Resources · Information gathering library · OT library · Download access · Privacy Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
This register distinguishes legal text, guidance, technical publications and vendor documentation. Each entry shows where the text lives and the date it was reviewed. The eCFR is an authoritative but unofficial current compilation, so check its displayed as of date and any later effective changes.
Library home · Download source register
Locate the official and technical references supporting the preparation collection. DFS01 DFS final adopted second amendment to Part 500 Source role Adopted regulatory text Relevant locator 500.1 through 500.24; read the amendment markup with care Review date 2026-10-18 https://www.dfs.ny.gov/industry_guidance/regulations/final_adoptions_fs/rf_fs_2amend23nycrr500_text_20231101
DFS final adopted second amendment to Part 500
DFS02 DFS Part 500 reading copy Source role Agency reading copy Relevant locator Full Part; unofficial reading copy; compare with the adopted text Review date 2026-10-18 https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500
NYDFS Cybersecurity Regulation, 23 NYCRR Part 500
DFS03 DFS cybersecurity submissions Source role Agency filing guidance Relevant locator Annual compliance notification; incident and extortion notices Review date 2026-10-18 https://www.dfs.ny.gov/cybersecurity/submissions
DFS cybersecurity submissions
DFS04 DFS cybersecurity FAQs Source role Agency interpretation Relevant locator Exemptions, applicability and program guidance Review date 2026-10-18 https://www.dfs.ny.gov/cybersecurity/faqs
DFS cybersecurity FAQs
DFS05 DFS risk assessment guidance September 10 2026 Source role Agency guidance Relevant locator Risk identification, methodology and use; guidance under the existing regulation Review date 2026-10-18 https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment
DFS risk assessment guidance September 10 2026
DFS06 DFS regulatory activity Source role Agency adoption index Relevant locator Final adoption and notice dated November 1 2023 Review date 2026-10-18 https://www.dfs.ny.gov/industry_guidance/regulatory_activity/financial_services
DFS regulatory activity
NY01 New York General Business Law 899-aa Source role State statutory text Relevant locator 1 definitions; 2 and 3 notice; 8 agencies; 9 HIPAA notice Review date 2026-10-18 https://www.nysenate.gov/legislation/laws/GBS/899-AA
N.Y. General Business Law 899-aa, Notification of breach of security
NY02 New York General Business Law 899-bb Source role State statutory text Relevant locator 1 regulated entities and small business; 2 safeguards Review date 2026-10-18 https://www.nysenate.gov/legislation/laws/GBS/899-BB
N.Y. General Business Law 899-bb, Data security protections
NY03 New York State Technology Law 208 Source role State statutory text Relevant locator Separate state entity breach regime Review date 2026-10-18 https://www.nysenate.gov/legislation/laws/STT/208
N.Y. State Technology Law 208, State and local breach notification
NY04 New York hospital cybersecurity rule Source role Agency regulatory text Relevant locator 10 NYCRR 405.46; general hospitals only Review date 2026-10-18 https://regs.health.ny.gov/content/section-40546-hospital-cybersecurity-requirements
New York hospital cybersecurity rule
NY05 New York Commercial Division rules Source role Court rules Relevant locator 11-a, 11-b, 11-c, 11-g and ESI Appendix A Review date 2026-10-18 https://www.nycourts.gov/rules/rule/section-20270-rules-commercial-division-supreme-court
New York Commercial Division rules
NY06 New York Uniform Civil Rules Part 202 Source role Court rules Relevant locator 202.20 interrogatories; 202.20-j and Appendix A Review date 2026-10-18 https://www.nycourts.gov/rules/part-202-uniform-civil-rules-supreme-court-and-county-court
New York Uniform Civil Rules Part 202
NY07 New York CPLR 3130 Source role State procedural text Relevant locator Use of interrogatories and restrictions Review date 2026-10-18 https://www.nysenate.gov/legislation/laws/CVP/3130
New York CPLR 3130
NY08 New York CPLR 3133 Source role State procedural text Relevant locator Answers or objections; current text for counsel Review date 2026-10-18 https://www.nysenate.gov/legislation/laws/CVP/3133
New York CPLR 3133
CM01 CMMC program rule Source role Federal regulatory compilation Relevant locator 170.14 to 170.23; latest eCFR display date controls Review date 2026-10-18 https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
CMMC program rule
CM02 Current CMMC program information Source role Agency program announcement Relevant locator Phase II suspended July 13 2026; Phase I continues; obtain operative instruments Review date 2026-10-18 https://dodcio.defense.gov/cmmc/About/
Current CMMC program information
CM03 CMMC Phase II suspension announcement Source role Agency announcement Relevant locator July 13 2026; read with the contract and deviation text Review date 2026-10-18 https://business.defense.gov/Engage/News/Newsfeed-Repository/Article/4542563/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/
CMMC Phase II suspension announcement
CM04 DFARS CMMC clause Source role Federal acquisition clause Relevant locator 252.204-7021; compare actual incorporated clause and deviation Review date 2026-10-18 https://www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses#DFARS_252.204-7021
DFARS CMMC clause
CM05 DFARS safeguarding and cyber incident reporting Source role Federal acquisition clause Relevant locator 252.204-7012; cloud and incident obligations where incorporated Review date 2026-10-18 https://www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses#DFARS_252.204-7012
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
CM06 FAR basic safeguarding Source role Federal acquisition clause Relevant locator 52.204-21; FCI and safeguards Review date 2026-10-18 https://www.acquisition.gov/far/52.204-21
FAR basic safeguarding
CM07 Current defense acquisition class deviations Source role Agency implementation index Relevant locator 2026-O0025 revision 3 and later operative instruments; contract specific confirmation Review date 2026-10-18 https://www.acq.osd.mil/dpap/dars/dfars_far_overhaul_class_deviations.html
Current defense acquisition class deviations
CM08 CMMC Level 2 scoping guidance Source role Agency technical guidance Relevant locator Asset categories, external and cloud service providers Review date 2026-10-18 https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL2v2.pdf
CMMC Level 2 scoping guidance
CM09 CMMC resources and documentation Source role Agency resources index Relevant locator Locate current assessment/scoping guides and implementation memoranda Review date 2026-10-18 https://dodcio.defense.gov/CMMC/Resources-Documentation/
CMMC resources and documentation
CM10 Defense class deviation 2026 O0025 Revision 3 Source role Signed agency implementation memorandum and attachments Relevant locator Pages 1 to 4; September 3 2026 index date; contract action, retained Revision 2 baseline and suspended Phase II transition Review date 2026-10-18 https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf
Defense class deviation 2026 O0025 Revision 3
NI01 NIST SP 800-171 Revision 2 Source role Technical standard publication page Relevant locator 110 security requirements; the earlier revision that CMMC references Review date 2026-10-18 https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
NIST SP 800-171 Revision 2
NI02 NIST SP 800-171 Revision 3 Source role Technical standard publication page Relevant locator Published May 2024; the revision incorporated in the contract governs until the contract changes Review date 2026-10-18 https://csrc.nist.gov/pubs/sp/800/171/r3/final
NIST SP 800-171 Revision 3
NI03 NIST SP 800-171A Revision 3 Source role Technical assessment guidance Relevant locator Examine, interview and test; pair with the correct requirement revision Review date 2026-10-18 https://csrc.nist.gov/pubs/sp/800/171/A/r3/final
NIST SP 800-171A Revision 3
NI04 NIST SP 800-86 Source role Technical forensic guidance Relevant locator Sections 3 to 6; collection, data files, operating systems, network/application sources Review date 2026-10-18 https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf
NIST SP 800-86
NI05 NIST SP 800-115 Source role Technical testing guidance Relevant locator Assessment planning, logistics, rules of engagement and reporting Review date 2026-10-18 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST SP 800-115
NI06 NIST Cybersecurity Framework 2 Source role Voluntary risk framework Relevant locator Govern, Identify, Protect, Detect, Respond, Recover; voluntary program framework Review date 2026-10-18 https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
NIST Cybersecurity Framework 2
EA01 EAR scope Source role Federal regulatory compilation Relevant locator 734.3, 734.13 to 734.19; jurisdiction, releases and conditional encrypted transmission Review date 2026-10-18 https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734
EAR scope
EA02 EAR recordkeeping Source role Federal regulatory compilation Relevant locator 762.2, 762.6; records and retention trigger Review date 2026-10-18 https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-762
EAR recordkeeping
EA03 BIS export compliance programs Source role Agency program guidance Relevant locator Eight elements; export compliance program guidance Review date 2026-10-18 https://www.bis.gov/learn-support/export-compliance-programs
BIS export compliance programs
EA04 BIS export compliance toolkit Source role Agency guidance index Relevant locator Classification, screening, technology controls and self audit modules Review date 2026-10-18 https://www.bis.gov/learn-support/export-compliance-programs/export-compliance-toolkit
BIS export compliance toolkit
EA05 EAR end user and end use controls Source role Federal regulatory compilation Relevant locator Transaction specific end user/end use controls Review date 2026-10-18 https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-744
EAR end user and end use controls
IT01 ITAR definitions Source role Federal regulatory compilation Relevant locator 120.31 to 120.33, 120.50 to 120.63; verify current text Review date 2026-10-18 https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120
ITAR definitions
IT02 ITAR encrypted technical data provision Source role Federal regulatory compilation Relevant locator 120.54(a)(5), (b), (c); current eCFR display as of October 15 2026 when researched Review date 2026-10-18 https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.54
ITAR encrypted technical data provision
IT03 ITAR registration and recordkeeping Source role Federal regulatory compilation Relevant locator 122.1 and 122.5; registration and export authorization are separate steps Review date 2026-10-18 https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-122
ITAR registration and recordkeeping
IT04 DDTC understanding ITAR Source role Agency jurisdiction guidance Relevant locator ITAR parts 120 to 130, USML, defense services and brokering Review date 2026-10-18 https://www.pmddtc.state.gov/ddtc_public/ddtc_landing?id=ddtc_public_portal_itar_landing
DDTC understanding ITAR
IT05 DDTC registration explanation Source role Agency registration guidance Review date 2026-10-18 https://www.pmddtc.state.gov/registration/documents/DS2032v4.4.pdf
DDTC Form DS-2032, Statement of Registration
LG01 Federal Rules of Civil Procedure December 2025 Source role Court procedural rules Relevant locator Rules 26, 33, 34, 37(e), 45; current court and case orders also apply Review date 2026-10-18 https://www.uscourts.gov/sites/default/files/document/federal-rules-of-civil-procedure.pdf
Federal Rules of Civil Procedure December 2025
LG02 Federal Rules of Evidence Source role Court procedural rules index Relevant locator Rules 502, 901, 902; authentication and privilege plan for counsel Review date 2026-10-18 https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-evidence
Federal Rules of Evidence
HE01 HIPAA Security Rule Source role Federal regulatory compilation Relevant locator 164.308(a)(1), 164.312(b), 164.316; regulated entity applicability Review date 2026-10-18 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
HIPAA Security Rule
HE02 HIPAA judicial proceedings provision Source role Federal regulatory compilation Relevant locator 164.512(e); legal process and assurances Review date 2026-10-18 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512
HIPAA judicial proceedings provision
HE03 HHS court orders and subpoenas Source role Agency interpretation Relevant locator Court order distinct from other subpoenas; disclosure within the authorized scope Review date 2026-10-18 https://www.hhs.gov/hipaa/for-individuals/court-orders-subpoenas/index.html
HHS court orders and subpoenas
HE04 HHS medical record retention FAQ Source role Agency interpretation Relevant locator Medical record retention periods come from state law and other obligations rather than the HIPAA Privacy Rule Review date 2026-10-18 https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html
HHS medical record retention FAQ
HE05 HHS Part 2 confidentiality Source role Agency interpretation Relevant locator 2024 final rule compliance February 16 2026; legal proceedings against patient Review date 2026-10-18 https://www.hhs.gov/hipaa/part-2/index.html
HHS Part 2 confidentiality
HE06 ONC auditable events certification guidance Source role Agency certification guidance Relevant locator 170.315(d)(2); product capability, with deployment and retention confirmed at the site Review date 2026-10-18 https://healthit.gov/test-method/auditable-events-and-tamper-resistance/
ONC auditable events certification guidance
HE07 Substance use disorder record regulation Source role Federal regulatory compilation Relevant locator Part 2; litigation and consent review by counsel Review date 2026-10-18 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
Substance use disorder record regulation
MS01 Microsoft eDiscovery data sources Source role Vendor documentation Relevant locator Mailbox, OneDrive, SharePoint locations; source specific inclusion Review date 2026-10-18 https://learn.microsoft.com/en-us/purview/edisc-data-sources
Microsoft eDiscovery data sources
MS02 Microsoft Teams content in eDiscovery Source role Vendor documentation Relevant locator Compliance records, files, channels, recordings and known exclusions Review date 2026-10-18 https://learn.microsoft.com/en-us/purview/edisc-search-teams
Microsoft Teams content in eDiscovery
MS03 OneDrive retention and deletion Source role Vendor documentation Relevant locator Deleted users, unlicensed archives, retention/hold and recycle bin behavior Review date 2026-10-18 https://learn.microsoft.com/en-us/onedrive/retention-and-deletion
OneDrive retention and deletion
MS04 Microsoft audit retention Source role Vendor documentation Relevant locator License dependent retention policies; inspect actual configuration Review date 2026-10-18 https://learn.microsoft.com/en-us/purview/audit-log-retention-policies
Microsoft audit retention
MS05 SharePoint and OneDrive retention Source role Vendor documentation Relevant locator Preservation Hold library, versions and recycle bin search behavior Review date 2026-10-18 https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint
SharePoint and OneDrive retention
MS06 Microsoft eDiscovery process reports Source role Vendor documentation Relevant locator Search/export scope, location counts, errors and completeness checks Review date 2026-10-18 https://learn.microsoft.com/en-us/purview/edisc-process-report
Microsoft eDiscovery process reports
GO01 Google Vault overview Source role Vendor documentation Relevant locator Supported services; licenses, retention, holds; works on live Workspace data Review date 2026-10-18 https://support.google.com/vault/answer/2462365?hl=en
Google Vault overview
GO02 Google audit lag and retention Source role Vendor documentation Relevant locator Log specific retention/lag; event coverage by log type Review date 2026-10-18 https://support.google.com/a/answer/7061566?hl=en
Google audit lag and retention
SL01 Slack Discovery APIs Source role Vendor documentation Relevant locator Enterprise, approved applications, preserved content and export scope Review date 2026-10-18 https://slack.com/help/articles/360002079527-a-guide-to-slacks-discovery-apis
Slack Discovery APIs
SL02 Slack Connect data management Source role Vendor documentation Relevant locator External organization ownership, export exclusions and retention Review date 2026-10-18 https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect
Slack Connect data management
AW01 AWS CloudTrail event history Source role Vendor documentation Relevant locator 90 day regional management history; data events through configured trails Review date 2026-10-18 https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html
AWS CloudTrail event history
DS01 Docusign history and completion certificate Source role Vendor documentation Relevant locator Envelope history and certificate. Review date 2026-10-18 https://support.docusign.com/s/document-item?bundleId=oeq1643226594604&topicId=hha1578456343641.html&language=en_US
Docusign history and completion certificate
CL01 Clio matter export scope Source role Vendor documentation Relevant locator Matter list export plus separate subtabs for activities and transactions Review date 2026-10-18 https://help.clio.com/hc/en-150/articles/9286116462747-Filter-Export-and-Convert-Matters
Clio matter export scope
CL02 Clio text message exports Source role Vendor documentation Relevant locator Messaging and PDF export; confirm tenant, version and export scope Review date 2026-10-18 https://help.clio.com/hc/en-us/articles/9125220988827-Text-Messaging-in-Clio-Manage
Clio text message exports
FT01 FTC Safeguards Rule business guidance Source role Agency guidance Relevant locator Covered financial institutions; limited exemptions; program selection only Review date 2026-10-18 https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
FTC Safeguards Rule business guidance
FP01 FedRAMP authorization explanation Source role Agency program index Relevant locator Cloud authorization context; agency and authorization specific scope Review date 2026-10-18 https://www.fedramp.gov/
FedRAMP authorization explanation
Bring the completed pack to a free scoping call and a senior examiner sets the scope from it. Call (800) 868-8189 .
Source review date: October 18 2026.
