Start with the legal entity, activities and applicable obligations; a sector label is not a complete requirements specification. Use official requirements to define the records and decisions that must be supported, then translate them into buyer acceptance tests.
| Context | Official source establishes | Suggested platform test—not a legal requirement in itself |
|---|---|---|
| Banking third-party risk | Interagency guidance addresses the relationship lifecycle through termination. OCC | Follow one supplier from approval to monitoring, exception and exit |
| FTC-regulated financial institutions | The Safeguards Rule applies within the FTC’s jurisdiction, not indiscriminately to every financial institution. FTC guide | Trace applicable security requirements to owners, safeguards and review evidence |
| NYDFS-covered entities | Part 500 applies to defined covered entities, with exemptions requiring separate consideration. DFS resource centre | Preserve entity applicability, assessment decisions and relevant evidence |
| Public-company cyber disclosure | Form 8-K Item 1.05 is generally due four business days after a materiality determination, not simply four days after discovery. SEC rule announcement | Record discovery, escalation, materiality decision and disclosure approval separately |
| Integrated ICFR audits | PCAOB AS 2201 addresses testing and evidence supporting conclusions about internal control. Standard | Preserve testing, review, deficiencies and remediation history |
The table is selective, not an exhaustive legal inventory. (occ.gov)
Date discipline matters. NYDFS’s implementation timeline placed the relevant MFA and asset-inventory transition provisions on 1 November 2025; that date is already past, not a future 2026 deadline. Applicability and exemptions still need review. Official timeline. (dfs.ny.gov)
Similarly, do not present a framework mapping as a certification or legal conclusion. NIST says its CSF does not require particular technologies or products and that most organisations use it voluntarily. NIST FAQ. (nist.gov)
Sources cited on this page
- OCC ↗www.occ.gov
- FTC guide ↗www.ftc.gov
- DFS resource centre ↗www.dfs.ny.gov
- SEC rule announcement ↗www.sec.gov
- Standard ↗pcaobus.org
- occ.gov ↗www.occ.gov
- Official timeline ↗www.dfs.ny.gov
- NIST FAQ ↗www.nist.gov