🇺🇸 United States

HIPAA sets U.S. national standards for protecting individuals' health information. Its Privacy Rule governs use and disclosure of protected health information, and its Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI). On January 6, 2025 HHS proposed an update to the Security Rule (90 FR 898, RIN 0945-AA22), which would require multi-factor authentication, remove the distinction between required and addressable implementation specifications, and set fixed access termination clocks. Comments closed on March 7, 2025; the proposal is not final, and the current Unified Agenda lists it as a long-term action with final action projected for July 2027.

The Gramm-Leach-Bliley Act requires financial institutions to protect the security and confidentiality of customer information. The FTC Safeguards Rule implements GLBA for non-bank financial institutions and, as amended in 2023, prescribes specific controls including access controls, encryption, and multi-factor authentication.

The Sarbanes-Oxley Act established corporate accountability and financial reporting reforms for U.S. public companies. Section 404 requires management to establish, maintain, and assess internal control over financial reporting (ICFR). Effective ICFR depends heavily on IT general controls such as access management and segregation of duties.

The CCPA grants California consumers rights over their personal information, and the CPRA expanded those rights and created the California Privacy Protection Agency. Businesses must honor rights to know, delete, correct, and opt out of sale or sharing, and must verify consumer identity before fulfilling requests. CPPA regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits took effect on 1 January 2026, with ADMT compliance due from 1 January 2027 and the first audit certifications from 1 April 2028 for the largest businesses.

COPPA regulates the online collection of personal information from children under 13. Operators of child-directed sites and services must give notice and obtain verifiable parental consent. The FTC's 2025 Rule amendments expanded covered personal information to include biometric and government identifiers.

NIST SP 800-63 is the U.S. federal reference for digital identity, defining models and risk-based assurance levels for identity proofing (IAL), authentication (AAL), and federation (FAL). It is mandatory for many federal systems and widely adopted as a best-practice benchmark by private organizations. Revision 4 was published in 2025.

The CJIS Security Policy sets the minimum security requirements for anyone who accesses, processes, stores or transmits criminal justice information (CJI) from FBI CJIS systems. Its modernized control set, aligned with NIST SP 800-53 and the authenticator requirements of NIST SP 800-63B, requires multi-factor authentication for every user account. Version 6.1, effective June 26, 2026, is a corrections release that clarifies authentication cross-references, requires immediate incident reporting, and raises encryption and scanning requirements.

BIPA is an Illinois statute that regulates how private entities collect, store, use, and disclose biometric identifiers and information such as fingerprints, retina or iris scans, voiceprints, and face geometry. It is one of the strictest biometric laws in the US because it gives individuals a private right of action with statutory damages, driving extensive class action litigation.

The VCDPA is Virginia's comprehensive consumer privacy law, effective 1 January 2023, giving residents rights over their personal data and imposing duties on businesses that control or process it. It treats biometric data processed to uniquely identify a person as sensitive data requiring opt-in consent. Enforcement rests solely with the Virginia Attorney General.

The Colorado Privacy Act is a comprehensive consumer privacy law effective 1 July 2023 that grants residents rights over their personal data and requires controllers to honor a universal opt-out mechanism for sale and targeted advertising. It treats biometric data used to identify a person as sensitive data requiring consent, and a 2024 amendment (HB 24-1130, effective 1 July 2025) added detailed obligations for biometric identifiers.

The TDPSA is Texas's comprehensive consumer privacy law, effective 1 July 2024, granting residents rights over their personal data and imposing controller and processor obligations. It treats certain biometric and sensitive data as requiring consent before processing, along with notice when sensitive or biometric data is sold. The Texas Attorney General has exclusive enforcement authority.

The CTDPA is Connecticut's consumer privacy law, in force since 1 July 2023. Amendments under SB 1295 (Public Act 25-113) took effect on 1 July 2026 and made it one of the broadest state laws: it now applies to any controller that processes sensitive data, lowered the general threshold to 35,000 consumers, and added profiling and minors' protections. A further amendment, SB 4 (Public Act 26-64), added changes from 1 October 2026, including a ban on selling precise geolocation data.

The OCPA is Oregon's consumer privacy law, effective 1 July 2024. It is known for giving consumers the right to obtain a list of the specific third parties that received their data, and for covering nonprofits. HB 2008 (2025), effective 1 January 2026, banned the sale of precise geolocation data and of personal data of consumers known to be under 16.

Montana's consumer privacy law took effect on 1 October 2024. Amendments made by SB 297 (2025) cut the applicability thresholds, removed the cure period, added a civil penalty, and introduced duties toward known minors.

The Delaware Personal Data Privacy Act took effect on 1 January 2025 with some of the lowest applicability thresholds of any state law. HB 380, signed on 2 September 2026, lowers them further from 1 January 2027 and expands sensitive data and assessment duties.

The NJDPA is New Jersey's consumer privacy law, effective 15 January 2025. It covers controllers that meet consumer-count thresholds, treats biometric and financial account data as sensitive, and directs the Division of Consumer Affairs to adopt implementing rules.

The TIPA is Tennessee's consumer privacy law, effective 1 July 2025. It has the highest applicability thresholds of the state laws, including a 25 million dollar revenue floor, and is the only one to offer an affirmative defense for controllers whose written privacy program reasonably conforms to the NIST Privacy Framework.

Minnesota's consumer privacy law took effect on 31 July 2025 (31 July 2029 for certain postsecondary institutions). It goes further than most state laws on profiling, giving consumers the right to question a profiling result, learn the reasons and have the decision re-evaluated, and it requires controllers to keep a data inventory.

The MODPA took effect on 1 October 2025 and applies to processing from 1 April 2026. It is the strictest state privacy law on sensitive data: collection and processing must be strictly necessary to provide the requested product or service, and sale of sensitive data is banned outright, even with consent.

Part 500 is New York's cybersecurity regulation for DFS-licensed banks, insurers and other financial services companies, effective 1 March 2017. The Second Amendment, adopted on 1 November 2023, phased in stricter controls, and the final set took effect on 1 November 2025, including multi-factor authentication for any individual accessing any information system and a complete asset inventory. It is one of the few laws that names MFA and privileged access management explicitly.

FERPA is the Family Educational Rights and Privacy Act of 1974, the federal law that protects the privacy of student education records. It gives parents, and eligible students (those who are 18 or attend a postsecondary institution), the right to inspect and amend education records and to consent to most disclosures of personally identifiable information from them. For identity teams, the implementing regulations at 34 CFR Part 99 contain two direct obligations: institutions must use reasonable methods to identify and authenticate anyone they disclose records to, and must use reasonable methods so that school officials reach only the records in which they have a legitimate educational interest.

The CIP standards are NERC's mandatory cybersecurity requirements for entities that operate the bulk electric system (BES), approved by FERC. Four standards carry most identity controls: CIP-004 (personnel risk assessment, training and access management), CIP-005 (electronic security perimeters and remote access, including multi-factor authentication for all Interactive Remote Access), CIP-007 (system access control, shared and default accounts, passwords) and CIP-003 (security management controls, where CIP-003-9 added vendor electronic remote access controls for low impact systems from April 1, 2026). FERC Order No. 919, effective May 26, 2026, approved virtualization revisions to 11 CIP standards, including CIP-003-10, CIP-004-8, CIP-005-8 and CIP-007-7.1, which take effect on July 1, 2028.

After the 2021 Colonial Pipeline ransomware attack, TSA used its emergency authority under 49 U.S.C. 114(l) to issue security directives to TSA-designated critical pipeline owners and operators. The SD Pipeline-2021-02 series, first issued on July 19, 2021, requires specific mitigations against ransomware and other threats to IT and OT systems; in 2022 TSA moved it to performance-based requirements that let operators choose how to meet security outcomes. On November 7, 2024 TSA proposed a rule (89 FR 88488) to make cyber risk management requirements permanent for certain pipeline and rail owners and operators, including MFA or equivalent controls, least privilege, and limits on shared accounts. Comments closed on February 5, 2025. The current Unified Agenda lists the rule as a long-term action with the final rule date to be determined.

CMMC is DoD's program for verifying that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program rule, 32 CFR Part 170 (89 FR 83092), took effect on December 16, 2024, and the DFARS acquisition rule (90 FR 43560, DFARS Case 2019-D041) took effect on November 10, 2025, which started Phase 1. Level 1 covers the 15 FAR 52.204-21 safeguarding requirements, Level 2 is identical to the 110 requirements of NIST SP 800-171 Rev. 2, including multi-factor authentication, and Level 3 adds 24 selected NIST SP 800-172 requirements. Phase 2, which brings third-party (C3PAO) Level 2 certification into applicable contracts, starts on November 10, 2026.

FedRAMP sets the security requirements federal agencies rely on when they use cloud services. Its Consolidated Rules for 2026 (CR26) use the term certification and sort cloud offerings into classes: Class A (pilot), Class B (Low) and Class C (Moderate), with Class D (High) to be developed in FedRAMP 20x Phase 4. Providers certify on one of two paths: Rev5, built on NIST SP 800-53 Rev. 5 control baselines, or FedRAMP 20x, which measures Key Security Indicators with automated validation. CR26 became optional on July 4, 2026 and is mandatory from January 1, 2027, and FedRAMP will stop accepting new Rev5 Certifications on June 11, 2027. On 5 November 2026 fedramp.gov listed 36 FedRAMP 20x certified services out of 554 certified services.

M-22-09 sets the federal zero trust architecture strategy that followed Executive Order 14028. Issued on January 26, 2022, it required agencies to meet specific cybersecurity standards and objectives by the end of fiscal year 2024. Its identity pillar is the most cited part: agencies must run centralized identity management systems, enforce MFA at the application layer, require phishing-resistant MFA for staff, contractors and partners, offer a phishing-resistant option to the public, drop password rules that demand special characters or regular rotation, and consider at least one device-level signal when authorizing access. OMB's memoranda page listed no rescission of M-22-09 on 5 November 2026.

PCI DSS is the PCI Security Standards Council's security standard for entities that store, process or transmit cardholder data. It is an industry standard rather than a statute: whether an entity must comply is decided by organizations that manage compliance programs, such as a payment brand or acquirer. Version 4.0.1, published in June 2024, is a limited revision with corrections and clarifications and no added or deleted requirements; v4.0 was retired on December 31, 2024. Requirement 8 is the identity core: unique IDs, 12-character passwords, MFA for all access into the cardholder data environment (CDE), and MFA systems that resist replay and cannot be bypassed. The requirements that v4.0 introduced as future-dated, including MFA for all CDE access, have been mandatory since March 31, 2025.

DEA's EPCS rules let practitioners issue Schedule II to V controlled substance prescriptions electronically, but only through prescribing and pharmacy applications that meet 21 CFR Part 1311. The interim final rule (75 FR 16236) was published on March 31, 2010 and took effect on June 1, 2010. It is one of the few U.S. rules that prescribes identity proofing and authentication in detail: practitioners must be identity proofed to NIST SP 800-63-1 Assurance Level 3 (or by an institutional credentialing office), sign each prescription with two of three factors where any hard token is a separate FIPS 140-2 Level 1 device, and get signing rights only through a two-person logical access control process. Applications need a third-party audit or certification before use and at least every two years.