Compliance is a buying force, not a category.

SaaS and cloud-hosted services selling into enterprise. Not legally required — required by your customers in their procurement process.

Any organisation selling into international enterprise, especially EU/UK and APAC. Often a procurement prerequisite outside the US.

Covered entities (providers, payers, clearinghouses) and their business associates. Anyone touching protected health information.

Any merchant or service provider that stores, processes, or transmits cardholder data. Scope reduction is the entire game.

Cloud service providers selling into US federal agencies. Three levels: Low, Moderate, High; most federal SaaS sits at Moderate.

The Defense Industrial Base — any contractor or subcontractor handling federal contract information or controlled unclassified information.

Banks, insurers, mortgage companies, and other DFS-licensed financial entities operating in or doing business with New York.

Essential and important entities across 18 sectors (energy, transport, banking, health, digital infrastructure, public administration, and more). Significantly expanded scope vs NIS1.

EU financial entities and their critical ICT third-party providers. Banks, insurers, investment firms, crypto-asset providers, and the technology vendors that serve them.

Any organisation processing personal data of EU residents, regardless of where the organisation is based. Controllers and processors have different obligations.

US public companies subject to Exchange Act reporting. Foreign private issuers are subject to a parallel framework.