# Cybersecurity Compliance Rules

Best practices and rules for Cybersecurity Compliance.

## Rules

| # | Rule | Impact | File |
|---|------|--------|------|
| 1 | Recognize that cyber incidents trigger mandatory legal obligations, and legal counsel should be part of the incident response team from the first moment. | HIGH | [`cybersecurity-compliance-recognize-that-cyber-incidents-trigger-mandatory-legal.md`](cybersecurity-compliance-recognize-that-cyber-incidents-trigger-mandatory-legal.md) |
| 2 | Map all of your notification obligations before an incident occurs. | CRITICAL | [`cybersecurity-compliance-map-all-of-your-notification-obligations-before-an-incident.md`](cybersecurity-compliance-map-all-of-your-notification-obligations-before-an-incident.md) |
| 3 | Pursue security certifications strategically based on your market. | CRITICAL | [`cybersecurity-compliance-pursue-security-certifications-strategically-based-on-your.md`](cybersecurity-compliance-pursue-security-certifications-strategically-based-on-your.md) |
| 4 | Test your incident response plan at least annually through tabletop exercises. | MEDIUM | [`cybersecurity-compliance-test-your-incident-response-plan-at-least-annually-through.md`](cybersecurity-compliance-test-your-incident-response-plan-at-least-annually-through.md) |
| 5 | Maintain cyber insurance and understand your policy's conditions and exclusions. | CRITICAL | [`cybersecurity-compliance-maintain-cyber-insurance-and-understand-your-policy-s.md`](cybersecurity-compliance-maintain-cyber-insurance-and-understand-your-policy-s.md) |
| 6 | Monitor the regulatory landscape actively. | HIGH | [`cybersecurity-compliance-monitor-the-regulatory-landscape-actively.md`](cybersecurity-compliance-monitor-the-regulatory-landscape-actively.md) |
| 7 | Implement board-level cybersecurity governance. | CRITICAL | [`cybersecurity-compliance-implement-board-level-cybersecurity-governance.md`](cybersecurity-compliance-implement-board-level-cybersecurity-governance.md) |
| 8 | Treat third-party risk management as a regulatory requirement, not just a best practice. | CRITICAL | [`cybersecurity-compliance-treat-third-party-risk-management-as-a-regulatory.md`](cybersecurity-compliance-treat-third-party-risk-management-as-a-regulatory.md) |