# Regulated IT Obligations

> The Regulated IT Obligations carries 9 published figures read from 2 sources' own pages, from 1 to 6 year, read 17 October 2026.

Outsourced IT Quotes · https://outsourceditsupportquotes.com/datasets/regulated-it-obligations/ · computed 2026-10-19

**Range of the published figures:** 1 to 6 year (range 1 to 6 year; 9 published figures; 3 of 14 sources read publish one).

3 of the 14 named sources read in full publish a figure; 11 publish none, read 17 October 2026.

## By control

| Breakdown | Median | Range | Sources |
|---|---|---|---|
| control ftc-safeguards-breach-notification | 30 day | 30 to 30 day | 1 |
| control cmmc-assessment-appeal | 21 day | 21 to 21 day | 1 |
| control cmmc-poam-closeout | 180 day | 180 to 180 day | 1 |
| control ftc-safeguards-secure-disposal | 2 year | 2 to 2 year | 1 |
| control ftc-safeguards-vulnerability-assessment | 6 month | 6 to 6 month | 1 |
| control cmmc-periodic-interval-max | 1 year | 1 to 1 year | 1 |
| control cmmc-level2-c3pao-reassessment | 3 year | 3 to 3 year | 1 |
| control cmmc-l3-incident-response-team | 24 hour | 24 to 24 hour | 1 |
| control cmmc-self-assessment-artifact-retention | 6 year | 6 to 6 year | 1 |
| control cmmc-level2-self-reassessment | 3 year | 3 to 3 year | 1 |
| control cmmc-certification-artifact-retention | 6 year | 6 to 6 year | 1 |
| control cmmc-level3-reassessment | 3 year | 3 to 3 year | 1 |
| control cmmc-level3-level2-prerequisite | 3 year | 3 to 3 year | 1 |
| control cmmc-dibcac-high-transition-validity | 3 year | 3 to 3 year | 1 |

## Every figure, with its source

One row per source: the figure the source's own page publishes, the page, and the day it was read.

| Source | Figure | Breakdown | Read |
|---|---|---|---|
| [Federal Register: CMMC Program final rule](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program) | 180 day | cmmc-poam-closeout | 2026-10-17 |
| [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) | 30 day | ftc-safeguards-breach-notification | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 24 hour | cmmc-l3-incident-response-team | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 21 day | cmmc-assessment-appeal | 2026-10-17 |
| [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) | 6 month | ftc-safeguards-vulnerability-assessment | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 6 year | cmmc-self-assessment-artifact-retention | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 6 year | cmmc-certification-artifact-retention | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 3 year | cmmc-level2-c3pao-reassessment | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 3 year | cmmc-level2-self-reassessment | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 3 year | cmmc-level3-reassessment | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 3 year | cmmc-level3-level2-prerequisite | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 3 year | cmmc-dibcac-high-transition-validity | 2026-10-17 |
| [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) | 2 year | ftc-safeguards-secure-disposal | 2026-10-17 |
| [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) | 1 year | cmmc-periodic-interval-max | 2026-10-17 |

## The sentence each figure was read from (14)

- [Federal Register: CMMC Program final rule](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program), read 2026-10-17: "All requirements that were scored “NOT MET” and placed on the POA&M must be remedied within 180 days of receiving their Conditional CMMC Status."
- [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-17: "Upon discovery of a notification event as described in paragraph (j)(2) of this section, if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "(xi) IR.L3-3.6.2e Establish and maintain a cyber-incident response team that can be deployed by the organization within 24 hours."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "(b) An OSC, the CMMC AB, or a C3PAO may appeal the outcome of its DCMA DIBCAC conducted assessment within 21 days by submitting a written basis for appeal with the requirements in question for DCMA DIBCAC consideration."
- [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-17: "(i) Annual penetration testing of your information systems determined each given year based on relevant identified risks in accordance with the risk assessment; and mation systems reasonably designed to identify publicly known security vulnerabilities in your information systems based on the risk assessment, at least every six months; and whenever there are material changes to your operations or b"
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "The artifacts used as evidence for the assessment must be retained by the OSA for six (6) years from the CMMC Status Date."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "The hashed artifacts used as evidence for the assessment must be retained by the OSC for six (6) years from the CMMC Status Date."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "The Level 2 certification assessment process must be performed every three years."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "To maintain compliance with the requirements for a CMMC Status of Level 2 (Self), the OSA must conduct a Level 2 self-assessment every three years and submit the results in SPRS, within three years of the CMMC Status Date associated with the Conditional Level 2 (Self)."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "To maintain compliance with the requirements for a CMMC Status of Level 3 (DIBCAC), the Level 3 certification assessment must be performed every three years for all information systems within the Level 3 CMMC Assessment Scope."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "In addition, given that compliance with Level 2 requirements is a prerequisite for applying for CMMC Level 3, a Level 2 (C3PAO) certification assessment must also be conducted every three years to maintain CMMC Level 3 (DIBCAC) status."
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "An OSC that achieved a perfect score with no open POA&M from a DCMA DIBCAC High Assessment conducted prior to the effective date of this rule, will be given a CMMC Status of Level 2 Final (C3PAO) with a validity period of three (3) years from the date of the original DCMA DIBCAC High Assessment."
- [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-17: "(i) Develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates, unless such informati"
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170), read 2026-10-17: "Periodically means occurring at a regular interval as determined by the OSA that may not exceed one year."

## Read in full, publishes no figure

- [eCFR 45 CFR 164.308 administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308), read 2026-10-17: read in full and no accepted figure on the page
- [eCFR 45 CFR 164.312 technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312), read 2026-10-17: read in full and no accepted figure on the page
- [eCFR 17 CFR 240.13a-15](https://www.ecfr.gov/current/title-17/chapter-II/part-240/section-240.13a-15), read 2026-10-17: read in full and no accepted figure on the page
- [FTC Gramm-Leach-Bliley business guidance](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), read 2026-10-17: read in full and no accepted figure on the page
- [ICO guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), read 2026-10-11: read in full and no accepted figure on the page
- [SRA Code of Conduct for Solicitors](https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-solicitors/), read 2026-10-03: read in full and no accepted figure on the page
- [PCI Security Standards Council: PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/), read 2026-09-11: read in full and no accepted figure on the page
- [HHS Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html), read 2026-10-10: read in full and no accepted figure on the page
- [HHS business associates guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), read 2026-09-12: read in full and no accepted figure on the page
- [ABA Model Rule 1.6 confidentiality](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/), read 2026-10-10: read in full and no accepted figure on the page
- [ABA Model Rule 1.1 competence](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/), read 2026-10-10: read in full and no accepted figure on the page

## Methodology

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 3 of the 14 named sources that could be read published a usable figure; 11 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in year (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 9 figures, never sentences; 67 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per control, quoted verbatim from the instrument with its citation and effective date, and marked required or addressable where the instrument marks it; the cross-regime comparison - which controls a law firm, a clinic, a defence supplier and a card-taking retailer each owe, and which are the same control under four names - is the figure nobody publishes. Changed-since makes a rate-year turn or a rule amendment the news.

## Sources

- [eCFR 45 CFR 164.308 administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308) (the publisher's own terms; quoted for reporting and comment)
- [eCFR 45 CFR 164.312 technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) (the publisher's own terms; quoted for reporting and comment)
- [eCFR 32 CFR part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-M/part-170) (the publisher's own terms; quoted for reporting and comment)
- [Federal Register: CMMC Program final rule](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program) (the publisher's own terms; quoted for reporting and comment)
- [eCFR 17 CFR 240.13a-15](https://www.ecfr.gov/current/title-17/chapter-II/part-240/section-240.13a-15) (the publisher's own terms; quoted for reporting and comment)
- [eCFR 16 CFR part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) (the publisher's own terms; quoted for reporting and comment)
- [FTC Gramm-Leach-Bliley business guidance](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act) (the publisher's own terms; quoted for reporting and comment)
- [ICO guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) (the publisher's own terms; quoted for reporting and comment)
- [SRA Code of Conduct for Solicitors](https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-solicitors/) (the publisher's own terms; quoted for reporting and comment)
- [PCI Security Standards Council: PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/) (the publisher's own terms; quoted for reporting and comment)
- [HHS Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS business associates guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) (the publisher's own terms; quoted for reporting and comment)
- [ABA Model Rule 1.6 confidentiality](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (the publisher's own terms; quoted for reporting and comment)
- [ABA Model Rule 1.1 competence](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/) (the publisher's own terms; quoted for reporting and comment)

## Cite or embed

- The Regulated IT Obligations carries 9 published figures read from 2 sources' own pages, from 1 to 6 year, read 17 October 2026.
- 3 of the 14 named sources read in full publish a figure; 11 publish none, read 17 October 2026.
- Regulated IT Obligations, control ftc-safeguards-breach-notification: median 30 day across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-assessment-appeal: median 21 day across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-poam-closeout: median 180 day across 1 source, read 17 October 2026.
- Regulated IT Obligations, control ftc-safeguards-secure-disposal: median 2 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control ftc-safeguards-vulnerability-assessment: median 6 month across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-periodic-interval-max: median 1 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-level2-c3pao-reassessment: median 3 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-l3-incident-response-team: median 24 hour across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-self-assessment-artifact-retention: median 6 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-level2-self-reassessment: median 3 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-certification-artifact-retention: median 6 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-level3-reassessment: median 3 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-level3-level2-prerequisite: median 3 year across 1 source, read 17 October 2026.
- Regulated IT Obligations, control cmmc-dibcac-high-transition-validity: median 3 year across 1 source, read 17 October 2026.

Cite as: "Outsourced IT Quotes Regulated IT Obligations", updated 2026-10-19, https://outsourceditsupportquotes.com/datasets/regulated-it-obligations/.

CSV: https://outsourceditsupportquotes.com/datasets/regulated-it-obligations.csv
JSON: https://outsourceditsupportquotes.com/datasets/regulated-it-obligations.json
Embed (plain HTML, static link back): see https://outsourceditsupportquotes.com/datasets/regulated-it-obligations/#median