# Global Regulations Cheat Sheet

How to navigate evolving cybersecurity and software supply chain requirements

[Download the Guide](/content/hubfs/White_Papers/SON-WP-GlobalRegulations-CheatSheet-v3.pdf)

Organizations today face a growing set of global regulations focused on software transparency, supply chain security, and operational resilience. While each framework varies, they share common themes: visibility into components, risk management, and rapid response to vulnerabilities.

This cheat sheet provides an overview of key regulations, a quick way to assess your readiness, and details on how Sonatype helps accelerate compliance.

## 1. SEBI Cybersecurity & Cyber Resilience Framework

### Why it matters
SEBI requires regulated entities to strengthen cybersecurity posture with increased emphasis on software component visibility, SBOM adoption, and third-party risk management.

### Checklist
- Do we maintain a complete and up-to-date SBOM for all applications?
- Are all third-party and open source components identified and tracked?
- Can we verify the integrity and authenticity of software components?
- Do we track licenses and supplier metadata for compliance purposes?
- Are vulnerabilities continuously monitored across all dependencies?

### How Sonatype helps
- Automatically generates and maintains accurate SBOMs across the SDLC
- Provides deep visibility into open source and third-party components
- Continuously monitors for vulnerabilities, license risks, and integrity issues
- Enables policy enforcement aligned with regulatory requirements

## 2. CERT-In Cybersecurity Directions (India)

_Focus: Incident reporting, monitoring, and security controls_

### Why it matters
CERT-In mandates strict requirements for incident detection, reporting timelines, and system logging, increasing accountability for cybersecurity operations.

### Checklist
- Do we detect and report incidents within mandated timeframes?
- Are logs collected, stored, and monitored across all systems?
- Do we have visibility into software vulnerabilities impacting operations?
- Are response processes documented and regularly tested?

### How Sonatype helps
- Identifies vulnerabilities early to reduce incident likelihood
- Provides continuous monitoring of component risk exposure
- Integrates into workflows to support rapid remediation and reporting readiness

## 3. DORA (EU Digital Operational Resilience Act)

_Focus: ICT risk management and operational resilience_

### Why it matters
DORA standardizes how financial institutions manage ICT risk, resilience testing, and third-party dependencies across the EU.

### Checklist
- Do we continuously monitor ICT and software supply chain risks?
- Are third-party dependencies fully documented and assessed?
- Do we perform regular resilience and vulnerability testing?
- Can we respond quickly to software-related disruptions?

### How Sonatype helps
- Enables full visibility into software supply chains and dependencies
- Continuously evaluates component health and policy compliance
- Supports proactive risk mitigation before issues impact operations

## 4. NIS2 Directive (EU)

_Focus: Cyber risk management and supply chain security_

### Why it matters
NIS2 expands cybersecurity obligations across industries, emphasizing risk management, governance, and supply chain accountability.

### Checklist
- Do we assess cybersecurity risk across suppliers and software components?
- Are secure development practices enforced across teams?
- Do we monitor and remediate vulnerabilities continuously?
- Is executive oversight in place for cybersecurity risk?

### How Sonatype helps
- Provides actionable insights into component and supplier risk
- Enforces security policies directly in developer workflows
- Reduces exposure through automated risk detection and remediation

## 5. U.S. Executive Order 14028

_Focus: Software supply chain security and SBOM adoption_

### Why it matters
This executive order drives adoption of SBOMs, secure software development practices, and vendor transparency across federal systems.

### Checklist
- Do we generate SBOMs for all delivered software?
- Are software components traceable and verifiable?
- Do we follow secure development and vulnerability management practices?
- Can we share SBOM data with stakeholders when required?

### How Sonatype helps
- Automates SBOM generation aligned with industry standards (CycloneDX, SPDX)
- Ensures complete visibility into all components, including transitive dependencies
- Supports compliance with federal supply chain security expectations

## 6. NIST SSDF (Secure Software Development Framework)

_Focus: Secure development lifecycle practices_

### Why it matters
SSDF provides guidelines for embedding security throughout the software development lifecycle, from design to deployment.

### Checklist
- Are security practices integrated into development workflows?
- Do we identify and remediate vulnerabilities early in the SDLC?
- Are software components continuously evaluated for risk?
- Do developers receive actionable security guidance?

### How Sonatype helps
- Integrates directly into developer tools for real-time risk feedback
- Automates vulnerability detection and prioritization
- Enables secure-by-design development practices

## 7. ISO/IEC 27001 (Software & Supply Chain Context)

_Focus: Information security management systems_

### Why it matters
ISO 27001 requires organizations to implement structured information security controls, including those related to software and third-party risk.

### Checklist
- Are software components governed under security policies?
- Do we manage third-party and open source risk effectively?
- Are vulnerabilities tracked and remediated systematically?
- Is compliance continuously monitored and audited?

### How Sonatype helps
- Centralizes policy management for open source and third-party components
- Provides audit-ready visibility into software risk posture
- Automates enforcement of security and compliance controls

## 8. PCI DSS (Software Security Aspects)

_Focus: Protecting payment systems and sensitive data_

### Why it matters
PCI DSS requires strong controls to protect cardholder data, including secure software and vulnerability management.

### Checklist
- Are vulnerabilities identified and remediated in a timely manner?
- Do we maintain secure configurations across applications?
- Are third-party components assessed for risk?
- Do we enforce secure development practices?

### How Sonatype helps
- Detects and prioritizes vulnerabilities impacting payment systems
- Prevents risky components from entering development pipelines
- Supports continuous compliance with security requirements

## 9. UK FCA / PRA Operational Resilience Requirements

_Focus: Business continuity and third-party risk_

### Why it matters
UK regulators emphasize operational resilience, including the ability to withstand disruptions caused by technology and third-party dependencies.

### Checklist
- Do we understand critical software dependencies and their risks?
- Are resilience and recovery plans in place and tested?
- Can we quickly identify and remediate vulnerable components?
- Do we monitor third-party software risk continuously?

### How Sonatype helps
- Maps and monitors critical software dependencies
- Enables rapid identification of vulnerable components
- Strengthens resilience through proactive risk management

## Simplify Compliance Across Regulations

Sonatype provides a unified platform to help organizations address overlapping regulatory requirements by delivering:
- End-to-end software supply chain visibility
- Automated SBOM generation and management
- Continuous vulnerability and policy monitoring
- Developer-first security workflows

Meet Regulatory Deadlines Faster

---