{ "name": "Hardenvo Security Standards Requirements", "title": "Security Standards Requirements", "url": "https://hardenvo.com/datasets/security-standards-requirements/", "csv": "https://hardenvo.com/datasets/security-standards-requirements.csv", "markdown": "https://hardenvo.com/datasets/security-standards-requirements/index.md", "computed_at": "2026-10-18", "license": "https://hardenvo.com/terms", "headline": "The Security Standards Requirements carries 6 published figures read from 7 sources' own pages, from 30 to 180 day, read 17 October 2026.", "quotes": [ "The Security Standards Requirements carries 6 published figures read from 7 sources' own pages, from 30 to 180 day, read 17 October 2026.", "7 of the 20 named sources read in full publish a figure; 13 publish none, read 17 October 2026.", "Security Standards Requirements, obligation HIPAA breach notice to the Secretary, 500 or more individuals: median 60 day across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation notification event deadline, 16 CFR 314.4(j): median 30 day across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation notify the FTC of a notification event, FTC Safeguards guidance: median 30 day across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation substitute notice toll-free number, 45 CFR 164.404: median 90 day across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation disable inactive privileged access, 45 days, ACSC Essential Eight: median 45 day across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation maximum administrative fine, essential entities, NIS2 Article 34: median 10,000,000 EUR across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation maximum administrative fine, important entities, NIS2 Article 34: median 7,000,000 EUR across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation POA&M closeout self-assessment, CMMC 32 CFR 170: median 180 day across 1 source, read 17 October 2026.", "Security Standards Requirements, obligation patch internet-facing vulnerabilities, 48 hours, ACSC Essential Eight: median 48 hour across 1 source, read 17 October 2026." ], "citation": "\"Hardenvo Security Standards Requirements\", updated 2026-10-18, https://hardenvo.com/datasets/security-standards-requirements/.", "changed_since": null, "national": { "unit": "day", "n": 6, "median": 52.5, "min": 30, "max": 180, "p25": 30, "p75": 112.5, "mean": 72.5, "units": { "EUR": 2, "day": 6, "hour": 1 }, "published_sources": 7, "named_sources": 20, "read_sources": 20, "not_published": 13, "published_share": 0.35 }, "by_axis": { "obligation": { "HIPAA breach notice to the Secretary, 500 or more individuals": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "notification event deadline, 16 CFR 314.4(j)": { "day": { "n": 1, "median": 30, "min": 30, "max": 30, "p25": 30, "p75": 30, "mean": 30 } }, "notify the FTC of a notification event, FTC Safeguards guidance": { "day": { "n": 1, "median": 30, "min": 30, "max": 30, "p25": 30, "p75": 30, "mean": 30 } }, "substitute notice toll-free number, 45 CFR 164.404": { "day": { "n": 1, "median": 90, "min": 90, "max": 90, "p25": 90, "p75": 90, "mean": 90 } }, "disable inactive privileged access, 45 days, ACSC Essential Eight": { "day": { "n": 1, "median": 45, "min": 45, "max": 45, "p25": 45, "p75": 45, "mean": 45 } }, "maximum administrative fine, essential entities, NIS2 Article 34": { "EUR": { "n": 1, "median": 10000000, "min": 10000000, "max": 10000000, "p25": 10000000, "p75": 10000000, "mean": 10000000 } }, "maximum administrative fine, important entities, NIS2 Article 34": { "EUR": { "n": 1, "median": 7000000, "min": 7000000, "max": 7000000, "p25": 7000000, "p75": 7000000, "mean": 7000000 } }, "POA&M closeout self-assessment, CMMC 32 CFR 170": { "day": { "n": 1, "median": 180, "min": 180, "max": 180, "p25": 180, "p75": 180, "mean": 180 } }, "patch internet-facing vulnerabilities, 48 hours, ACSC Essential Eight": { "hour": { "n": 1, "median": 48, "min": 48, "max": 48, "p25": 48, "p75": 48, "mean": 48 } } } }, "rows": [ { "source": "HHS breach notification guidance", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA breach notice to the Secretary, 500 or more individuals" }, "retrieved_at": "2026-10-17", "quote": "If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "FTC Safeguards Rule, 16 CFR Part 314", "url": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "obligation": "notification event deadline, 16 CFR 314.4(j)" }, "retrieved_at": "2026-10-17", "quote": "Upon discovery of a notification event as described in paragraph (j)(2) of this section, if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event.", "source_class": "primary-government", "text_sha256": "044cdacd1bcc988637724df18579b751a7d4830312e2eb04afa8a85c7c699641" }, { "source": "FTC Safeguards Rule business guidance", "url": "https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "obligation": "notify the FTC of a notification event, FTC Safeguards guidance" }, "retrieved_at": "2026-10-17", "quote": "Section 314.4(j) of the Safeguards Rule requires financial institutions to notify the FTC as soon as possible – and no later than 30 days after discovery – of a “notification event.” For purposes of the Rule, a “notification event” is a security breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information.", "source_class": "primary-government", "text_sha256": "9f1542b886ecb037ec05446304d24f573c89c32539078ec8ed09f929c1c13efd" }, { "source": "HIPAA Breach Notification Rule, 45 CFR 164 Subpart D", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "obligation": "substitute notice toll-free number, 45 CFR 164.404" }, "retrieved_at": "2026-10-17", "quote": "(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.", "source_class": "primary-government", "text_sha256": "5b2dd02280a8d60654d8d612f7811cb25cba72fdf077d28b6eae1bdc2085b118" }, { "source": "ACSC Essential Eight maturity model", "url": "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model", "figure": "45 days", "value": 45, "unit": "day", "vat": null, "axis": { "obligation": "disable inactive privileged access, 45 days, ACSC Essential Eight" }, "retrieved_at": "2026-10-17", "quote": "Privileged access to systems and applications is disabled after 45 days of inactivity.", "source_class": "primary-government", "text_sha256": "80146ff9b96b704b91edf6a2812558caf44654882ef22b4eaaae670dcdbbd799" }, { "source": "NIS2 Directive (EU) 2022/2555", "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj", "figure": "EUR 10 000 000 ", "value": 10000000, "unit": "EUR", "vat": null, "axis": { "obligation": "maximum administrative fine, essential entities, NIS2 Article 34" }, "retrieved_at": "2026-10-17", "quote": "ringe Article 21 or 23, essential entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs,", "source_class": "primary-government", "text_sha256": "4a1dfa694c9f0592e97b86b12308539b3cc96feaecdf2815ccb621ab24a408cc" }, { "source": "NIS2 Directive (EU) 2022/2555", "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj", "figure": "EUR 7 000 000 ", "value": 7000000, "unit": "EUR", "vat": null, "axis": { "obligation": "maximum administrative fine, important entities, NIS2 Article 34" }, "retrieved_at": "2026-10-17", "quote": "ringe Article 21 or 23, important entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 7 000 000 or of a maximum of at least 1,4 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belong", "source_class": "primary-government", "text_sha256": "4a1dfa694c9f0592e97b86b12308539b3cc96feaecdf2815ccb621ab24a408cc" }, { "source": "CMMC Program, 32 CFR Part 170", "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170", "figure": "180 days", "value": 180, "unit": "day", "vat": null, "axis": { "obligation": "POA&M closeout self-assessment, CMMC 32 CFR 170" }, "retrieved_at": "2026-10-17", "quote": "The OSA must remediate any NOT MET requirements, must perform a POA&M closeout self-assessment, and must post compliance results to SPRS within 180 days of the CMMC Status Date associated with the Conditional Level 2 (Self).", "source_class": "primary-government", "text_sha256": "5435adb8d4c8daa8d87a8463b7e8a0df0e164f19664dd5b9f2d3da32e49c5bc9" }, { "source": "ACSC Essential Eight maturity model", "url": "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model", "figure": "48 hours", "value": 48, "unit": "hour", "vat": null, "axis": { "obligation": "patch internet-facing vulnerabilities, 48 hours, ACSC Essential Eight" }, "retrieved_at": "2026-10-17", "quote": "Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.", "source_class": "primary-government", "text_sha256": "80146ff9b96b704b91edf6a2812558caf44654882ef22b4eaaae670dcdbbd799" } ], "not_published": [ { "source": "HIPAA Security Rule, 45 CFR 164 Subpart C", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "45 CFR 164.308 administrative safeguards", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "45 CFR 164.312 technical safeguards", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS HIPAA Security Rule guidance", "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "32 CFR 170.14 CMMC model", "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.14", "retrieved_at": "2026-10-17", "reason": "every candidate on the page was refused" }, { "source": "NIST Cybersecurity Framework", "url": "https://www.nist.gov/cyberframework", "retrieved_at": "2026-10-11", "reason": "read in full and no accepted figure on the page" }, { "source": "NIST SP 800-171 (final)", "url": "https://csrc.nist.gov/pubs/sp/800/171/r3/final", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "NIST SP 800-53 Rev 5 (final)", "url": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "PCI SSC document library", "url": "https://www.pcisecuritystandards.org/document_library/", "retrieved_at": "2026-10-02", "reason": "read in full and no accepted figure on the page" }, { "source": "SEC cybersecurity disclosure rules", "url": "https://www.sec.gov/newsroom/press-releases/2023-139", "retrieved_at": "2026-10-17", "reason": "every candidate on the page was refused" }, { "source": "ICO guide to data security (UK GDPR Art 32)", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/", "retrieved_at": "2026-10-11", "reason": "read in full and no accepted figure on the page" }, { "source": "NIS Regulations 2018 (UK)", "url": "https://www.legislation.gov.uk/uksi/2018/506/contents", "retrieved_at": "2026-10-03", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO/IEC 27001 standard page", "url": "https://www.iso.org/standard/27001", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C", "label": "HIPAA Security Rule, 45 CFR 164 Subpart C", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308", "label": "45 CFR 164.308 administrative safeguards", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312", "label": "45 CFR 164.312 technical safeguards", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "label": "HHS HIPAA Security Rule guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170", "label": "CMMC Program, 32 CFR Part 170", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.14", "label": "32 CFR 170.14 CMMC model", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314", "label": "FTC Safeguards Rule, 16 CFR Part 314", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know", "label": "FTC Safeguards Rule business guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.nist.gov/cyberframework", "label": "NIST Cybersecurity Framework", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://csrc.nist.gov/pubs/sp/800/171/r3/final", "label": "NIST SP 800-171 (final)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final", "label": "NIST SP 800-53 Rev 5 (final)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.pcisecuritystandards.org/document_library/", "label": "PCI SSC document library", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model", "label": "ACSC Essential Eight maturity model", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj", "label": "NIS2 Directive (EU) 2022/2555", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.sec.gov/newsroom/press-releases/2023-139", "label": "SEC cybersecurity disclosure rules", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D", "label": "HIPAA Breach Notification Rule, 45 CFR 164 Subpart D", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "label": "HHS breach notification guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/", "label": "ICO guide to data security (UK GDPR Art 32)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.legislation.gov.uk/uksi/2018/506/contents", "label": "NIS Regulations 2018 (UK)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/standard/27001", "label": "ISO/IEC 27001 standard page", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 7 of the 20 named sources that could be read published a usable figure; 13 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 42 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per obligation, quoted verbatim from the authority with its effective date: the required safeguards, the retention and recovery obligations (the only authoritative answer to 'backup retention policy', which every vendor blog answers by assertion), the assessment or audit that evidences it, the breach-reporting clock, and the penalty ceiling; the cross-regime comparison - which regimes name a retention period at all, whose reporting clock is shortest - is the figure, and changed-since is the news when a rule turns", "embed": "

30 to 180 day

6 published figures, Security Standards Requirements, across 7 sources, read 17 October 2026

Source: Hardenvo Security Standards Requirements
" }