Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
[{"title":"NIS2 Directive Official Text (EUR-Lex)","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"},{"title":"ISO/IEC 27001 Information Security Management","url":"https://www.iso.org/standard/27001"},{"title":"NIST Cybersecurity Framework","url":"https://www.nist.gov/cyberframework"}]
Cybersecurity Compliance
Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.
Overview
Cybersecurity is no longer just a technical concern — it is a regulated activity. Mandatory incident reporting, board-level accountability, and third-party risk requirements are expanding globally. Organizations that experience a cyber incident face not only the technical challenge of response and recovery but also a complex web of legal obligations with strict timelines. Failure to comply with these obligations can result in penalties that compound the damage of the underlying incident. Understanding your reporting obligations, certification requirements, and insurance coverage before an incident occurs is essential.
One of the most critical aspects of cybersecurity compliance is understanding how quickly you must report an incident and to whom. These timelines begin running from the moment you become aware of the incident, making rapid detection and assessment capabilities essential.
Jurisdiction / Law
Timeline
Notify Whom
Trigger
GDPR
72 hours
Supervisory authority + data subjects if high risk
Personal data breach
NIS2
24hr early warning + 72hr notification + 1 month final report
CSIRT / competent authority
Significant incident
HIPAA
60 days
HHS + individuals + media if >500 affected
PHI breach
SEC
4 business days
SEC on Form 8-K
Material cybersecurity incident
California
Expedient, without unreasonable delay
AG + individuals
Personal information breach
Australia
30 days assessment + notification
OAIC + individuals
Eligible data breach
Key considerations:
Multiple notification obligations can be triggered by a single incident. A data breach affecting EU residents' personal data that also constitutes a significant NIS2 incident requires parallel notifications under both GDPR and NIS2 with different timelines and recipients.
The definition of "awareness" or "discovery" that starts the clock varies by jurisdiction. Some laws start the clock when you reasonably should have known, not when you actually confirmed.
Late notification can itself be a separate violation carrying its own penalties.
Security Certifications and Frameworks
Many customers, partners, and regulators require evidence of your security posture through formal certifications or audit reports. Choosing the right framework depends on your market, customer base, and regulatory environment.
Framework
Type
Scope
Who Needs It
SOC 2
Audit report (Type I or Type II)
Service organizations
SaaS vendors selling to enterprises
ISO 27001
Certifiable international standard
Any organization
Global enterprises, particularly in EU and APAC
FedRAMP
US federal government authorization
Cloud services for federal agencies
US government contractors and cloud providers
StateRAMP
State government authorization
Cloud services for state/local government
State and local government contractors
CMMC
DoD certification (Levels 1-3)
Defense contractors
US defense supply chain
TISAX
Automotive industry certification
Automotive supply chain
Automotive suppliers and partners
HDS
Healthcare hosting certification
Healthcare data hosting in France
Organizations hosting healthcare data in France
SOC 2 vs. ISO 27001: SOC 2 is dominant in North America and focuses on controls relevant to service organizations (security, availability, processing integrity, confidentiality, privacy). ISO 27001 is more widely recognized internationally and provides a certifiable information security management system (ISMS). Many organizations pursue both.
FedRAMP: If you sell cloud services to US federal agencies, FedRAMP authorization is effectively mandatory. The process is rigorous and can take 12-18 months. FedRAMP Rev 5 aligns with NIST SP 800-53 Rev 5 controls. The FedRAMP authorization boundary must be clearly defined and all components within it must meet the required control baselines (Low, Moderate, or High).
CMMC: The Cybersecurity Maturity Model Certification is required for Department of Defense contractors. CMMC 2.0 simplified the model to three levels: Level 1 (foundational, self-assessment), Level 2 (advanced, third-party assessment for critical programs), and Level 3 (expert, government-led assessment). Level 2 aligns with NIST SP 800-171.
Cyber Insurance
Cyber insurance has become an important component of organizational risk management, and insurers are increasingly prescriptive about the security controls they require.
What cyber insurance typically covers:
First-party coverage — Direct costs to your organization: incident response and forensics, business interruption losses, data recovery costs, ransomware payments (where legal), notification costs, credit monitoring for affected individuals, public relations and crisis management.
Third-party coverage — Claims from others: regulatory fines and penalties (where insurable), legal defense costs, settlements and judgments from lawsuits, media liability.
Common insurer requirements:
Insurers increasingly require specific security controls as a condition of coverage. Failure to maintain these controls can void your policy or result in claim denial:
Multi-factor authentication (MFA) on all remote access, email, and privileged accounts
Endpoint detection and response (EDR) deployed across all endpoints
Regular, tested backups with offline or immutable copies
Documented incident response plan that is tested at least annually
Employee security awareness training conducted regularly
Patch management program with defined timelines for critical vulnerabilities
Privileged access management with least-privilege principles
Email security including anti-phishing controls
Premium factors: Premiums are influenced by industry, revenue, data volume, security maturity, claims history, and the specific controls you have in place. Organizations with strong security postures and certifications (SOC 2, ISO 27001) often receive more favorable terms.
Incident Response Plan
Multiple regulations now legally require organizations to maintain and test an incident response plan. Beyond regulatory compliance, a well-prepared incident response capability dramatically reduces the cost and impact of security incidents.
Regulations requiring incident response plans:
NIS2 (Article 21 — incident handling)
DORA (Article 17 — ICT-related incident management process)
Many state breach notification laws implicitly require response readiness
Key components of a compliant incident response plan:
Detection and analysis — How incidents are identified, classified by severity, and triaged. Define what constitutes a reportable incident under each applicable regulation.
Containment — Immediate actions to limit the scope and impact of the incident. Short-term containment (isolate affected systems) and long-term containment (apply fixes while maintaining business operations).
Legal notification and regulatory coordination — Mapped timelines and procedures for every applicable notification obligation. Legal counsel should be involved immediately to manage privilege and direct the response.
Forensic investigation — Evidence preservation, chain of custody, root cause analysis. Use qualified forensic investigators, and be aware that forensic reports may be discoverable in litigation unless properly protected by attorney-client privilege.
Eradication and recovery — Remove the threat, restore affected systems, verify integrity, and return to normal operations with enhanced monitoring.
Post-incident review and lessons learned — Document what happened, what worked, what did not, and what changes are needed. Many regulations (NIS2, DORA) require formal post-incident reports.
Critical legal consideration: Involve legal counsel at the start of any incident response, not at the end. Communications during incident response may be discoverable in subsequent litigation or regulatory proceedings. Structuring the response under attorney-client privilege can protect sensitive assessments and recommendations.
Best Practices
Recognize that cyber incidents trigger mandatory legal obligations, and legal counsel should be part of the incident response team from the first moment. Delaying legal involvement can result in missed notification deadlines, waived privilege, and increased liability.
Map all of your notification obligations before an incident occurs. Create a matrix of every regulation, customer contract, and insurance policy that imposes notification requirements, including timelines, recipients, content requirements, and methods. Do not try to figure this out during the chaos of an active incident.
Pursue security certifications strategically based on your market. SOC 2 for North American enterprise sales, ISO 27001 for international markets, FedRAMP for US government, CMMC for defense. These certifications also demonstrate due diligence in regulatory and litigation contexts.
Test your incident response plan at least annually through tabletop exercises. Include technical staff, legal counsel, executive leadership, and communications teams. Simulate scenarios that trigger multiple notification obligations simultaneously.
Maintain cyber insurance and understand your policy's conditions and exclusions. Review your policy annually, ensure you are meeting all required security controls, and understand what is and is not covered — particularly regarding ransomware, nation-state attacks, and war exclusions.
Monitor the regulatory landscape actively. NIS2 transposition into national laws, CIRCIA final rules, and evolving SEC enforcement priorities are all creating new obligations. Assign responsibility for tracking regulatory changes to a specific role.
Implement board-level cybersecurity governance. NIS2 and SEC rules explicitly require board or management body accountability for cybersecurity. Ensure regular reporting to the board, documented risk acceptance decisions, and management training on cyber risk.
Treat third-party risk management as a regulatory requirement, not just a best practice. NIS2, DORA, and many industry frameworks require formal assessment and ongoing monitoring of your supply chain's cybersecurity posture. Maintain an inventory of critical suppliers and their security certifications.
