Too Many Mandates or Too Many Programs?

States enacted 145 new AI laws in 2025; federal agencies issued 59 AI regulations the year before that. And AI is only one lane — 24 states now run comprehensive privacy regimes, while healthcare, insurance, and financial institutions each carry sector-specific stacks of their own. Whatever your mandate count is today, treat it as a floor.

As regulations evolve, new mandates take effect, and customers and suppliers introduce additional requirements. Organizations respond by establishing controls, assessments, and reporting processes to meet each obligation. 

Without a coordinated approach, those responses gradually become separate compliance programs. Controls overlap, evidence is collected repeatedly, and teams spend more time managing compliance than strengthening security.

You don’t have a hundred-mandate problem. You have a hundred-program problem.

HOW IT ADDED UP

The Rise of Siloed Compliance Programs

Responsibility for meeting these obligations often fell to different departments. Insurance teams managed the National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law, banking partners layered on contractual security and reporting obligations, and legal departments tracked an expanding collection of state privacy statutes.

Each department developed its own approach to compliance, with separate control lists, evidence repositories, assessment schedules, and reporting cycles. These processes often evolved independently, with little consideration of where they overlapped.

Each department met its obligations, while duplication across the organization often went unaddressed.

THE REAL COST

The Same Control, Assessed a Hundred Ways

A single control, such as multi-factor authentication, can satisfy multiple regulatory requirements. Yet organizations often assess that same control separately for insurance examinations, HIPAA risk analyses, customer security questionnaires, and internal audits. The result isn't stronger security. It's repeated evidence collection, often in different formats that become difficult to reconcile.

The Cyber Risk Institute's CRI Profile puts this duplication into perspective: more than 3,500 regulatory expectations consolidated into 318 control objectives. Rather than treating every requirement as a separate assessment, organizations can use a common set of controls to demonstrate compliance across multiple frameworks.

The operational burden becomes more apparent when an incident demands immediate action. Teams must determine which reporting obligations apply while gathering information from compliance programs that may have operated independently.

Under New York's cybersecurity regulation, covered entities must report qualifying cybersecurity incidents within 72 hours of determining they occurred and notify the superintendent within 24 hours of making an extortion payment.

When reporting deadlines are measured in hours, managing multiple compliance programs leaves less time to establish what happened and coordinate a response.

ON THE HORIZON

New Regulations, Familiar Challenges

Organizations are facing another wave of regulatory requirements, even as they work to manage the programs already in place.

CISA submitted its final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule to the Office of Information and Regulatory Affairs (OIRA) for review on October 1, 2026, which can run up to 90 days or longer. Final text and publication could slip to early 2027. HHS estimates that its proposed HIPAA Security Rule revisions would cost regulated entities approximately $9 billion in the first year and $6 billion annually in years two through five. Final action on the revisions is currently projected for July 2027. For affected payers, the Centers for Medicare & Medicaid Services (CMS) Prior Authorization API requirements introduce another deadline beginning January 1, 2027. 

PUTTING IT INTO PRACTICE

One Set of Controls, Assessed Once

I developed the Armor Unified Control Framework to consolidate requirements from multiple regulations into a single set of controls. We assess that one control set at defined frequencies to evaluate compliance across all applicable regulatory frameworks, rather than repeating the work for each mandate.

This goes beyond mapping controls to regulations in a spreadsheet before an audit. The controls form the foundation of our compliance program, with each regulatory requirement mapped to the controls that address it, using the most stringent requirements as our baseline.

New regulatory obligations no longer require us to build separate compliance programs; they become part of the framework we already manage. 

APPLYING THE APPROACH

Aligning Your Control Framework With Regulatory Obligations

The same approach can work across industries, but the framework must reflect each organization's regulatory obligations. At Armor, those requirements reflect our role as a service provider. Hospitals, insurers, and financial institutions face different obligations and need frameworks suited to their operations.

Organizations don't necessarily have to start from scratch. NIST CSF 2.0 offers a general foundation, while financial institutions can build on the CRI Profile. Healthcare organizations can reference HHS's voluntary HPH Cybersecurity Performance Goals, alongside applicable HIPAA and CMS requirements.

Determining which obligations apply requires examining your operations, jurisdictions, and contractual commitments. Legal counsel should help establish those boundaries before requirements are incorporated into the framework.

A unified framework should reflect the obligations your organization must meet, not every regulation it might encounter.

Regulatory complexity will continue to grow, but the operational burden doesn't have to follow. By reducing the effort spent maintaining multiple compliance programs, organizations can devote more resources to strengthening security.

On Tuesday, November 10, I'll demonstrate this approach in Armor Dash: one control mapped to multiple regulatory requirements, with evidence collected once and reused across assessments.

One Program, 100+ Mandates — Register for the Webinar