Frameworks and Compliance Terms
Customers, insurers, payment processors, and regulators often ask which security standard your business follows. These terms explain the frameworks and rules small businesses actually run into, such as PCI DSS, HIPAA, the NIST Cybersecurity Framework, and CMMC. Each one covers who it applies to, what it requires, and where to read the official text.
Start here
- NIST Cybersecurity Framework (CSF 2.0): A voluntary NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
- CIS Controls: A prioritized set of specific security safeguards from the Center for Internet Security, grouped into Implementation Groups.
- PCI DSS: The PCI Security Standards Council standard of technical and operational requirements for any entity that stores, processes, or transmits payment card data.
- HIPAA Security Rule: The federal rule requiring administrative, physical, and technical safeguards for electronic protected health information.
- SOC 2: An independent CPA examination of a service organization's controls under the AICPA Trust Services Criteria.
- Zero trust: A security approach that grants no implicit trust based on network location and verifies every access request.
- CMMC: The Defense Department program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information.
Last updated October 14, 2026.