Law / Frameworks / ENISA NIS2 guidance / Asset management

ENISA NIS2 guidance 12.2Handling of assets

The relevant entities shall establish, implement and apply a policy for the proper handling of assets, including information, in accordance with their network and information security policy, and shall communicate the policy on proper handling of assets to anyone who uses or handles assets.ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 12.2

We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: retention.

11: laws
11: jurisdictions
0: with court rulings behind them
0: not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkCT.DM-P5 Data are destroyed according to policy., 8 laws
NIST CSF 2.0ID.AM-08 Systems, hardware, software, services, and data are managed throughout their..., 10 laws
FINOS AIGFAIR-DET-004 AI System Observability, 11 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 11 laws

Security baseline statutes

9 laws, 9 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its retention duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its retention duty. What it requires
Hawaii	Destruction of Personal Information Records	Through its retention duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its retention duty. What it requires
Kuwait	Data Classification Policy	Through its retention duty. What it requires
Michigan	Identity Theft Protection Act, destruction of data no longer needed	Through its retention duty. What it requires
Montana	Impediment of Identity Theft, record destruction duty	Through its retention duty. What it requires
North Carolina	Identity Theft Protection Act, destruction of personal information records	Through its retention duty. What it requires
Vermont	Document Safe Destruction Act, safe destruction of records containing personal information	Through its retention duty. What it requires

Sector security regimes

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties	Through its retention duty. What it requires
United States	Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer	Through its retention duty. What it requires

Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.