Cybersecurity Directory: Purpose and Scope

The National Digital Security Authority maintains this directory as a structured reference index of cybersecurity service providers, regulatory frameworks, professional credentials, and sector-specific compliance resources operating within the United States. The directory spans the full landscape of digital security services — from federal agency programs and certified professional practitioners to sector-specific compliance regimes and incident response resources. Its scope reflects the fragmented but codified nature of US cybersecurity governance, where authority is distributed across federal agencies, sector regulators, and state-level bodies. Navigating this landscape without a structured reference requires cross-referencing dozens of agency websites, statutory texts, and standards documents — a task this directory is designed to reduce.

Standards for Inclusion

Listings and referenced resources within this directory meet a defined set of inclusion criteria applied consistently across all categories. The criteria are drawn from publicly recognized qualification frameworks, statutory designations, and standards body publications — not from commercial relationships or self-reported claims.

Inclusion standards operate across four primary categories:

1. Regulatory and Agency Resources — Entities must be US government agencies, offices, or programs with a statutory or executive mandate covering cybersecurity. Examples include the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), and the Office of the National Cyber Director (ONCD). References to these bodies link to primary source materials including NIST Special Publications, CISA advisories, and the US Cybersecurity Regulatory Framework.

2. Credentialed Professionals and Firms — Individual practitioners or firms listed in the Cybersecurity Professional Directory must hold at least one credential recognized by an accredited body. Recognized frameworks include certifications governed by (ISC)², ISACA, CompTIA, GIAC, or federal designations such as those tied to CMMC (Cybersecurity Maturity Model Certification) under 32 CFR Part 170. The Cybersecurity Certifications and Credentials reference section defines the full list of accepted credentials.

3. Sector-Specific Compliance Services — Service providers operating in regulated sectors — including healthcare under HIPAA (45 CFR Parts 160 and 164), financial services under the Gramm-Leach-Bliley Act (GLBA), and defense contracting under DFARS clause 252.204-7012 — must demonstrate documented alignment with the applicable sectoral standard. The directory covers these verticals through dedicated reference pages including Healthcare Cybersecurity Requirements, Financial Sector Cybersecurity Compliance, and Government Contractor Cybersecurity Requirements.

4. Standards and Framework References — Technical standards, frameworks, and guidance documents are included only when published by a named standards body (NIST, ISO/IEC, NERC, IETF, or equivalent) or when adopted by reference into federal or state regulation.

How the Directory Is Maintained

Directory content is maintained through a structured review cycle that applies documented criteria at each update interval. The maintenance process operates across three phases:

• Initial qualification review — Each listing or referenced resource is validated against the inclusion standards defined above before publication. For regulatory resources, the primary source URL is confirmed against the issuing agency's official domain (e.g., cisa.gov, nist.gov, hhs.gov).
• Periodic accuracy audits — Regulatory citations are cross-checked against current codified versions in the Electronic Code of Federal Regulations (eCFR) at ecfr.gov. Standards references are checked against the issuing body's publication database. NIST SP 800-series documents, for example, undergo revision cycles that affect cited control baselines.
• Flagging and removal — Listings that no longer meet inclusion standards — due to lapsed credentials, dissolved entities, or superseded regulatory designations — are flagged for removal at the next audit cycle. Superseded standards are noted with the replacement document identified by name and number.

The directory does not operate as a real-time database. Time-sensitive regulatory developments, such as amendments to the National Cybersecurity Strategy or new CISA binding operational directives, are reflected in the relevant reference sections following audit confirmation.

What the Directory Does Not Cover

The scope of this directory has defined boundaries that distinguish it from adjacent resource types.

Excluded categories include:

• Incident reporting portals for active cyber incidents — those are handled through the Internet Crime Complaint Center (IC3) at ic3.gov and CISA's reporting infrastructure; see Cybersecurity Reporting Obligations for a structured breakdown
• Legal representation and cybersecurity litigation services — no law firms or legal practitioners are listed in this directory
• Cyber insurance underwriters and policy products — the Cyber Insurance Landscape reference page covers the regulatory and market structure of this sector without endorsing specific carriers
• Academic research institutions and degree programs — workforce development resources are addressed separately through Cybersecurity Workforce Development, which references programs aligned with the NICE Cybersecurity Workforce Framework (NIST SP 800-181)
• International jurisdictions — the directory's geographic scope is limited to US federal law, US-operating entities, and state-level regulatory regimes; cross-border frameworks such as the EU NIS2 Directive or ISO/IEC 27001 are referenced only where they intersect with US compliance obligations

The distinction between a regulatory reference resource and a procurement platform is a structural boundary this directory maintains. No listing constitutes an endorsement, procurement recommendation, or qualified bidders list.

Relationship to Other Network Resources

This directory operates as a structured index that connects to a set of topical reference pages covering specific regulatory domains, sector verticals, and professional qualification standards. The Cybersecurity Listings section provides the primary index of categorized entries. The NIST Cybersecurity Framework reference page covers the five-function CSF structure (Identify, Protect, Detect, Respond, Recover) and its application across sectors. Federal agency programs — including CISA's known exploited vulnerabilities catalog and its Shields Up advisory structure — are documented through CISA Resources and Programs.

Sector-specific compliance regimes are addressed through the Sector-Specific Cybersecurity Requirements index, which routes to vertical pages covering energy, healthcare, financial services, defense contracting, and critical infrastructure protection. The Federal Cybersecurity Agencies reference page maps the statutory authority of 12 named federal bodies with cybersecurity mandates, including NSA, CISA, FBI Cyber Division, and the Office of Management and Budget (OMB).

Readers navigating this directory for the first time can consult How to Use This Cybersecurity Resource for a structured orientation to the directory's classification system, search conventions, and the relationship between topical reference pages and listed service categories.