Commonly encountered industry-specific security standards

There are many industry-specific guidance and regulatory requirements, some of which you may be familiar with even if you're not in that industry. As they are industry-specific, we'll describe each at a high level – if any of these apply to you, you'll know that each of these is worthy of a book (or several books) on its own.

While each of these standards and regulatory or legal requirements have an industry-specific focus, many of the underlying recommendations and requirements are very similar. The Center for Internet Security (CIS) "critical controls" are often used when there is no set of regulations that provide good security guidance. In fact, these controls are often used in conjunction with regulatory requirements to provide a better overall security posture.