The U.S. doesn't have a federal cybersecurity law, but that doesn't mean there is no cybersecurity industry standard. There are regulations, case law, guidelines and state laws that, when combined, create an industry standard applicable to almost all business sectors. Specifically, if you receive, collect or hold data in an enumerated industry or sector, your business must have an information security program in place.