# Security audits: Security Standards Requirements

> The Security Standards Requirements carries 6 published figures read from 7 sources' own pages, from 30 to 180 day, read 17 October 2026.

Hardenvo · https://hardenvo.com/datasets/security-standards-requirements/ · computed 2026-10-18

**Range of the published figures:** 30 to 180 day (range 30 to 180 day; 6 sources with a figure; 7 of 20 sources read publish one).

7 of the 20 named sources read in full publish a figure; 13 publish none, read 17 October 2026.

## By obligation

| Breakdown | Median | Range | Sources |
|---|---|---|---|
| obligation HIPAA breach notice to the Secretary, 500 or more individuals | 60 day | 60 to 60 day | 1 |
| obligation notification event deadline, 16 CFR 314.4(j) | 30 day | 30 to 30 day | 1 |
| obligation notify the FTC of a notification event, FTC Safeguards guidance | 30 day | 30 to 30 day | 1 |
| obligation substitute notice toll-free number, 45 CFR 164.404 | 90 day | 90 to 90 day | 1 |
| obligation disable inactive privileged access, 45 days, ACSC Essential Eight | 45 day | 45 to 45 day | 1 |
| obligation maximum administrative fine, essential entities, NIS2 Article 34 | 10,000,000 EUR | 10,000,000 to 10,000,000 EUR | 1 |
| obligation maximum administrative fine, important entities, NIS2 Article 34 | 7,000,000 EUR | 7,000,000 to 7,000,000 EUR | 1 |
| obligation POA&M closeout self-assessment, CMMC 32 CFR 170 | 180 day | 180 to 180 day | 1 |
| obligation patch internet-facing vulnerabilities, 48 hours, ACSC Essential Eight | 48 hour | 48 to 48 hour | 1 |

## Every figure, with its source

One row per source: the figure the source's own page publishes, the page, and the day it was read.

| Source | Figure | Breakdown | Read |
|---|---|---|---|
| [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) | 10,000,000 EUR | maximum administrative fine, essential entities, NIS2 Article 34 | 2026-10-17 |
| [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) | 7,000,000 EUR | maximum administrative fine, important entities, NIS2 Article 34 | 2026-10-17 |
| [CMMC Program, 32 CFR Part 170](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) | 180 day | POA&M closeout self-assessment, CMMC 32 CFR 170 | 2026-10-17 |
| [HIPAA Breach Notification Rule, 45 CFR 164 Subpart D](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D) | 90 day | substitute notice toll-free number, 45 CFR 164.404 | 2026-10-17 |
| [HHS breach notification guidance](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 60 day | HIPAA breach notice to the Secretary, 500 or more individuals | 2026-10-17 |
| [ACSC Essential Eight maturity model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model) | 48 hour | patch internet-facing vulnerabilities, 48 hours, ACSC Essential Eight | 2026-10-17 |
| [ACSC Essential Eight maturity model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model) | 45 day | disable inactive privileged access, 45 days, ACSC Essential Eight | 2026-10-17 |
| [FTC Safeguards Rule, 16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) | 30 day | notification event deadline, 16 CFR 314.4(j) | 2026-10-17 |
| [FTC Safeguards Rule business guidance](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) | 30 day | notify the FTC of a notification event, FTC Safeguards guidance | 2026-10-17 |

## The sentence each figure was read from (9)

- [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj), read 2026-10-17: "ringe Article 21 or 23, essential entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs,"
- [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj), read 2026-10-17: "ringe Article 21 or 23, important entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 7 000 000 or of a maximum of at least 1,4 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belong"
- [CMMC Program, 32 CFR Part 170](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170), read 2026-10-17: "The OSA must remediate any NOT MET requirements, must perform a POA&M closeout self-assessment, and must post compliance results to SPRS within 180 days of the CMMC Status Date associated with the Conditional Level 2 (Self)."
- [HIPAA Breach Notification Rule, 45 CFR 164 Subpart D](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D), read 2026-10-17: "(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach."
- [HHS breach notification guidance](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach."
- [ACSC Essential Eight maturity model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model), read 2026-10-17: "Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist."
- [ACSC Essential Eight maturity model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model), read 2026-10-17: "Privileged access to systems and applications is disabled after 45 days of inactivity."
- [FTC Safeguards Rule, 16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-17: "Upon discovery of a notification event as described in paragraph (j)(2) of this section, if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event."
- [FTC Safeguards Rule business guidance](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know), read 2026-10-17: "Section 314.4(j) of the Safeguards Rule requires financial institutions to notify the FTC as soon as possible – and no later than 30 days after discovery – of a “notification event.” For purposes of the Rule, a “notification event” is a security breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information."

## Read in full, publishes no figure

- [HIPAA Security Rule, 45 CFR 164 Subpart C](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C), read 2026-10-17: read in full and no accepted figure on the page
- [45 CFR 164.308 administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308), read 2026-10-17: read in full and no accepted figure on the page
- [45 CFR 164.312 technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312), read 2026-10-17: read in full and no accepted figure on the page
- [HHS HIPAA Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html), read 2026-10-10: read in full and no accepted figure on the page
- [32 CFR 170.14 CMMC model](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.14), read 2026-10-17: every candidate on the page was refused
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework), read 2026-10-11: read in full and no accepted figure on the page
- [NIST SP 800-171 (final)](https://csrc.nist.gov/pubs/sp/800/171/r3/final), read 2026-09-12: read in full and no accepted figure on the page
- [NIST SP 800-53 Rev 5 (final)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final), read 2026-09-12: read in full and no accepted figure on the page
- [PCI SSC document library](https://www.pcisecuritystandards.org/document_library/), read 2026-10-02: read in full and no accepted figure on the page
- [SEC cybersecurity disclosure rules](https://www.sec.gov/newsroom/press-releases/2023-139), read 2026-10-17: every candidate on the page was refused
- [ICO guide to data security (UK GDPR Art 32)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), read 2026-10-11: read in full and no accepted figure on the page
- [NIS Regulations 2018 (UK)](https://www.legislation.gov.uk/uksi/2018/506/contents), read 2026-10-03: read in full and no accepted figure on the page
- [ISO/IEC 27001 standard page](https://www.iso.org/standard/27001), read 2026-10-09: read in full and no accepted figure on the page

## Methodology

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 7 of the 20 named sources that could be read published a usable figure; 13 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 42 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per obligation, quoted verbatim from the authority with its effective date: the required safeguards, the retention and recovery obligations (the only authoritative answer to 'backup retention policy', which every vendor blog answers by assertion), the assessment or audit that evidences it, the breach-reporting clock, and the penalty ceiling; the cross-regime comparison - which regimes name a retention period at all, whose reporting clock is shortest - is the figure, and changed-since is the news when a rule turns

## Sources

- [HIPAA Security Rule, 45 CFR 164 Subpart C](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C) (the publisher's own terms; quoted for reporting and comment)
- [45 CFR 164.308 administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308) (the publisher's own terms; quoted for reporting and comment)
- [45 CFR 164.312 technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) (the publisher's own terms; quoted for reporting and comment)
- [HHS HIPAA Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html) (the publisher's own terms; quoted for reporting and comment)
- [CMMC Program, 32 CFR Part 170](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) (the publisher's own terms; quoted for reporting and comment)
- [32 CFR 170.14 CMMC model](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.14) (the publisher's own terms; quoted for reporting and comment)
- [FTC Safeguards Rule, 16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) (the publisher's own terms; quoted for reporting and comment)
- [FTC Safeguards Rule business guidance](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) (the publisher's own terms; quoted for reporting and comment)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) (the publisher's own terms; quoted for reporting and comment)
- [NIST SP 800-171 (final)](https://csrc.nist.gov/pubs/sp/800/171/r3/final) (the publisher's own terms; quoted for reporting and comment)
- [NIST SP 800-53 Rev 5 (final)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) (the publisher's own terms; quoted for reporting and comment)
- [PCI SSC document library](https://www.pcisecuritystandards.org/document_library/) (the publisher's own terms; quoted for reporting and comment)
- [ACSC Essential Eight maturity model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model) (the publisher's own terms; quoted for reporting and comment)
- [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) (the publisher's own terms; quoted for reporting and comment)
- [SEC cybersecurity disclosure rules](https://www.sec.gov/newsroom/press-releases/2023-139) (the publisher's own terms; quoted for reporting and comment)
- [HIPAA Breach Notification Rule, 45 CFR 164 Subpart D](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D) (the publisher's own terms; quoted for reporting and comment)
- [HHS breach notification guidance](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) (the publisher's own terms; quoted for reporting and comment)
- [ICO guide to data security (UK GDPR Art 32)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) (the publisher's own terms; quoted for reporting and comment)
- [NIS Regulations 2018 (UK)](https://www.legislation.gov.uk/uksi/2018/506/contents) (the publisher's own terms; quoted for reporting and comment)
- [ISO/IEC 27001 standard page](https://www.iso.org/standard/27001) (the publisher's own terms; quoted for reporting and comment)

## Cite or embed

- The Security Standards Requirements carries 6 published figures read from 7 sources' own pages, from 30 to 180 day, read 17 October 2026.
- 7 of the 20 named sources read in full publish a figure; 13 publish none, read 17 October 2026.
- Security Standards Requirements, obligation HIPAA breach notice to the Secretary, 500 or more individuals: median 60 day across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation notification event deadline, 16 CFR 314.4(j): median 30 day across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation notify the FTC of a notification event, FTC Safeguards guidance: median 30 day across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation substitute notice toll-free number, 45 CFR 164.404: median 90 day across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation disable inactive privileged access, 45 days, ACSC Essential Eight: median 45 day across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation maximum administrative fine, essential entities, NIS2 Article 34: median 10,000,000 EUR across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation maximum administrative fine, important entities, NIS2 Article 34: median 7,000,000 EUR across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation POA&M closeout self-assessment, CMMC 32 CFR 170: median 180 day across 1 source, read 17 October 2026.
- Security Standards Requirements, obligation patch internet-facing vulnerabilities, 48 hours, ACSC Essential Eight: median 48 hour across 1 source, read 17 October 2026.

Cite as: "Hardenvo Security Standards Requirements", updated 2026-10-18, https://hardenvo.com/datasets/security-standards-requirements/.

CSV: https://hardenvo.com/datasets/security-standards-requirements.csv
JSON: https://hardenvo.com/datasets/security-standards-requirements.json
Embed (plain HTML, static link back): see https://hardenvo.com/datasets/security-standards-requirements/#median