Single-requirement comparisons across frameworks: incident reporting deadlines, penetration testing, fines, log retention, MFA, patching, third-party risk, management accountability, audit frequency, published costs and the kind of proof each framework produces.
Every reporting clock side by side for teams that must notify more than one authority: NIS2 24 hours, 72 hours and one month; DORA 4 and 24 hours; GDPR 72 hours; HIPAA 60 days; Cyber Resilience Act 24 hours; NERC CIP one hour; DFARS 72 hours; SEC Form 8-K four business days. Covers triggers and how to build one playbook.
Which frameworks require a penetration test, how often and who may run it: PCI DSS yearly internal and external tests, SOC 2 where it is only a point of focus, HIPAA today and under the proposed rule, DORA threat-led testing every three years, CIS Safeguard 18.2, CMMC Level 3 and NIST 800-53 CA-8. For buyers scoping one test to satisfy several audits.
Maximum penalties side by side, only as written in law or regulator rules: GDPR, NIS2, the EU AI Act and the Cyber Resilience Act turnover-based fines, HIPAA civil money penalties, NERC per-violation per-day penalties, SOX criminal penalties for false certification, and PCI DSS, where the council itself fines no one.
How long logs must be kept under each framework and which ones leave it to you: PCI DSS 12 months with three immediately available, CIS Safeguard 8.10 and NERC CIP 90 days, NIS2 and DORA entity-defined periods, CMMC long enough to investigate, and HIPAA six-year documentation retention. For teams sizing SIEM storage once for several audits.
Where multi-factor authentication is mandatory and for which access: PCI DSS 8.4 for all CDE access, CMMC IA.L2-3.5.3 with its partial-credit scoring, Essential Eight, CIS Safeguards 6.3 and 6.4, NIS2 where appropriate, NERC CIP Interactive Remote Access, Swift control 4.2, and HIPAA under the proposed rule. For identity teams planning one rollout.
Scan frequencies and patch windows each framework fixes or leaves open: PCI DSS quarterly scans and one month for critical patches, CIS quarterly internal scans, Essential Eight 48-hour windows, NERC CIP 35-day evaluation cycles, NIS2 reasonable time, CMMC one-year cap on periodic activities, and the HIPAA proposed six-month scans.
What each framework makes you do about vendors: DORA register of information, NIS2 supply chain security, PCI DSS 12.8 service provider management, SOC 2 CC9.2, HIPAA business associate contracts, NERC CIP-013 supply chain plans and CMMC flowdown. For procurement and security teams building one vendor review that satisfies several regimes.
What executives personally approve, sign or answer for: NIS2 management body approval, oversight and training, DORA management body ultimate responsibility for ICT risk, SOX Section 302 and 906 officer certifications, and the CMMC senior affirming official. For boards and executives deciding how to organize oversight.
Assessment cycles side by side for planning a compliance calendar: SOC 2 report periods, the three-year ISO certification cycle with yearly audits, annual PCI DSS assessment, CMMC three-year assessments with annual affirmation, HITRUST one and two year certifications, the annual Swift attestation, NERC three-year audits and DORA threat-led tests every three years.
Only the cost figures regulators and official bodies have published: Justice Department estimates for SOC 2 audits, DoD estimates for CMMC Level 2 assessments, SEC studies of SOX 404, Commission impact assessments for the Cyber Resilience Act, EU AI Act and DORA testing, and where no official figure exists, as for PCI DSS and HITRUST.
For teams answering "are you certified?": which frameworks end in a certificate from an accredited body (ISO 27001, HITRUST, CMMC), which in a CPA attestation report (SOC 2), which in an assessor report and attestation of compliance (PCI DSS), and which have no certificate at all (HIPAA, the NIST CSF, NIS2), and what each proof is worth to a customer.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.