# 20. Which US regulatory requirements should influence GRC platform selection?

Start with the legal entity, activities and applicable obligations; a sector label is not a complete requirements specification. Use official requirements to define the records and decisions that must be supported, then translate them into buyer acceptance tests.

| Context | Official source establishes | Suggested platform test—not a legal requirement in itself |
|---|---|---|
| Banking third-party risk | Interagency guidance addresses the relationship lifecycle through termination. [OCC](https://www.occ.gov/news-issuances/news-releases/2023/nr-ia-2023-53.html) | Follow one supplier from approval to monitoring, exception and exit |
| FTC-regulated financial institutions | The Safeguards Rule applies within the FTC’s jurisdiction, not indiscriminately to every financial institution. [FTC guide](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) | Trace applicable security requirements to owners, safeguards and review evidence |
| NYDFS-covered entities | Part 500 applies to defined covered entities, with exemptions requiring separate consideration. [DFS resource centre](https://www.dfs.ny.gov/cybersecurity) | Preserve entity applicability, assessment decisions and relevant evidence |
| Public-company cyber disclosure | Form 8-K Item 1.05 is generally due four business days after a materiality determination, not simply four days after discovery. [SEC rule announcement](https://www.sec.gov/newsroom/press-releases/2023-139) | Record discovery, escalation, materiality decision and disclosure approval separately |
| Integrated ICFR audits | PCAOB AS 2201 addresses testing and evidence supporting conclusions about internal control. [Standard](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201) | Preserve testing, review, deficiencies and remediation history |

The table is selective, not an exhaustive legal inventory. ([occ.gov](https://www.occ.gov/news-issuances/news-releases/2023/nr-ia-2023-53.html?utm_source=openai))

**Date discipline matters.** NYDFS’s implementation timeline placed the relevant MFA and asset-inventory transition provisions on **1 November 2025**; that date is already past, not a future 2026 deadline. Applicability and exemptions still need review. [Official timeline](https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf). ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf))

Similarly, do not present a framework mapping as a certification or legal conclusion. NIST says its CSF does not require particular technologies or products and that most organisations use it voluntarily. [NIST FAQ](https://www.nist.gov/cyberframework/faqs). ([nist.gov](https://www.nist.gov/cyberframework/faqs))