.204-7012: Defense Federal Acquisition Regulation Supplement that specifies safeguarding requirements for covered defense information and cyber incident reporting
NIST SP 800-171: National Institute of Standards and Technology Special Publication providing requirements for protecting Controlled Unclassified Information in non-federal systems
FISMA: Federal Information Security Management Act that provides a framework for protecting government information, operations and assets against threats
FAR: Federal Acquisition Regulation that serves as the primary regulation for use by federal agencies in their acquisition of supplies and services
NIST Cybersecurity Framework: Voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk
NIST SP 800-53: Security and privacy controls standard for federal information systems and organizations
ISO 27001: International standard for information security management systems (ISMS)
ITAR: International Traffic in Arms Regulations controlling the export and import of defense-related articles and services
EAR: Export Administration Regulations controlling the export of commercial and dual-use items
CUI Requirements: Controlled Unclassified Information requirements for handling and protecting sensitive but unclassified information
Privacy Act of 1974: Federal law establishing a Code of Fair Information Practice governing the collection, maintenance, use, and dissemination of personal information
State Privacy Laws: Various state-specific privacy laws that may impact access control requirements depending on business location
DoD Requirements: Department of Defense specific requirements for contractors and subcontractors handling defense information
DIB Requirements: Defense Industrial Base specific requirements for cybersecurity and information protection
SSP Requirements: System Security Plan documentation requirements outlining the implementation of security controls
POA&M Requirements: Plan of Action and Milestones documentation requirements for tracking and planning the resolution of information security weaknesses
