CPL U.S. States Alignment
Jurisdiction profiles that connect the Defensible 10 Standards to state-level cybersecurity law categories.
Last updated: December 2025. State-level laws only. No municipal, city, or county ordinances.
[Governance: Professional Licensing Authority + CPL Governance Working Group]
Organizations do not operate in a single cybersecurity environment. In the United States, state-level cybersecurity obligations shape breach response expectations, unlawful access controls, sector security duties, and government cybersecurity governance requirements. ISAUnited maintains U.S. state alignment profiles to show how the Defensible 10 Standards (D10S) map to these legal categories through evidence-based engineering practice.
CPL applicants select one or more states of practice during registration. ISAUnited then issues a jurisdiction profile checklist that aligns applicable state-law categories with D10S evidence expectations, supporting consistent governance and defensible implementation across environments.
Why U.S. State Alignment Matters
Cybersecurity is not only technical. It is operational accountability. State laws set minimum requirements for breach response, consumer notification, and the protection of certain data classes. Regulated sectors such as insurance, education, and health data may carry additional requirements.
ISAUnited’s approach is not to replace legal counsel or compliance functions. The purpose is to provide an engineering-grade, repeatable mapping that helps organizations and practitioners connect statutory categories to measurable technical standards and evidence.
Matrix 1 summarizes the presence of state-level cybersecurity law categories by state. It is a landscape view. It does not attempt to reproduce statutes or legal text. It shows which categories are commonly in scope for breach response, unlawful access, privacy duties, and key sector overlay.
From legal categories to engineered outcomes
A category's presence does not mean an organization is prepared. ISAUnited uses the Defensible 10 Standards to translate these categories into engineering expectations that can be verified with evidence. CPL is the evaluation mechanism that validates that a practitioner can apply the standards under responsible practice, document decisions, and produce defensible artifacts for organizational review.
ISAUnited uses the Defensible 10 Standards to translate these categories into engineering expectations that can be verified with evidence. CPL is the evaluation mechanism that validates that a practitioner can apply the standards under responsible practice, document decisions, and produce defensible artifacts for organizational review.
The following Matrix 2 shows the D10S parent standards that govern each law category when it is present in a state profile.
How CPL registration uses U.S. States Alignment
During CPL registration, applicants identify their state or states of practice and the sectors in which they operate. ISAUnited issues a jurisdiction profile checklist that aligns state-law categories with D10S evidence expectations. ISAUnited issues a jurisdiction profile checklist that aligns state-law categories with D10S evidence expectations. This gives organizations a consistent method for verifying that a practitioner can design, implement, and govern defensible outcomes in the context of state-level cybersecurity obligations. This establishes a consistent process for organizations to evaluate capability, using the same standards language across jurisdictions.
-
State selection produces the jurisdiction profile checklist.
-
D10S determines the engineering expectations and evidence posture.
-
CPL evaluation verifies competence through defensible artifacts.
