Attack surface compliance, by region
What each regulator actually requires for internet-facing assets. Every claim is cited to a primary source, and where a requirement is commonly misquoted we say so.
For the rules in a specific country, see our country guides, including attack surface management in Australia, New Zealand, Singapore and the GCC.
- Australia6 min read
ASD Essentials and Your Internet-Facing Systems: Why Boundary Services Come First
ASD Essentials puts boundary services, your internet-facing systems, in priority phase 1. What that means for your inventory, evidence and EASM.
- Concepts7 min read
How to Choose EASM Software: A 12-Point Buyer's Checklist
Twelve questions that separate EASM products: discovery sources, attribution, safe active checks, stable findings, exports, data location and pricing.
- Concepts6 min read
EASM vs CAASM: Outside In or Inside Out?
EASM discovers what the internet sees of you; CAASM merges what your tools already know. How they differ, when each fits and how they work together.
- Concepts8 min read
Do You Still Need Standalone EASM? What Bundled Discovery Cannot See
Your cloud provider and XDR already do external discovery. Whether that is enough depends on one question: how much of your estate sits outside them.
- Concepts7 min read
EASM vs Vulnerability Scanning: Why Your Coverage Figure Is Measuring the Wrong Denominator
Vulnerability scanners assess the assets you told them about. Attack surface management establishes what you actually expose, and regulators now say which.
- Australia6 min read
PSPF 0211, SOCI and the Essential Eight: Australia’s Attack Surface Rules
What PSPF 0211 and SOCI actually require for internet-facing assets, including the Essential Eight patching window most guides state incorrectly.
- New Zealand6 min read
External Attack Surface Management in New Zealand: MCSS, NZISM and What Actually Binds You
New Zealand's attack surface obligation comes from MCSS, not NZISM. Standard 3, the CMM4 continuous monitoring expectation, and the two-day patch window.
- Malaysia7 min read
External Attack Surface Management in Malaysia: Act 854, NACSA and the Licensing Trap
Malaysia's Cyber Security Act 2024 requires scanning of all connected systems, and its licensing rules reach further than most vendors assume.
- Saudi Arabia7 min read
External Attack Surface Management in Saudi Arabia: ECC-2, NCNICC and Aramco SACS
ECC-2:2024 requires penetration testing across all internet-provided services. What it really says about frequency, plus the NCNICC private-sector rules.
- United Arab Emirates5 min read
External Attack Surface Management in the UAE: What Is Verified and What Is Not
An honest read of UAE cyber requirements for internet-facing assets, separating what is verifiable in primary sources from what is vendor marketing.
- United Kingdom7 min read
External Attack Surface Management in the UK: CAF v4.0, Cyber Essentials and the Web Check Gap
The NCSC published an EASM buyer's guide then retired Web Check. What CAF v4.0 and Cyber Essentials Plus v3.3 require for internet-facing assets.