Law / Frameworks / ENISA NIS2 guidance / Risk management policy

ENISA NIS2 guidance 2.1Risk management framework

For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities shall establish and maintain an appropriate risk management framework to identify and address the risks posed to the security of network and information systems. The relevant entities shall perform and document risk assessments and, based on the results, establish, implement and monitor a risk treatment plan. Risk assessment results and residual risks shall be accepted by management bodies or, where applicable, by persons who are accountable and have the authority to manage risks, provided that the relevant entities ensure adequate reporting to the management bodies.ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 2.1

We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: DPIA, security.

110: laws
70: jurisdictions
0: with court rulings behind them
6: not yet in force
1: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkPR.DS-P5 Protections against data leaks are implemented., 39 laws
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery..., 28 laws
NIST Privacy FrameworkPR.PO-P10 A vulnerability management plan is developed and implemented., 14 laws
6 more in the NIST Privacy Framework
NIST CSF 2.0PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected, 40 laws
NIST CSF 2.0PR.PS-06 Secure software development practices are integrated, and their performance..., 29 laws
NIST CSF 2.0ID.IM-04 Incident response plans and other cybersecurity plans that affect operations..., 24 laws
18 more in the NIST CSF 2.0
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 107 laws
FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 107 laws
FINOS AIGFAIR-PREV-012 Role-Based Access Control for AI Data, 107 laws
10 more in the FINOS AIGF

A law in force is unmarked; the rest wear their state: not yet in force proposed

Sector security regimes

43 laws, 30 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases	Through its security duty. What it requires
Belgium	Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure	Through its security duty. What it requires
Burundi	Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers	Through its security duty. What it requires
Canada	OSFI Guideline B-13, Technology and Cyber Risk Management	Through its security duty. What it requires
Czech Republic	Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Through its security duty. What it requires
Djibouti	Digital Code, Book VI: Critical Installation Protection and Operator Security Controls	Through its security duty. What it requires
Estonia	Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification	Through its security duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its security duty. What it requires
European Union	DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework	Through its security duty. What it requires

Show the other 33 laws

European Union	DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents)	Through its security duty. What it requires
European Union	DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing)	Through its security duty. What it requires
European Union	DORA, Articles 5-16 (ICT Risk Management Framework)	Through its security duty. What it requires
European Union	Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication	Through its security duty. What it requires
Germany	Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures	Through its security duty. What it requires
Germany	Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms	Through its security duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its security duty. What it requires
Hungary	2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems	Through its security duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its security duty. What it requires
Ireland	European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms	Through its security duty. What it requires
Latvia	Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Through its security duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its security duty. What it requires
Liberia	Telecommunications Act 2007, Security Safeguards for Customer Information and Communications	Through its security duty. What it requires
Luxembourg	Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms	Through its security duty. What it requires
Micronesia	FSM Telecommunications Act of 2014, Security Safeguards for Customer Information	Through its security duty. What it requires
Montenegro	Law on Information Security, Essential and Important Entities	Through its DPIA duty. What it requires
Netherlands	Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details	Through its security duty. What it requires
New York	DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models	Through its security duty. What it requires
New York	DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks	Through its security duty. What it requires
New York	DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation	Through its DPIA duty. What it requires
New York	DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Incident Response and Business Continuity Management	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions	Through its security duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its security duty. What it requires
Slovenia	ZEKom-2, Operator Security Measures (Articles 115 and 116)	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Security Safeguards for Consumer Information	Through its security duty. What it requires
Spain	Real Decreto-ley 7/2022 on the Security of 5G Networks and Services, Duties of 5G Operators, Suppliers and Corporate Users	Through its security duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its security duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its security duty. What it requires
Turkmenistan	Law on Communications, network and subscriber-information protection duties	Through its security duty. What it requires

Security baseline statutes

33 laws, 31 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its security duty. What it requires
Arkansas	Arkansas Personal Information Protection Act, reasonable security procedures	Through its security duty. What it requires
Belarus	Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)	Through its security duty. What it requires
California	Customer Records Act, Reasonable Security Procedures	Through its security duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its security duty. What it requires
Colorado	Protection of personal identifying information, reasonable security procedures duty	Through its security duty. What it requires
Connecticut	Connected device provider's duty to protect recorded personal information with reasonable security measures	Through its security duty. What it requires
Connecticut	Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty	Through its security duty. What it requires
Cuba	Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty	Through its security duty. What it requires
Delaware	Computer Security Breaches, protection of personal information	Through its security duty. What it requires

Show the other 23 laws

Democratic Republic of the Congo	Digital Code, Livre IV: Digital Services Provider Security Obligations	Through its security duty. What it requires
District of Columbia	Security requirements for personal information (Security Breach Protection Amendment Act of 2020)	Through its security duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its security duty. What it requires
Illinois	Personal Information Protection Act, data security duty	Through its security duty. What it requires
Indiana	Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records	Through its security duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its security duty. What it requires
Kazakhstan	Digital Code, general cybersecurity duty on digital-object owners and holders	Through its security duty. What it requires
Kuwait	Data Classification Policy	Through its security duty. What it requires
Louisiana	Database Security Breach Notification Law, reasonable security procedures and destruction duty	Through its security duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty	Through its security duty. What it requires
Massachusetts	Standards for the Protection of Personal Information of Residents of the Commonwealth	Through its security duty. What it requires
Mexico	Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)	Through its security duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its security duty. What it requires
Nebraska	Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty	Through its security duty. What it requires
Nevada	Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield	Through its security duty. What it requires
Nevada	Security measures for data collectors maintaining personal information	Through its security duty. What it requires
New Mexico	Data Breach Notification Act, security and disposal duties	Through its security duty. What it requires
Oregon	Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information	Through its security duty. What it requires
Rhode Island	Identity Theft Protection Act of 2015, risk-based information security program	Through its security duty. What it requires
Texas	Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information	Through its security duty. What it requires
Turkmenistan	Law on Information and Its Protection, information-security duty	Through its security duty. What it requires
Utah	Protection of Personal Information Act, reasonable procedures and records-destruction duty	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its security duty. What it requires

Product security requirements

25 laws, 13 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Australia	Security Standards for Smart Devices	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its security duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its security duty. What it requires
California	Security of Connected Devices	Through its security duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its security duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements	Through its security duty. What it requires
European Union	Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements	Through its DPIA duty. What it requires
European Union	Cyber Resilience Act, Essential Requirements and Manufacturer Obligations from 11 Dec 2027, in 14 months	Through its security duty. What it requires
European Union	Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements	Through its security duty. What it requires
European Union	EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate	Through its security duty. What it requires

Show the other 15 laws

European Union	European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems from 26 Mar 2029, in 2.4 years	Through its security duty. What it requires
European Union	General Product Safety Regulation, Cybersecurity Features and Software Changes in Assessing a Consumer Product's Safety	Through its security duty. What it requires
European Union	General Safety Regulation, Protection of Vehicles Against Cyberattacks (Annex II, Item D4)	Through its security duty. What it requires
European Union	In Vitro Diagnostic Medical Devices Regulation, Software Development, Information Security and IT Security Information Requirements	Through its security duty. What it requires
European Union	L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) from 11 Dec 2027, in 14 months	Through its security duty. What it requires
European Union	Machinery Regulation, Protection Against Corruption and Safety and Reliability of Control Systems (Software and Cybersecurity Requirements) from 14 Jan 2027, in 3 months	Through its security duty. What it requires
European Union	Medical Devices Regulation, Software Development, Information Security and IT Security Information Requirements	Through its security duty. What it requires
European Union	Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment	Through its security duty. What it requires
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems	Through its DPIA, security duties. What it requires
Greece	Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices	Through its security duty. What it requires
Oregon	Security requirements for Internet-connected devices	Through its security duty. What it requires
Portugal	Decreto-Lei n.º 84/2021, Security Updates for Goods With Digital Elements and Digital Content	Through its security duty. What it requires
Romania	Ordonanța de urgență nr. 140/2021, Updates and Security Updates for Goods With Digital Elements	Through its security duty. What it requires
Romania	Ordonanța de urgență nr. 141/2021, Updates and Security Updates for Digital Content and Digital Services	Through its security duty. What it requires
United Kingdom	Product Security Requirements for Connectable Products	Through its security duty. What it requires

Vulnerability and incident reporting

9 laws, 9 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its security duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its security duty. What it requires
Italy	Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its security duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its security duty. What it requires
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock proposed	Through its security duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its security duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its security duty. What it requires

Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.