Digital Security Directory: Purpose and Scope

The Digital Security Authority directory is a structured reference index of organizations, service providers, regulatory frameworks, standards bodies, and professional resources operating within the United States cybersecurity sector. This page defines the directory's inclusion criteria, classification logic, geographic scope, and navigation structure. Practitioners, compliance officers, procurement teams, and researchers rely on these boundaries to distinguish authoritative listings from adjacent or unrelated resources.

What is included

The directory covers four primary categories of entities and resources within the United States digital security landscape:

1. Service providers and vendors — firms offering managed security services, penetration testing, incident response, identity and access management, cloud security, and endpoint protection, operating under established professional or contractual standards.
2. Regulatory bodies and enforcement agencies — federal and state entities with jurisdiction over cybersecurity obligations, including the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Trade Commission (FTC), the National Institute of Standards and Technology (NIST), and the Department of Health and Human Services Office for Civil Rights (HHS OCR).
3. Standards and certification bodies — organizations that publish enforceable or voluntary frameworks, including NIST (SP 800-series controls), the International Organization for Standardization (ISO/IEC 27001), and the Payment Card Industry Security Standards Council (PCI SSC).
4. Professional credentialing and workforce organizations — entities issuing recognized cybersecurity credentials or maintaining practitioner communities, such as (ISC)², ISACA, CompTIA, and EC-Council.

Listings are tagged by sector alignment, referencing the 16 critical infrastructure sectors defined by CISA under Presidential Policy Directive 21 (PPD-21). These sectors include energy, financial services, healthcare and public health, information technology, and communications, among others. Tags enable filtered navigation across the full digital security listings index.

Excluded from the directory: general IT hardware resellers with no dedicated security practice, academic institutions unless they operate a named cybersecurity center or publish a recognized public framework, and foreign-domiciled entities with no US regulatory footprint or domestic operations.

How entries are determined

Entry into the directory follows a structured evaluation against four classification criteria:

1. Regulatory or professional standing — the entity must operate under a named regulatory framework, hold a recognized professional certification, or publish a standard referenced by a federal or state body. A managed security service provider, for example, must demonstrate alignment with NIST Cybersecurity Framework (CSF) categories or equivalent contractual security obligations.
2. Sector specificity — the entity's primary activity must fall within digital security as a defined practice area, not as an incidental feature of broader IT services. A firm offering general software development that includes one security module does not qualify on that basis alone.
3. Verifiable public presence — entries require a traceable public record: federal registration, published framework, state licensure, or verifiable professional affiliation. Anonymous or unverifiable entities are not listed.
4. US operational nexus — the entity must serve US clients under US regulatory obligations or hold a formal presence within the US legal or professional structure.

The distinction between a regulatory body entry and a service provider entry is categorical, not hierarchical. CISA and a CISA-aligned incident response firm occupy separate classification buckets within the same directory structure. Conflating enforcement authority with commercial service delivery is a common navigation error that the classification system is designed to prevent. The how to use this digital security resource page provides additional guidance on filtering by entry type.

Entries are reviewed against publicly available records. Where a regulatory status or certification claim cannot be independently verified through a named public source — such as a state licensing board, federal contractor registry, or standards body member directory — the entry is suspended pending documentation.

Geographic coverage

The directory operates at national scope within the United States. Primary regulatory alignment follows federal frameworks enforced by CISA, NIST, the FTC, and HHS OCR. Where state-level obligations introduce additional classification requirements — California's Consumer Privacy Act (CCPA), New York's SHIELD Act, or the 47 states with breach notification statutes as catalogued by the National Conference of State Legislatures — those obligations are noted within relevant sector tags rather than treated as separate geographic subdivisions.

The directory does not cover EU-domiciled entities operating exclusively under GDPR jurisdiction, nor does it index entities whose sole US connection is compliance with a cross-border data transfer agreement. Entities with both EU and US operational presence are indexed only against their US regulatory obligations.

Sector-level coverage follows PPD-21's 16-sector model. Each sector entry within the digital security listings identifies the sector's designated Sector Risk Management Agency (SRMA) — the federal entity with coordinating authority under Executive Order 13636 and subsequent policy instruments — alongside relevant service providers and framework references.

How to use this resource

The directory is structured for three distinct navigation patterns:

By entity type — Users seeking a regulatory body, a standards document, or a service provider begin with the entity-type filter. Regulatory and enforcement entries carry agency codes and jurisdictional scope notes. Service provider entries carry sector tags and framework alignment indicators. Standards body entries link to the primary published document.

By sector — Users with a sector-specific compliance need — a healthcare organization mapping to HIPAA Security Rule obligations under 45 CFR Part 164, or an energy utility operating under NERC CIP standards — navigate through the sector tag system. Each of the 16 PPD-21 sectors is represented, with entries cross-referenced to both the SRMA and relevant private-sector service categories.

By framework — Users benchmarking against a specific standard (NIST CSF, ISO/IEC 27001, SOC 2, PCI DSS 4.0) can filter listings to surface providers and bodies aligned to that framework. Framework alignment is self-reported by listed entities and cross-checked against publicly available certification or attestation records where those records exist.

The digital security directory purpose and scope classification logic described on this page governs all three navigation paths. Entries that satisfy one filter criterion do not automatically appear in others — a NIST-aligned consulting firm appears under framework and service provider filters, but not under regulatory body filters, regardless of the firm's size or federal contracting history.