Law / Frameworks / ENISA NIS2 guidance / Incident handling

ENISA NIS2 guidance 3.1Incident handling policy

For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 3.1

We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: breach notice, reporting, security.

201: laws
103: jurisdictions
0: with court rulings behind them
10: not yet in force
6: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkPR.DS-P5 Protections against data leaks are implemented., 39 laws
NIST Privacy FrameworkCM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event., 38 laws
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery..., 32 laws
6 more in the NIST Privacy Framework
NIST CSF 2.0RS.CO-02 Internal and external stakeholders are notified of incidents, 100 laws
NIST CSF 2.0RS.CO-03 Information is shared with designated internal and external stakeholders, 49 laws
NIST CSF 2.0PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected, 40 laws
23 more in the NIST CSF 2.0
FINOS AIGFAIR-DET-004 AI System Observability, 110 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 109 laws
FINOS AIGFAIR-DET-001 AI Data Leakage Prevention and Detection, 108 laws
10 more in the FINOS AIGF

A law in force is unmarked; the rest wear their state: not yet in force proposed

Vulnerability and incident reporting

87 laws, 64 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Andorra	Llei 22/2022, Incident Handling and Notification Obligation	Through its reporting duty. What it requires
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its reporting, security duties. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident	Through its reporting duty. What it requires
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations	Through its reporting duty. What it requires
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)	Through its reporting duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its reporting, security duties. What it requires
China	National Cybersecurity Incident Reporting Measures	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations	Through its reporting duty. What it requires
Cuba	Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad	Through its reporting duty. What it requires

Show the other 77 laws

Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations	Through its reporting duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification	Through its reporting duty. What it requires
Côte d'Ivoire	Mandatory Reporting of Attacks and Intrusions to ARTCI	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security-Incident Notification	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty	Through its reporting duty. What it requires
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties	Through its reporting duty. What it requires
Djibouti	Digital Code, Book VII: National Health Data System Security Incident Reporting	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident	Through its reporting duty. What it requires
Ethiopia	Computer Crime Proclamation, Duty to Report Computer Crime and Illegal Content	Through its reporting duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT from 21 Jul 2027, in 9 months	Through its reporting duty. What it requires
European Union	Commission Delegated Regulation (EU) 2022/1645, External Reporting of Information Security Incidents and Vulnerabilities (IS.D.OR.230)	Through its reporting duty. What it requires
European Union	Commission Delegated Regulation (EU) 2024/1366, Cybersecurity Network Code for Cross-Border Electricity Flows: Information Sharing on Cyber-Attacks and Threats	Through its reporting duty. What it requires
European Union	Commission Implementing Regulation (EU) 2023/203, External Reporting of Information Security Incidents and Vulnerabilities in Aviation (IS.I.OR.230)	Through its reporting duty. What it requires
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations	Through its reporting duty. What it requires
European Union	DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats	Through its reporting duty. What it requires
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301	Through its reporting duty. What it requires
European Union	eIDAS Regulation, Article 19a(1)(b): Notification of Security Breaches and Disruptions by Non-Qualified Trust Service Providers	Through its reporting duty. What it requires
European Union	EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure	Through its reporting duty. What it requires
European Union	European Health Data Space Regulation, Serious-Incident Reporting by Manufacturers of EHR Systems from 26 Mar 2029, in 2.4 years	Through its reporting duty. What it requires
European Union	NIS2 Directive, Reporting Obligations	Through its reporting duty. What it requires
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances	Through its reporting duty. What it requires
Finland	Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators	Through its reporting duty. What it requires
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification	Through its reporting duty. What it requires
France	Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Incident Notification (NIS2) proposed	Through its reporting duty. What it requires
Gambia	Information and Communications Act, 2009, security of information and communications services (subscriber risk notification)	Through its breach notice duty. What it requires
Germany	BSI-Gesetz (BSIG), Incident Notification	Through its reporting duty. What it requires
Ghana	Cybersecurity Act, Duty to Report Cybersecurity Incident	Through its reporting duty. What it requires
Greece	Law 5160/2024, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine	Through its reporting duty. What it requires
Iceland	Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response Team	Through its reporting duty. What it requires
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation	Through its reporting duty. What it requires
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty	Through its reporting duty. What it requires
Ireland	European Union (NIS) Regulations 2018, Incident Notification	Through its reporting duty. What it requires
Ireland	National Cyber Security Bill, Incident Response Powers and Reporting Obligations proposed	Through its reporting duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification	Through its reporting duty. What it requires
Italy	Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties	Through its reporting, security duties. What it requires
Jordan	Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty	Through its reporting duty. What it requires
Kenya	Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat	Through its reporting duty. What it requires
Kiribati	Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Kyrgyzstan	Digital Code, digital resilience incident notification	Through its reporting duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its reporting, security duties. What it requires
Latvia	Nacionālās kiberdrošības likums, Incident Notification	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Incident Notification	Through its reporting duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification	Through its reporting duty. What it requires
Luxembourg	Loi du 20 décembre 2024, Cybersecurity Certification Authority and Vulnerability Notices	Through its reporting duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification	Through its reporting duty. What it requires
Malta	Electronic Communications Networks and Services (General) Regulations, Security Incident Notification to the Malta Communications Authority	Through its reporting duty. What it requires
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches	Through its reporting duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT	Through its reporting duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its reporting, security duties. What it requires
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock proposed	Through its security duty. What it requires
Mongolia	Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal Persons	Through its reporting duty. What it requires
Montenegro	Law on Information Security, Cyber Threat and Incident Reporting	Through its reporting duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties	Through its reporting duty. What it requires
Mozambique	Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure	Through its reporting duty. What it requires
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent	Through its reporting duty. What it requires
Nigeria	Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024, Reporting of Cyber Threats to the National CERT	Through its reporting duty. What it requires
Poland	Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów Poważnych	Through its reporting duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification	Through its reporting duty. What it requires
Serbia	Law on Information Security, Incident Reporting Obligations	Through its reporting duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents	Through its reporting duty. What it requires
Slovakia	Vyhláška NBÚ č. 226/2025 Z. z., Details of Cyber Security Reports	Through its reporting duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification	Through its reporting duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations	Through its reporting duty. What it requires
South Korea	Information and Communications Network Act, Report on Computer Security Incidents	Through its reporting duty. What it requires
Spain	Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Incident Reporting Obligations proposed	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation	Through its reporting duty. What it requires
Sweden	Cybersäkerhetslag, Incident Notification	Through its reporting duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its reporting, security duties. What it requires
Tonga	Cybersecurity Act 2025, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its reporting, security duties. What it requires
Turkey	Cybersecurity Law, Reporting and Cooperation Duties	Through its reporting duty. What it requires
Ukraine	Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification Duty	Through its reporting duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its reporting, security duties. What it requires

Sector security regimes

56 laws, 41 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Albania	Law No. 25/2024, On Cybersecurity	Through its reporting duty. What it requires
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases	Through its security duty. What it requires
Belgium	Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure	Through its security duty. What it requires
Burundi	Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers	Through its security duty. What it requires
Canada	OSFI Guideline B-10, Third-Party Risk Management	Through its reporting duty. What it requires
Canada	OSFI Guideline B-13, Technology and Cyber Risk Management	Through its security duty. What it requires
Central African Republic	Cybersecurity Law: Mandatory Security Audit Regime	Through its reporting duty. What it requires
Croatia	Zakon o provedbi Uredbe (EU) 2022/2554, Competent Authorities, Incident Reporting and Fines for Financial Entities	Through its reporting duty. What it requires
Czech Republic	Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Through its security duty. What it requires

Show the other 46 laws

Djibouti	Digital Code, Book II: Electronic Communications Network and Service Security	Through its reporting duty. What it requires
Djibouti	Digital Code, Book VI: Critical Installation Protection and Operator Security Controls	Through its security duty. What it requires
Estonia	Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification	Through its security duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its security duty. What it requires
European Union	DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework	Through its security duty. What it requires
European Union	DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents)	Through its security duty. What it requires
European Union	DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing)	Through its security duty. What it requires
European Union	DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers)	Through its reporting duty. What it requires
European Union	DORA, Articles 5-16 (ICT Risk Management Framework)	Through its security duty. What it requires
European Union	Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication	Through its security duty. What it requires
Finland	Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars	Through its reporting duty. What it requires
Germany	Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures	Through its security duty. What it requires
Germany	Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms	Through its security duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its security duty. What it requires
Hungary	2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems	Through its security duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its security duty. What it requires
Ireland	European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms	Through its security duty. What it requires
Italy	Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification	Through its reporting duty. What it requires
Latvia	Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements	Through its reporting, security duties. What it requires
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Through its security duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its reporting, security duties. What it requires
Liberia	Telecommunications Act 2007, Security Safeguards for Customer Information and Communications	Through its security duty. What it requires
Luxembourg	Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms	Through its security duty. What it requires
Malta	Malta DORA Regulations (S.L. 330.20)	Through its reporting duty. What it requires
Micronesia	FSM Telecommunications Act of 2014, Security Safeguards for Customer Information	Through its security duty. What it requires
Netherlands	Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details	Through its reporting, security duties. What it requires
New York	DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models	Through its security duty. What it requires
New York	DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks	Through its security duty. What it requires
New York	DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Incident Response and Business Continuity Management	Through its security duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions	Through its security duty. What it requires
Poland	Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions	Through its reporting duty. What it requires
Portugal	Lei n.º 73/2025, Digital Operational Resilience of the Financial Sector	Through its reporting duty. What it requires
Romania	DNSC Order 1/2025, Notification for Registration of Essential and Important Entities	Through its reporting duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its security duty. What it requires
Slovenia	ZEKom-2, Operator Security Measures (Articles 115 and 116)	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Security Safeguards for Consumer Information	Through its security duty. What it requires
Somalia	Somalia Cybersecurity Act (2026) proposed	Through its reporting duty. What it requires
Spain	Real Decreto-ley 7/2022 on the Security of 5G Networks and Services, Duties of 5G Operators, Suppliers and Corporate Users	Through its security duty. What it requires
Sweden	Cybersäkerhetsförordning (2025:1507), Notification Channels and Supervisory Authorities	Through its reporting duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its reporting, security duties. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its reporting, security duties. What it requires
Turkmenistan	Law on Communications, network and subscriber-information protection duties	Through its security duty. What it requires
United Kingdom	Cyber Security and Resilience (Network and Information Systems) Bill proposed	Through its reporting duty. What it requires

Security baseline statutes

33 laws, 31 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its security duty. What it requires
Arkansas	Arkansas Personal Information Protection Act, reasonable security procedures	Through its security duty. What it requires
Belarus	Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)	Through its security duty. What it requires
California	Customer Records Act, Reasonable Security Procedures	Through its security duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its security duty. What it requires
Colorado	Protection of personal identifying information, reasonable security procedures duty	Through its security duty. What it requires
Connecticut	Connected device provider's duty to protect recorded personal information with reasonable security measures	Through its security duty. What it requires
Connecticut	Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty	Through its security duty. What it requires
Cuba	Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty	Through its security duty. What it requires
Delaware	Computer Security Breaches, protection of personal information	Through its security duty. What it requires

Show the other 23 laws

Democratic Republic of the Congo	Digital Code, Livre IV: Digital Services Provider Security Obligations	Through its security duty. What it requires
District of Columbia	Security requirements for personal information (Security Breach Protection Amendment Act of 2020)	Through its security duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its security duty. What it requires
Illinois	Personal Information Protection Act, data security duty	Through its security duty. What it requires
Indiana	Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records	Through its security duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its security duty. What it requires
Kazakhstan	Digital Code, general cybersecurity duty on digital-object owners and holders	Through its security duty. What it requires
Kuwait	Data Classification Policy	Through its security duty. What it requires
Louisiana	Database Security Breach Notification Law, reasonable security procedures and destruction duty	Through its security duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty	Through its security duty. What it requires
Massachusetts	Standards for the Protection of Personal Information of Residents of the Commonwealth	Through its security duty. What it requires
Mexico	Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)	Through its security duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its security duty. What it requires
Nebraska	Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty	Through its security duty. What it requires
Nevada	Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield	Through its security duty. What it requires
Nevada	Security measures for data collectors maintaining personal information	Through its security duty. What it requires
New Mexico	Data Breach Notification Act, security and disposal duties	Through its security duty. What it requires
Oregon	Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information	Through its security duty. What it requires
Rhode Island	Identity Theft Protection Act of 2015, risk-based information security program	Through its security duty. What it requires
Texas	Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information	Through its security duty. What it requires
Turkmenistan	Law on Information and Its Protection, information-security duty	Through its security duty. What it requires
Utah	Protection of Personal Information Act, reasonable procedures and records-destruction duty	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its security duty. What it requires

Product security requirements

25 laws, 13 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Australia	Security Standards for Smart Devices	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its security duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its security duty. What it requires
California	Security of Connected Devices	Through its security duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its reporting, security duties. What it requires
Cyprus	Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements	Through its security duty. What it requires
European Union	Cyber Resilience Act, Essential Requirements and Manufacturer Obligations from 11 Dec 2027, in 14 months	Through its security duty. What it requires
European Union	Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements	Through its security duty. What it requires
European Union	EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate	Through its security duty. What it requires
European Union	European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems from 26 Mar 2029, in 2.4 years	Through its security duty. What it requires

Show the other 15 laws

European Union	General Product Safety Regulation, Cybersecurity Features and Software Changes in Assessing a Consumer Product's Safety	Through its security duty. What it requires
European Union	General Safety Regulation, Protection of Vehicles Against Cyberattacks (Annex II, Item D4)	Through its security duty. What it requires
European Union	In Vitro Diagnostic Medical Devices Regulation, Software Development, Information Security and IT Security Information Requirements	Through its security duty. What it requires
European Union	L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) from 11 Dec 2027, in 14 months	Through its security duty. What it requires
European Union	Machinery Regulation, Protection Against Corruption and Safety and Reliability of Control Systems (Software and Cybersecurity Requirements) from 14 Jan 2027, in 3 months	Through its security duty. What it requires
European Union	Medical Devices Regulation, Software Development, Information Security and IT Security Information Requirements	Through its security duty. What it requires
European Union	Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment	Through its security duty. What it requires
Finland	Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act	Through its reporting duty. What it requires
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems	Through its security duty. What it requires
Greece	Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices	Through its security duty. What it requires
Oregon	Security requirements for Internet-connected devices	Through its security duty. What it requires
Portugal	Decreto-Lei n.º 84/2021, Security Updates for Goods With Digital Elements and Digital Content	Through its security duty. What it requires
Romania	Ordonanța de urgență nr. 140/2021, Updates and Security Updates for Goods With Digital Elements	Through its security duty. What it requires
Romania	Ordonanța de urgență nr. 141/2021, Updates and Security Updates for Digital Content and Digital Services	Through its security duty. What it requires
United Kingdom	Product Security Requirements for Connectable Products	Through its security duty. What it requires

Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.