Safe Harbor
What is Safe Harbor?
Legal provisions that protect organizations from liability or penalties when they have acted in good faith compliance with specified requirements.
Terms that appear alongside safe harbor
Each of these is named in at least one of the same controls as safe harbor. The number is how many controls name both.
- hipaa 9 shared controls
- consent 7 shared controls
- compliance 7 shared controls
- nist 6 shared controls
- audit 6 shared controls
- encryption 6 shared controls
- cybersecurity 5 shared controls
- authentication 5 shared controls
Frameworks that govern safe harbor
What the standards actually require on safe harbor
Requirements naming safe harbor across 6 standards, quoted from the control text.
Approved safe harbors must, by October 22, 2025 and annually thereafter, report to the FTC identifying each member operator and all approved websites or online services and members that left, with a narrative of the business model including additional services...
coppa::312.11(d) · § 312.11(d) Safe harbor reporting, recordkeeping and public member list →A qualified mortgage must not have negative amortization, interest-only payments or a balloon payment (subject to limited exceptions), must have a loan term of 30 years or less, and must keep points and fees within the percentage-of-loan-amount caps the rule s...
truth-in-lending-act-tila::1026.43-qm · Qualified mortgage: the points-and-fees cap and the safe-harbor/rebuttable-presumption structure →Proposed Regulation Crypto Assets (17 CFR Part 228; 91 FR 54510, 21 August 2026, comments to 20 October 2026) would add two Securities Act exemptions for 'covered investment contracts' (a non-security digital asset subject to an investment contract): a startup...
us-sec-digital-assets-and-crypto-regulatory-framework::REG CA (proposed) · Proposed Regulation Crypto Assets: offering exemptions and an investment contract safe harbor, not yet adopted →Disclose progress toward each disclosed target or goal and how it was achieved, updated every fiscal year with the actions taken during the year, including a discussion of material impacts on the business, results or financial condition as a direct result of t...
sec-climate-disclosure-rule::1504(c) · Item 1504(c): progress toward targets, annual update and material expenditures →Health information is no longer PHI, and may be used or disclosed without restriction, only if de-identified under the 164.514 Safe Harbor (removal of the 18 identifiers, with no actual knowledge the result could identify the individual) or the Expert Determin...
hipaa-privacy-rule::164.514d · De-identification of protected health information →HL7 FHIR Resilience + Privacy + SMART Health Cards. RATE LIMITING AND ANTI-ABUSE (FHIR-SEC-14) - API rate limiting + throttling + DDoS protection + abuse detection + IP/Subject + Token-based limits + sliding window + token bucket + sectoral best practices;
HL7-FHIR-Resilience-RateLimit-CORS-AntiAbuse-SmartHealth · HL7 FHIR Resilience - Rate Limiting + Anti-Abuse + CORS + SMART Health Cards + De-identification + Privacy →Questions people ask about safe harbor
What is Safe Harbor?
Why is Safe Harbor important for compliance?
Which compliance frameworks address Safe Harbor?
Where can I learn more about Safe Harbor?
See how Safe Harbor applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.