Law / Frameworks / CIS Controls / 17

CIS Controls, 1717.2

A maintained list of who to contact about a security incident, inside and outside the enterprise. Our summary; Center for Internet Security's text is not ours to print.

We read each law below as bearing on this Safeguard. That does not mean the Safeguard, done well, meets the law: what each law asks is on its own page. Law library as of 8 Oct 2026.

The kinds of duty that reach it: breach notice, reporting.

77: laws
66: places
0: with court rulings behind them
4: not yet in force

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFGOVERN 4.3 Organizational practices are in place to enable AI testing, identification of...
NIST AI RMFMANAGE 4.1 Post-deployment AI system monitoring plans are implemented, including mechanisms for...
NIST AI 600-1GAI-RISK-09 Information Security
NIST AI 600-1GAI-RISK-04 Data Privacy
MIT mitigations4.3 Incident Reporting
MIT mitigations3.6 Incident Response & Recovery
NIST Privacy FrameworkCM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event.
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans...
NIST CSF 2.0ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are...
NIST CSF 2.0RS.CO-02 Internal and external stakeholders are notified of incidents
FINOS AIGFAIR-DET-004 AI System Observability
FINOS AIGFAIR-DET-001 AI Data Leakage Prevention and Detection

A law in force is unmarked; the rest wear their state: not yet in force

Vulnerability and incident reporting

68 laws, 62 places

Place	Law	How it reaches this Safeguard
Andorra	Llei 22/2022, Incident Handling and Notification Obligation	Through its reporting duty. What it requires
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its reporting duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident	Through its reporting duty. What it requires
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations	Through its reporting duty. What it requires
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)	Through its reporting duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its reporting duty. What it requires
China	National Cybersecurity Incident Reporting Measures	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations	Through its reporting duty. What it requires
Cuba	Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad	Through its reporting duty. What it requires

Show the other 58 laws

Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations	Through its reporting duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification	Through its reporting duty. What it requires
Côte d'Ivoire	Mandatory Reporting of Attacks and Intrusions to ARTCI	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security-Incident Notification	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty	Through its reporting duty. What it requires
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties	Through its reporting duty. What it requires
Djibouti	Digital Code, Book VII: National Health Data System Security Incident Reporting	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident	Through its reporting duty. What it requires
Ethiopia	Computer Crime Proclamation, Duty to Report Computer Crime and Illegal Content	Through its reporting duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT from 21 Jul 2027, in 9 months	Through its reporting duty. What it requires
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations	Through its reporting duty. What it requires
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301	Through its reporting duty. What it requires
European Union	NIS2 Directive, Reporting Obligations	Through its reporting duty. What it requires
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification	Through its reporting duty. What it requires
Gambia	Information and Communications Act, 2009, security of information and communications services (subscriber risk notification)	Through its breach notice duty. What it requires
Germany	BSI-Gesetz (BSIG), Incident Notification	Through its reporting duty. What it requires
Ghana	Cybersecurity Act, Duty to Report Cybersecurity Incident	Through its reporting duty. What it requires
Greece	Law 5160/2024, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine	Through its reporting duty. What it requires
Iceland	Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response Team	Through its reporting duty. What it requires
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation	Through its reporting duty. What it requires
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty	Through its reporting duty. What it requires
Ireland	European Union (NIS) Regulations 2018, Incident Notification	Through its reporting duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification	Through its reporting duty. What it requires
Jordan	Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty	Through its reporting duty. What it requires
Kenya	Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat	Through its reporting duty. What it requires
Kiribati	Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Kyrgyzstan	Digital Code, digital resilience incident notification	Through its reporting duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Incident Notification	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Incident Notification	Through its reporting duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification	Through its reporting duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification	Through its reporting duty. What it requires
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches	Through its reporting duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT	Through its reporting duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its reporting duty. What it requires
Mongolia	Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal Persons	Through its reporting duty. What it requires
Montenegro	Law on Information Security, Cyber Threat and Incident Reporting	Through its reporting duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties	Through its reporting duty. What it requires
Mozambique	Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure	Through its reporting duty. What it requires
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent	Through its reporting duty. What it requires
Nigeria	Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, Reporting of Cyber Threats to the National CERT	Through its reporting duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification	Through its reporting duty. What it requires
Serbia	Law on Information Security, Incident Reporting Obligations	Through its reporting duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents	Through its reporting duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification	Through its reporting duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations	Through its reporting duty. What it requires
South Korea	Information and Communications Network Act, Report on Computer Security Incidents	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation	Through its reporting duty. What it requires
Sweden	Cybersäkerhetslag, Incident Notification	Through its reporting duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its reporting duty. What it requires
Tonga	Cybersecurity Act 2025, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its reporting duty. What it requires
Turkey	Cybersecurity Law, Reporting and Cooperation Duties	Through its reporting duty. What it requires
Ukraine	Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification Duty	Through its reporting duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its reporting duty. What it requires

Sector security regimes

7 laws, 7 places

Place	Law	How it reaches this Safeguard
Albania	Law No. 25/2024, On Cybersecurity	Through its reporting duty. What it requires
Central African Republic	Cybersecurity Law: Mandatory Security Audit Regime	Through its reporting duty. What it requires
Djibouti	Digital Code, Book II: Electronic Communications Network and Service Security	Through its reporting duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its reporting duty. What it requires
Somalia	National Cybersecurity Law (2025)	Through its reporting duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its reporting duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its reporting duty. What it requires

Product security requirements

2 laws, 2 places

Place	Law	How it reaches this Safeguard
China	Cybersecurity Law, Network Product and Service Security Duties	Through its reporting duty. What it requires
Finland	Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act	Through its reporting duty. What it requires

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text. Every Safeguard of the framework.