Source Register

Source register

Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave, which depends on the version and settings in use. The eCFR is the current compilation of federal regulations; check its as of date. The same list, with the date each source was last checked, is in Source-register.csv.

DFS01 DFS final adopted second amendment to Part 500. Adopted regulatory text. 500.1 through 500.24 as amended November 1, 2023; read the amendment markup carefully. https://www.dfs.ny.gov/industry_guidance/regulations/final_adoptions_fs/rf_fs_2amend23nycrr500_text_20231101

DFS02 DFS Part 500 reading copy. Agency reading copy. Full Part 500 reading copy; compare it with the adopted text. https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500

DFS03 DFS cybersecurity submissions. Agency filing guidance. Annual compliance notification; incident and extortion notices. https://www.dfs.ny.gov/cybersecurity/submissions

DFS04 DFS cybersecurity FAQs. Agency interpretation. Exemptions, applicability and program guidance. https://www.dfs.ny.gov/cybersecurity/faqs

DFS05 DFS risk assessment guidance, September 10, 2026. Agency guidance. Risk identification, methodology and use of the risk assessment. https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment

DFS06 DFS regulatory activity. Agency adoption index. Final adoption and notice dated November 1 2023. https://www.dfs.ny.gov/industry_guidance/regulatory_activity/financial_services

NY01 New York General Business Law 899-aa. State statutory text. 1 definitions; 2 and 3 notice; 8 agencies; 9 HIPAA notice. https://www.nysenate.gov/legislation/laws/GBS/899-AA

NY02 New York General Business Law 899-bb. State statutory text. 1 regulated entities and small business; 2 safeguards. https://www.nysenate.gov/legislation/laws/GBS/899-BB

NY03 New York State Technology Law 208. State statutory text. Breach notice regime for state entities. https://www.nysenate.gov/legislation/laws/STT/208

NY04 New York hospital cybersecurity rule. Agency regulatory text. 10 NYCRR 405.46; general hospitals only. https://regs.health.ny.gov/content/section-40546-hospital-cybersecurity-requirements

NY05 New York Commercial Division rules. Court rules. 11-a, 11-b, 11-c, 11-g and ESI Appendix A. https://www.nycourts.gov/rules/rule/section-20270-rules-commercial-division-supreme-court

NY06 New York Uniform Civil Rules Part 202. Court rules. 202.20 interrogatories; 202.20-j and Appendix A. https://www.nycourts.gov/rules/part-202-uniform-civil-rules-supreme-court-and-county-court

NY07 New York CPLR 3130. State procedural text. Use of interrogatories and restrictions. https://www.nysenate.gov/legislation/laws/CVP/3130

NY08 New York CPLR 3133. State procedural text. Answers and objections to interrogatories. https://www.nysenate.gov/legislation/laws/CVP/3133

CM01 CMMC program rule. Federal regulatory compilation. 170.2 definitions and incorporation, 170.14 to 170.24 assessment requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170

CM02 Current CMMC program information. Agency program announcement. Phase 2 suspended July 13, 2026; Phase 1 continues. https://dodcio.defense.gov/cmmc/About/

CM03 CMMC Phase II suspension announcement. Agency announcement. Suspension of the Phase 2 transition, July 13, 2026. https://business.defense.gov/Engage/News/Newsfeed-Repository/Article/4542563/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/

CM04 DFARS CMMC clause. Federal acquisition clause. 252.204-7021 as incorporated in the contract. https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.

CM05 DFARS safeguarding and cyber incident reporting. Federal acquisition clause. 252.204-7012; cloud and incident obligations where incorporated. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.

CM06 FAR basic safeguarding. Federal acquisition clause. 52.204-21; FCI and safeguards. https://www.acquisition.gov/far/52.204-21

CM07 Current defense acquisition class deviations. Agency implementation index. Class Deviation 2026-O0025 Revision 3 and any later revision. https://www.acq.osd.mil/dpap/dars/dfars_far_overhaul_class_deviations.html

CM08 CMMC Level 2 scoping guidance. Agency technical guidance. Asset categories, external and cloud service providers. https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL2v2.pdf

CM09 CMMC resources and documentation. Agency resources index. Current assessment and scoping guides and implementation memoranda. https://dodcio.defense.gov/CMMC/Resources-Documentation/

CM10 Class Deviation 2026-O0025 Revision 3 (signed memorandum and attachments). Signed agency implementation memorandum and attachments. Suspension of the Phase 2 transition, NIST SP 800-171 Revision 2 baseline, clause 252.240-7997. https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf

NI01 NIST SP 800-171 Revision 2. Technical standard publication page. 110 security requirements; the revision CMMC incorporates. https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final

NI02 NIST SP 800-171 Revision 3. Technical standard publication page. Published May 2024; CMMC and DFARS 252.204-7012 still use Revision 2. https://csrc.nist.gov/pubs/sp/800/171/r3/final

NI03 NIST SP 800-171A Revision 3. Technical assessment guidance. Examine, interview and test procedures; pair with the matching requirement revision. https://csrc.nist.gov/pubs/sp/800/171/A/r3/final

NI04 NIST SP 800-86. Technical forensic guidance. Sections 3 to 6; collection, data files, operating systems, network or application sources. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf

NI05 NIST SP 800-115. Technical testing guidance. Assessment planning, logistics, rules of engagement and reporting. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf

NI06 NIST Cybersecurity Framework 2.0. Voluntary risk framework. Govern, Identify, Protect, Detect, Respond, Recover. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

EA01 EAR scope. Federal regulatory compilation. 734.3, 734.13 to 734.19; jurisdiction, releases and conditional encrypted transmission. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734

EA02 EAR recordkeeping. Federal regulatory compilation. 762.2, 762.6; records and retention trigger. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-762

EA03 BIS export compliance programs. Agency program guidance. Eight elements of an export compliance program. https://www.bis.gov/learn-support/export-compliance-programs

EA04 BIS export compliance toolkit. Agency guidance index. Classification, screening, technology controls and self audit modules. https://www.bis.gov/learn-support/export-compliance-programs/export-compliance-toolkit

EA05 EAR end user and end use controls. Federal regulatory compilation. Transaction specific end user or end use controls. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-744

IT01 ITAR definitions. Federal regulatory compilation. 120.31 to 120.33 and 120.50 to 120.63. https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120

IT02 ITAR encrypted technical data provision. Federal regulatory compilation. 120.54(a)(5), (b) and (c). https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.54

IT03 ITAR registration and recordkeeping. Federal regulatory compilation. 122.1 registration and 122.5 recordkeeping. https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-122

IT04 DDTC understanding ITAR. Agency jurisdiction guidance. ITAR parts 120 to 130, USML, defense services and brokering. https://www.pmddtc.state.gov/ddtc_public/ddtc_landing?id=ddtc_public_portal_itar_landing

IT05 DDTC registration explanation. Agency registration guidance. Registration process; under 22 CFR 122.1(c) registration is generally a precondition to the issuance of a license or other approval. https://www.pmddtc.state.gov/registration/documents/DS2032v4.4.pdf

LG01 Federal Rules of Civil Procedure (December 1, 2025). Court procedural rules. Rules 26, 33, 34, 37(e) and 45. https://www.uscourts.gov/sites/default/files/document/federal-rules-of-civil-procedure.pdf

LG02 Federal Rules of Evidence. Court procedural rules index. Rules 502, 901 and 902. https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-evidence

HE01 HIPAA Security Rule. Federal regulatory compilation. 164.308(a)(1), 164.312(b) and 164.316. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C

HE02 HIPAA judicial proceedings provision. Federal regulatory compilation. 164.512(e) disclosures for judicial and administrative proceedings. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512

HE03 HHS court orders and subpoenas. Agency interpretation. Court orders compared with other subpoenas. https://www.hhs.gov/hipaa/for-individuals/court-orders-subpoenas/index.html

HE04 HHS medical record retention FAQ. Agency interpretation. The Privacy Rule sets no general medical record retention period. https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html

HE05 HHS Part 2 confidentiality. Agency interpretation. 2024 final rule; compliance date February 16, 2026; proceedings against a patient. https://www.hhs.gov/hipaa/part-2/index.html

HE06 ONC auditable events certification guidance. Agency certification guidance. 170.315(d)(2) auditable events and tamper resistance. https://healthit.gov/test-method/auditable-events-and-tamper-resistance/

HE07 Substance use disorder record regulation. Federal regulatory compilation. 42 CFR Part 2; consent and use in proceedings. https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

MS01 Microsoft eDiscovery data sources. Vendor documentation. Mailbox, OneDrive, SharePoint locations; source specific inclusion. https://learn.microsoft.com/en-us/purview/edisc-data-sources

MS02 Microsoft Teams content in eDiscovery. Vendor documentation. Compliance records, files, channels, recordings and known exclusions. https://learn.microsoft.com/en-us/purview/edisc-search-teams

MS03 OneDrive retention and deletion. Vendor documentation. Deleted users, unlicensed archives, retention or hold and recycle bin limitations. https://learn.microsoft.com/en-us/onedrive/retention-and-deletion

MS04 Microsoft audit retention. Vendor documentation. Audit retention policies by license; check the tenant configuration. https://learn.microsoft.com/en-us/purview/audit-log-retention-policies

MS05 SharePoint and OneDrive retention. Vendor documentation. Preservation Hold library, versions and recycle bin search limits. https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint

MS06 Microsoft eDiscovery process reports. Vendor documentation. Search or export scope, location counts, errors and completeness limits. https://learn.microsoft.com/en-us/purview/edisc-process-report

GO01 Google Vault overview. Vendor documentation. Supported services, licenses, retention rules and holds. https://support.google.com/vault/answer/2462365?hl=en

GO02 Google audit lag and retention. Vendor documentation. Retention and reporting lag for each log type. https://support.google.com/a/answer/7061566?hl=en

SL01 Slack Discovery APIs. Vendor documentation. Enterprise, approved applications, preserved content and export scope. https://slack.com/help/articles/360002079527-a-guide-to-slacks-discovery-apis

SL02 Slack Connect data management. Vendor documentation. External organization ownership, export exclusions and retention. https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect

AW01 AWS CloudTrail event history. Vendor documentation. 90 day regional management event history; data events are excluded. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html

DS01 Docusign history and completion certificate. Vendor documentation. Envelope history and certificate of completion. https://support.docusign.com/s/document-item?bundleId=oeq1643226594604&topicId=hha1578456343641.html&language=en_US

CL01 Clio matter export scope. Vendor documentation. What a matter export contains and the separate subtabs. https://help.clio.com/hc/en-150/articles/9286116462747-Filter-Export-and-Convert-Matters

CL02 Clio text message exports. Vendor documentation. Text message export to PDF. https://help.clio.com/hc/en-us/articles/9125220988827-Text-Messaging-in-Clio-Manage

FT01 FTC Safeguards Rule business guidance. Agency guidance. Covered financial institutions and limited exemptions. https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know

FP01 FedRAMP authorization explanation. Agency program index. Cloud service authorization. https://www.fedramp.gov/

DFS07 23 NYCRR 500.12 and 500.17 (Cornell LII text). Regulatory text. 500.12(a) multifactor authentication; 500.17(a)(1) 72 hour notice, 500.17(b) April 15 filing, 500.17(c) extortion payment notice. https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.17

LG03 Defend Trade Secrets Act, 18 U.S.C. 1836 and 1839. Federal statute. 1836(b) civil action and seizure, 1836(d) three year limitation, 1839(3) trade secret, 1839(5) misappropriation. https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap90-sec1839.htm