Compliance Public Resources and References

Navigating compliance obligations in the United States requires grounding in authoritative public sources — federal agency guidance, state regulatory portals, professional standards bodies, and court records. This page catalogs the primary reference categories that practitioners, organizations, and researchers draw on when building or auditing a compliance program. Understanding which source governs which obligation is foundational to the work described in the Compliance Standards Overview.

Federal resources

Federal compliance infrastructure is distributed across more than a dozen major agencies, each publishing binding rules, guidance documents, and enforcement data through official channels.

Core federal portals and repositories:

  1. eCFR (Electronic Code of Federal Regulations) — Available at ecfr.gov, the eCFR provides the current, continuously updated text of all federal regulations organized by Title. Title 21 (Food and Drugs) governs FDA-regulated entities; Title 29 (Labor) covers OSHA; Title 45 (Public Welfare) contains HHS rules including HIPAA's Privacy and Security Rules at 45 C.F.R. Parts 160–164.
  2. Federal Register — Published by the Office of the Federal Register at federalregister.gov, this is the daily journal of proposed rules, final rules, and agency notices. Organizations monitoring regulatory change use the Federal Register to track rulemaking at its earliest stage.
  3. NIST Cybersecurity and Privacy Resources — The National Institute of Standards and Technology publishes frameworks and special publications at csrc.nist.gov, including NIST SP 800-53 Rev. 5 (Security and Privacy Controls) and the NIST Cybersecurity Framework (CSF). These are not binding statutes but are incorporated by reference into numerous federal contracts and sector regulations.
  4. FTC Bureau of Consumer Protection — Enforcement actions, consent orders, and business guidance are published at ftc.gov/business-guidance. The FTC Act Section 5 unfairness standard and the Gramm-Leach-Bliley Act Safeguards Rule are both administered here.
  5. HHS Office for Civil Rights — HIPAA enforcement decisions, corrective action plans, and annual reports are available at hhs.gov/ocr. The OCR Resolution Agreements database documents specific penalty amounts and violation categories.

The distinction between a statute (enacted by Congress, found in the U.S. Code at uscode.house.gov) and a regulation (promulgated by an agency under statutory authority, found in the CFR) is a foundational classification boundary. Compliance obligations derive from regulations; the statute sets the outer authority and penalty ceiling.

State-level resources

State compliance obligations layer on top of federal requirements and, in areas like consumer privacy and data breach notification, frequently set stricter standards. As of 2024, at least 13 states have enacted comprehensive consumer privacy statutes, including California (CPRA), Virginia (CDPA), Colorado (CPA), and Connecticut (CTDPA).

Key state-level reference types include:

Understanding the Compliance Scope of any given program requires mapping federal preemption against state-specific rules — a comparison that varies by industry sector, data type, and transaction geography.

Professional and industry references

Professional standards bodies publish frameworks that are not law but carry significant weight in demonstrating due care and in satisfying auditor expectations.

The Process Framework for Compliance maps how organizations integrate these external standards into internal control structures.

Federal court decisions interpret how statutes and regulations apply to specific facts, and they bind enforcement posture. Three primary repositories are accessible without subscription:

  1. PACER (Public Access to Court Electronic Records) — Available at pacer.uscourts.gov, PACER provides docket access to all federal district, appellate, and bankruptcy court filings. Per-page fees apply beyond a quarterly threshold.
  2. U.S. Supreme Court opinions — Full text opinions are published free of charge at supremecourt.gov.
  3. Google Scholar Case Law — Provides free full-text access to federal and state court opinions, useful for citation research when PACER fees are a constraint.

The distinction between persuasive authority (decisions from other circuits or state courts) and binding authority (decisions from the controlling circuit or the Supreme Court) determines how much weight any given ruling carries in a compliance argument before a regulator or in litigation. Federal circuit splits — where two appellate courts interpret the same statute differently — represent active compliance risk zones until the Supreme Court resolves the divergence.

📜 2 regulatory citations referenced  ·  ✅ Citations verified Feb 25, 2026  ·  View update log

References

📜 2 regulatory citations referenced  ·  ✅ Citations verified Feb 25, 2026  ·  View update log

Read Next

Compliance: Standards Overview This page covers the definition and scope of compliance standards in the US context, the structural mechanisms through which... Compliance: Scope Determining scope incorrectly — whether too narrow or too broad — produces either undetected violations or unnecessary cost... Process Framework for Compliance This page covers the core mechanics of how compliance frameworks operate, the enforcement pressures that drive their adoption,...