How to Use This Cybersecurity Resource

Cyber Safety Authority is a structured reference directory covering the cybersecurity service sector, regulatory frameworks, and professional discipline categories relevant to US organizations and the practitioners who serve them. This page describes how the directory is organized, how its content is classified and verified, and how different professional audiences can navigate it alongside authoritative primary sources. The Directory Purpose and Scope page establishes the full boundaries of what is indexed and why it is structured as it is.

How to find specific topics

The directory is organized around three primary classification axes: service category, regulatory framework, and professional credential type. Navigating effectively depends on identifying which axis best matches the research objective.

By service category — Readers researching managed detection and response, penetration testing, cloud security architecture, incident response, or compliance consulting should begin with the Cyber Safety Listings index. Service categories within that index map to the functional domains established by the NIST Cybersecurity Framework (CSF) 2.0 — Govern, Identify, Protect, Detect, Respond, and Recover — published at csrc.nist.gov. This taxonomy provides a neutral classification standard independent of vendor terminology.

By regulatory framework — Organizations navigating obligations under specific regulatory instruments can use the framework name as the entry point. The major frameworks covered include:

1. NIST SP 800-53 Rev 5 — federal information system controls, applicable to agencies and contractors
2. HIPAA Security Rule (45 CFR Part 164) — technical and administrative safeguards for covered entities and business associates, maintained by the HHS Office for Civil Rights
3. FTC Safeguards Rule (16 CFR Part 314) — data security requirements for non-banking financial institutions, enforced by the Federal Trade Commission
4. CMMC 2.0 — Cybersecurity Maturity Model Certification requirements for Department of Defense contractors, administered by the DoD CMMC Program Office
5. CISA guidance — sector-specific advisories and the Known Exploited Vulnerabilities (KEV) catalog, published at cisa.gov

By credential or certification type — Professionals benchmarking providers or researching qualification standards can filter by certification body. The directory distinguishes between vendor-neutral credentials (CISSP from ISC², CISM from ISACA, CompTIA Security+) and framework-specific certifications (CMMC Registered Practitioner, HIPAA-focused certifications from AHIMA). These represent distinct credential categories with different examination authorities and renewal structures.

When a topic spans more than one axis — for example, a managed security service provider holding both SOC 2 attestation and FedRAMP authorization — the listing cross-references both the service category and the applicable compliance standard.

How content is verified

Content published across this directory is evaluated against named, publicly accessible standards documents and regulatory instruments rather than vendor literature or unattributed commentary. Verification follows a structured three-stage process:

1. Source identification — Each factual claim is traced to a named public document, statute, or standards publication before inclusion. Primary reference bodies include NIST (specifically csrc.nist.gov), CISA (cisa.gov), HHS Office for Civil Rights (hhs.gov/hipaa), the FTC, and the DoD CMMC Program Office.
2. Classification boundary review — Content distinguishing between control types — for example, preventive versus detective controls, or administrative versus technical safeguards under HIPAA — is checked against the originating framework's own taxonomy rather than derived interpretations.
3. Recency assessment — Regulatory and standards references are checked against the version or revision currently in force. NIST CSF 2.0 superseded CSF 1.1 in February 2024; listings and framework references within this directory reflect the operative version at time of publication and note version transitions where operationally significant.

Content describing legal obligations — penalty structures, enforcement thresholds, or certification requirements — uses the statutory or regulatory text as the baseline. Where penalty figures are cited, the source document is identified inline. No content within this directory constitutes legal advice, compliance certification, or security engineering guidance; it functions as a structured reference entry point.

How to use alongside other sources

This directory operates as a classification and navigation resource, not as a terminal authority. Effective use pairs it with primary sources in a defined workflow.

When researching a service provider's regulatory fitness, the directory entry identifies the relevant framework and credential type. The authoritative compliance standard — the actual regulatory text at ecfr.gov, the NIST publication at csrc.nist.gov, or the CISA advisory at cisa.gov — should be consulted directly before making procurement or compliance determinations.

A meaningful distinction applies between framework guidance and regulatory mandate. NIST CSF 2.0 is voluntary guidance for most private-sector organizations; HIPAA Security Rule requirements under 45 CFR Part 164 carry enforcement authority through HHS Office for Civil Rights, with civil penalty tiers reaching up to $1,993,932 per violation category per year (HHS Civil Monetary Penalties). This directory marks that distinction explicitly in framework-specific content. Readers should not treat a framework reference in a listing as equivalent to a confirmed compliance status.

For threat intelligence and vulnerability research, CISA's KEV catalog and NIST's National Vulnerability Database (NVD) at nvd.nist.gov are the authoritative public repositories. The How to Use This Cyber Safety Resource page covers integration guidance for both.

Feedback and updates

The directory content landscape is governed by the publication cycles of the standards bodies and regulatory agencies it references. NIST SP 800-series publications, CISA advisories, and federal regulatory amendments follow independent revision schedules, and directory content is updated to reflect material changes in operative versions, penalty structures, and classification standards.

Content accuracy depends on alignment with the named public sources identified in each section. Where a standard body has issued a superseding document — such as the transition from NIST CSF 1.1 to CSF 2.0 — the directory reflects the current operative version with a notation of the prior version where continuity matters for readers working under legacy contracts or assessments.

Readers who identify a factual discrepancy, an outdated regulatory reference, or a classification error are directed to the Contact page. Submissions should reference the specific page, the claim in question, and the named public source supporting the correction. Framework citations, statute references, and standards body publications receive priority review given their direct effect on the accuracy of regulatory framing across the directory.