Law / Frameworks / CIS Controls / 3

CIS Controls, 33.11

Encryption of sensitive data where it is stored on servers and applications. Our summary; Center for Internet Security's text is not ours to print.

We read each law below as bearing on this Safeguard. That does not mean the Safeguard, done well, meets the law: what each law asks is on its own page. Law library as of 8 Oct 2026.

The kinds of duty that reach it: security.

65: laws
52: places
0: with court rulings behind them
7: not yet in force
1: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFMEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...
NIST AI RMFMEASURE 2.6 The AI system is evaluated regularly for safety risks – as identified in the MAP...
NIST AI 600-1GAI-RISK-04 Data Privacy
NIST AI 600-1GAI-RISK-09 Information Security
OWASP LLM Top 10LLM01:2026 Prompt Injection
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure
OWASP Agentic Top 10ASI01 Agent Goal Hijack
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse
MIT mitigations2.1 Model & Infrastructure Security
MIT mitigations2.3 Model Safety Engineering
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans...
NIST Privacy FrameworkPR.PO-P10 A vulnerability management plan is developed and implemented.
NIST CSF 2.0ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST CSF 2.0ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems
FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems

A law in force is unmarked; the rest wear their state: not yet in force proposed

Security baseline statutes

33 laws, 31 places

Place	Law	How it reaches this Safeguard
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its security duty. What it requires
Arkansas	Arkansas Personal Information Protection Act, reasonable security procedures	Through its security duty. What it requires
Belarus	Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)	Through its security duty. What it requires
California	Customer Records Act, Reasonable Security Procedures	Through its security duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its security duty. What it requires
Colorado	Protection of personal identifying information, reasonable security procedures duty	Through its security duty. What it requires
Connecticut	Connected device provider's duty to protect recorded personal information with reasonable security measures	Through its security duty. What it requires
Connecticut	Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty	Through its security duty. What it requires
Cuba	Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty	Through its security duty. What it requires
Delaware	Computer Security Breaches, protection of personal information	Through its security duty. What it requires

Show the other 23 laws

Democratic Republic of the Congo	Digital Code, Livre IV: Digital Services Provider Security Obligations	Through its security duty. What it requires
District of Columbia	Security requirements for personal information (Security Breach Protection Amendment Act of 2020)	Through its security duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its security duty. What it requires
Illinois	Personal Information Protection Act, data security duty	Through its security duty. What it requires
Indiana	Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records from a date not yet set	Through its security duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its security duty. What it requires
Kazakhstan	Digital Code, general cybersecurity duty on digital-object owners and holders	Through its security duty. What it requires
Kuwait	Data Classification Policy	Through its security duty. What it requires
Louisiana	Database Security Breach Notification Law, reasonable security procedures and destruction duty	Through its security duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty	Through its security duty. What it requires
Massachusetts	Standards for the Protection of Personal Information of Residents of the Commonwealth	Through its security duty. What it requires
Mexico	Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)	Through its security duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its security duty. What it requires
Nebraska	Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty	Through its security duty. What it requires
Nevada	Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield from a date not yet set	Through its security duty. What it requires
Nevada	Security measures for data collectors maintaining personal information from a date not yet set	Through its security duty. What it requires
New Mexico	Data Breach Notification Act, security and disposal duties from a date not yet set	Through its security duty. What it requires
Oregon	Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information	Through its security duty. What it requires
Rhode Island	Identity Theft Protection Act of 2015, risk-based information security program from a date not yet set	Through its security duty. What it requires
Texas	Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information	Through its security duty. What it requires
Turkmenistan	Law on Information and Its Protection, information-security duty	Through its security duty. What it requires
Utah	Protection of Personal Information Act, reasonable procedures and records-destruction duty	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its security duty. What it requires

Sector security regimes

16 laws, 16 places

Place	Law	How it reaches this Safeguard
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases	Through its security duty. What it requires
Burundi	Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Through its security duty. What it requires
Djibouti	Digital Code, Book VI: Critical Installation Protection and Operator Security Controls	Through its security duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its security duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its security duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Through its security duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its security duty. What it requires
Liberia	Telecommunications Act 2007, Security Safeguards for Customer Information and Communications	Through its security duty. What it requires

Show the other 6 laws

Micronesia	FSM Telecommunications Act of 2014, Security Safeguards for Customer Information	Through its security duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Security Safeguards for Consumer Information	Through its security duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its security duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its security duty. What it requires
Turkmenistan	Law on Communications, network and subscriber-information protection duties	Through its security duty. What it requires

Product security requirements

8 laws, 8 places

Place	Law	How it reaches this Safeguard
Australia	Security Standards for Smart Devices	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its security duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its security duty. What it requires
California	Security of Connected Devices	Through its security duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its security duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements	Through its security duty. What it requires
Oregon	Security requirements for Internet-connected devices	Through its security duty. What it requires
United Kingdom	Product Security Requirements for Connectable Products	Through its security duty. What it requires

Vulnerability and incident reporting

8 laws, 8 places

Place	Law	How it reaches this Safeguard
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its security duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its security duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its security duty. What it requires
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock proposed	Through its security duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its security duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its security duty. What it requires

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text. Every Safeguard of the framework.