Regulation is the set of laws, rules, and formal requirements that govern how organizations collect, use, store, transfer, and secure information. In cybersecurity, its scope may depend on the data involved, the organization’s sector, and the jurisdictions in which it operates. Requirements can address privacy, access control, risk assessment, retention, encryption, audit records, third-party oversight, and notification of certain security incidents.
For practitioners, regulation turns security obligations into evidence-based operational work: identifying regulated data, mapping it to systems and suppliers, testing safeguards, and preserving records that demonstrate compliance. It also affects vulnerability management and incident response, because organizations may need documented remediation priorities, investigation procedures, and legally defined notifications. Meeting a regulatory requirement does not guarantee that systems are secure; controls must still reflect current threats and the organization’s actual attack surface. Noncompliance can create legal, financial, and operational exposure, particularly when weak governance obscures who is responsible for protecting data.