Global Regulations Cheat Sheet

How to navigate evolving cybersecurity and software supply chain requirements

Download the Guide

Organizations today face a growing set of global regulations focused on software transparency, supply chain security, and operational resilience. While each framework varies, they share common themes: visibility into components, risk management, and rapid response to vulnerabilities.

This cheat sheet provides an overview of key regulations, a quick way to assess your readiness, and details on how Sonatype helps accelerate compliance.

1. SEBI Cybersecurity & Cyber Resilience Framework

Why it matters

SEBI requires regulated entities to strengthen cybersecurity posture with increased emphasis on software component visibility, SBOM adoption, and third-party risk management.

Checklist

• Do we maintain a complete and up-to-date SBOM for all applications?
• Are all third-party and open source components identified and tracked?
• Can we verify the integrity and authenticity of software components?
• Do we track licenses and supplier metadata for compliance purposes?
• Are vulnerabilities continuously monitored across all dependencies?

How Sonatype helps

• Automatically generates and maintains accurate SBOMs across the SDLC
• Provides deep visibility into open source and third-party components
• Continuously monitors for vulnerabilities, license risks, and integrity issues
• Enables policy enforcement aligned with regulatory requirements

2. CERT-In Cybersecurity Directions (India)

Focus: Incident reporting, monitoring, and security controls

Why it matters

CERT-In mandates strict requirements for incident detection, reporting timelines, and system logging, increasing accountability for cybersecurity operations.

Checklist

• Do we detect and report incidents within mandated timeframes?
• Are logs collected, stored, and monitored across all systems?
• Do we have visibility into software vulnerabilities impacting operations?
• Are response processes documented and regularly tested?

How Sonatype helps

• Identifies vulnerabilities early to reduce incident likelihood
• Provides continuous monitoring of component risk exposure
• Integrates into workflows to support rapid remediation and reporting readiness

3. DORA (EU Digital Operational Resilience Act)

Focus: ICT risk management and operational resilience

Why it matters

DORA standardizes how financial institutions manage ICT risk, resilience testing, and third-party dependencies across the EU.

Checklist

• Do we continuously monitor ICT and software supply chain risks?
• Are third-party dependencies fully documented and assessed?
• Do we perform regular resilience and vulnerability testing?
• Can we respond quickly to software-related disruptions?

How Sonatype helps

• Enables full visibility into software supply chains and dependencies
• Continuously evaluates component health and policy compliance
• Supports proactive risk mitigation before issues impact operations

4. NIS2 Directive (EU)

Focus: Cyber risk management and supply chain security

Why it matters

NIS2 expands cybersecurity obligations across industries, emphasizing risk management, governance, and supply chain accountability.

Checklist

• Do we assess cybersecurity risk across suppliers and software components?
• Are secure development practices enforced across teams?
• Do we monitor and remediate vulnerabilities continuously?
• Is executive oversight in place for cybersecurity risk?

How Sonatype helps

• Provides actionable insights into component and supplier risk
• Enforces security policies directly in developer workflows
• Reduces exposure through automated risk detection and remediation

5. U.S. Executive Order 14028

Focus: Software supply chain security and SBOM adoption

Why it matters

This executive order drives adoption of SBOMs, secure software development practices, and vendor transparency across federal systems.

Checklist

• Do we generate SBOMs for all delivered software?
• Are software components traceable and verifiable?
• Do we follow secure development and vulnerability management practices?
• Can we share SBOM data with stakeholders when required?

How Sonatype helps

• Automates SBOM generation aligned with industry standards (CycloneDX, SPDX)
• Ensures complete visibility into all components, including transitive dependencies
• Supports compliance with federal supply chain security expectations

6. NIST SSDF (Secure Software Development Framework)

Focus: Secure development lifecycle practices

Why it matters

SSDF provides guidelines for embedding security throughout the software development lifecycle, from design to deployment.

Checklist

• Are security practices integrated into development workflows?
• Do we identify and remediate vulnerabilities early in the SDLC?
• Are software components continuously evaluated for risk?
• Do developers receive actionable security guidance?

How Sonatype helps

• Integrates directly into developer tools for real-time risk feedback
• Automates vulnerability detection and prioritization
• Enables secure-by-design development practices

7. ISO/IEC 27001 (Software & Supply Chain Context)

Focus: Information security management systems

Why it matters

ISO 27001 requires organizations to implement structured information security controls, including those related to software and third-party risk.

Checklist

• Are software components governed under security policies?
• Do we manage third-party and open source risk effectively?
• Are vulnerabilities tracked and remediated systematically?
• Is compliance continuously monitored and audited?

How Sonatype helps

• Centralizes policy management for open source and third-party components
• Provides audit-ready visibility into software risk posture
• Automates enforcement of security and compliance controls

8. PCI DSS (Software Security Aspects)

Focus: Protecting payment systems and sensitive data

Why it matters

PCI DSS requires strong controls to protect cardholder data, including secure software and vulnerability management.

Checklist

• Are vulnerabilities identified and remediated in a timely manner?
• Do we maintain secure configurations across applications?
• Are third-party components assessed for risk?
• Do we enforce secure development practices?

How Sonatype helps

• Detects and prioritizes vulnerabilities impacting payment systems
• Prevents risky components from entering development pipelines
• Supports continuous compliance with security requirements

9. UK FCA / PRA Operational Resilience Requirements

Focus: Business continuity and third-party risk

Why it matters

UK regulators emphasize operational resilience, including the ability to withstand disruptions caused by technology and third-party dependencies.

Checklist

• Do we understand critical software dependencies and their risks?
• Are resilience and recovery plans in place and tested?
• Can we quickly identify and remediate vulnerable components?
• Do we monitor third-party software risk continuously?

How Sonatype helps

• Maps and monitors critical software dependencies
• Enables rapid identification of vulnerable components
• Strengthens resilience through proactive risk management

Simplify Compliance Across Regulations

Sonatype provides a unified platform to help organizations address overlapping regulatory requirements by delivering:

• End-to-end software supply chain visibility
• Automated SBOM generation and management
• Continuous vulnerability and policy monitoring
• Developer-first security workflows

Meet Regulatory Deadlines Faster