Home / Rules by market
The rules that make a standard apply
A mechanism standard binds nobody by itself. It applies when a contract, a scheme, a regulator or your own policy points at it. This page names the regimes that commonly do, per market, and says plainly where this site has not analysed them.
| Market | Regimes that can point at an entity authentication standard | What this record says |
|---|---|---|
| United States | FISMA and the NIST control set, FedRAMP, and sector rules that adopt NIST publications | Named, not analysed. The mechanism standard can be cited through a control that requires strong entity authentication. |
| European Union | NIS2, the Cyber Resilience Act, eIDAS and the implementing acts around electronic identification | Named, not analysed. A conformity route may name a harmonised standard rather than this part. |
| United Kingdom | NCSC guidance and the Cyber Assessment Framework, plus sector regulators that reference it | Named, not analysed. The framework expects evidence of authentication design, not a certificate. |
| Australia | The Security of Critical Infrastructure Act and the Information Security Manual | Named, not analysed. The manual names approved cryptographic mechanisms and the evidence to keep. |
How to use this page
Find the regime your organisation is actually held to, then find the clause or control that names the standard or the mechanism. If nothing names it, the standard is good practice and not an obligation, and the record should say so in the risk register rather than in a compliance claim.
What is deliberately missing
No legal analysis of any regime, no mapping table and no claim that a regime requires this part. Those would need a lawyer and a current text, and this site has neither. The four markets are named so that a reader knows where to look, not so that the site can imply an obligation it has not proved.
Not legal advice; does not certify.