Law / Frameworks / Crosswalk / ENISA NIS2 guidance to NIST CSF 2.0

The ENISA NIS2 Technical Implementation Guidance, mapped to the NIST Cybersecurity Framework

20 of ENISA NIS2 guidance's requirements connect to 35 of NIST CSF 2.0's through 276 laws in 112 jurisdictions. Two requirements connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, European Union Agency for Cybersecurity (ENISA)
To: NIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), National Institute of Standards and Technology
See also: NIST CSF 2.0 to ENISA NIS2 guidance, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-csf--enisa-nis2-guidance.csv · nist-csf--enisa-nis2-guidance.json

ENISA NIS2 guidance	NIST CSF 2.0	Laws	Jurisdictions	Where the laws stand
1.1Policy on the security of network and information systems	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind 1.1 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind 1.1 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind 1.1 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind 1.1 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	24	18	22 in force, 1 not yet in force, 1 proposed
	The 24 laws behind 1.1 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Cybersecurity Act, Risk-Management Measures, Hungary and 14 more, every one in the free file.
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	10	10	10 in force
	The 10 laws behind 1.1 and ID.AM-08 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
	PR.PS-04Log records are generated and made available for continuous monitoring	7	6	6 in force, 1 not yet in force
	The 7 laws behind 1.1 and PR.PS-04 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Cyber Security and Crime Act, 2021, Critical National Information Infrastructure, Sierra Leone
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind 1.1 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 1.1 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind 1.1 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	2	2	2 in force
	The 2 laws behind 1.1 and ID.AM-07 Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 1.1 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind 1.1 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind 1.1 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind 1.1 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind 1.1 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 1.1 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
1.2Roles, responsibilities and authorities	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind 1.2 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind 1.2 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind 1.2 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind 1.2 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	24	18	22 in force, 1 not yet in force, 1 proposed
	The 24 laws behind 1.2 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Cybersecurity Act, Risk-Management Measures, Hungary and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	6	5	5 in force, 1 not yet in force
	The 6 laws behind 1.2 and PR.PS-04 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Cyber Security and Crime Act, 2021, Critical National Information Infrastructure, Sierra Leone
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind 1.2 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 1.2 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind 1.2 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	2	2	2 in force
	The 2 laws behind 1.2 and ID.AM-07 Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 1.2 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind 1.2 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind 1.2 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind 1.2 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind 1.2 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 1.2 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
2.1Risk management framework	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 2.1 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 2.1 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 2.1 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 2.1 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 2.1 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 2.1 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 2.1 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 2.1 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.1 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 2.1 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 2.1 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 2.1 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	ID.IM-01Improvements are identified from evaluations	3	3	3 in force
	The 3 laws behind 2.1 and ID.IM-01 Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Law on Information Security, Essential and Important Entities, Montenegro
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 2.1 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind 2.1 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 2.1 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind 2.1 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 2.1 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 2.1 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 2.1 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind 2.1 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
2.2Compliance monitoring	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind 2.2 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind 2.2 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind 2.2 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind 2.2 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	24	18	22 in force, 1 not yet in force, 1 proposed
	The 24 laws behind 2.2 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Cybersecurity Act, Risk-Management Measures, Hungary and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	6	5	5 in force, 1 not yet in force
	The 6 laws behind 2.2 and PR.PS-04 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Cyber Security and Crime Act, 2021, Critical National Information Infrastructure, Sierra Leone
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind 2.2 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 2.2 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind 2.2 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	2	2	2 in force
	The 2 laws behind 2.2 and ID.AM-07 Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 2.2 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind 2.2 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind 2.2 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind 2.2 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind 2.2 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 2.2 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
2.3Independent review of information and network security	ID.IM-01Improvements are identified from evaluations	3	3	3 in force
2.3Independent review of information and network security	The 3 laws behind 2.3 and ID.IM-01 Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Law on Information Security, Essential and Important Entities, Montenegro
3.1Incident handling policy	RS.CO-02Internal and external stakeholders are notified of incidents	100	67	91 in force, 4 not yet in force, 5 proposed
	The 100 laws behind 3.1 and RS.CO-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Cybersecurity Law, Network Product and Service Security Duties, China Data Security Law, Risk Monitoring and Incident Reporting Duty, China National Cybersecurity Incident Reporting Measures, China and 90 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	49	37	45 in force, 2 not yet in force, 2 proposed
	The 49 laws behind 3.1 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 39 more, every one in the free file.
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 3.1 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 3.1 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	25	24	22 in force, 1 not yet in force, 2 proposed
	The 25 laws behind 3.1 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats, European Union DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Cybersecurity Act, Duty to Report Cybersecurity Incident, Ghana and 15 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 3.1 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 3.1 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 3.1 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.1 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 3.1 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 3.1 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind 3.1 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 3.1 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 3.1 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	3	3	3 in force
	The 3 laws behind 3.1 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 3.1 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	3 in force
	The 3 laws behind 3.1 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 3.1 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind 3.1 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and PR.PS-02 Cybersecurity Law, Network Product and Service Security Duties, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.1 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 3.1 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.PS-04Log records are generated and made available for continuous monitoring	2	2	2 in force
	The 2 laws behind 3.1 and PR.PS-04 CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, India New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 3.1 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	RS.MA-03Incidents are categorized and prioritized	2	2	2 in force
	The 2 laws behind 3.1 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 3.1 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
3.2Monitoring and logging	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind 3.2 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind 3.2 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind 3.2 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind 3.2 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	24	18	22 in force, 1 not yet in force, 1 proposed
	The 24 laws behind 3.2 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Cybersecurity Act, Risk-Management Measures, Hungary and 14 more, every one in the free file.
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	10	10	10 in force
	The 10 laws behind 3.2 and ID.AM-08 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
	PR.PS-04Log records are generated and made available for continuous monitoring	7	6	6 in force, 1 not yet in force
	The 7 laws behind 3.2 and PR.PS-04 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Cyber Security and Crime Act, 2021, Critical National Information Infrastructure, Sierra Leone
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind 3.2 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 3.2 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind 3.2 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	2	2	2 in force
	The 2 laws behind 3.2 and ID.AM-07 Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.2 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind 3.2 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind 3.2 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind 3.2 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind 3.2 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.2 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
3.4Event assessment and classification	RS.CO-02Internal and external stakeholders are notified of incidents	98	67	89 in force, 4 not yet in force, 5 proposed
	The 98 laws behind 3.4 and RS.CO-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Cybersecurity Law, Network Product and Service Security Duties, China Data Security Law, Risk Monitoring and Incident Reporting Duty, China National Cybersecurity Incident Reporting Measures, China and 88 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	49	37	45 in force, 2 not yet in force, 2 proposed
	The 49 laws behind 3.4 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 39 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	23	22	20 in force, 1 not yet in force, 2 proposed
	The 23 laws behind 3.4 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats, European Union DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Cybersecurity Act, Duty to Report Cybersecurity Incident, Ghana Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy and 13 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 3.4 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind 3.4 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind 3.4 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 3.4 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind 3.4 and ID.RA-06 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.4 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	RS.MA-03Incidents are categorized and prioritized	2	2	2 in force
	The 2 laws behind 3.4 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia
3.5Incident response	RS.CO-02Internal and external stakeholders are notified of incidents	101	69	92 in force, 4 not yet in force, 5 proposed
	The 101 laws behind 3.5 and RS.CO-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Cybersecurity Law, Network Product and Service Security Duties, China and 91 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	49	37	45 in force, 2 not yet in force, 2 proposed
	The 49 laws behind 3.5 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 39 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	23	22	20 in force, 1 not yet in force, 2 proposed
	The 23 laws behind 3.5 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats, European Union DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Cybersecurity Act, Duty to Report Cybersecurity Incident, Ghana Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy and 13 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 3.5 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind 3.5 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind 3.5 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	RC.CO-04Public updates on incident recovery are shared using approved methods and messaging	3	3	3 in force
	The 3 laws behind 3.5 and RC.CO-04 Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon Cybersecurity Law: Network and Information System Security Duty, Central African Republic Sécurité des systèmes d'information (dispositions communes), Gabon
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 3.5 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind 3.5 and ID.RA-06 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.5 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	2	2 in force
	The 2 laws behind 3.5 and PR.PS-02 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Law, Network Product and Service Security Duties, China
	RS.MA-03Incidents are categorized and prioritized	2	2	2 in force
	The 2 laws behind 3.5 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia
3.6Post-incident reviews	RS.CO-02Internal and external stakeholders are notified of incidents	97	66	88 in force, 4 not yet in force, 5 proposed
	The 97 laws behind 3.6 and RS.CO-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Cybersecurity Law, Network Product and Service Security Duties, China Data Security Law, Risk Monitoring and Incident Reporting Duty, China National Cybersecurity Incident Reporting Measures, China and 87 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	49	37	45 in force, 2 not yet in force, 2 proposed
	The 49 laws behind 3.6 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 39 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	23	22	20 in force, 1 not yet in force, 2 proposed
	The 23 laws behind 3.6 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats, European Union DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Cybersecurity Act, Duty to Report Cybersecurity Incident, Ghana Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy and 13 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 3.6 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind 3.6 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind 3.6 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 3.6 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind 3.6 and ID.RA-06 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.6 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	RS.MA-03Incidents are categorized and prioritized	2	2	2 in force
	The 2 laws behind 3.6 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia
4.1Business continuity and disaster recovery plan	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 4.1 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 4.1 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 4.1 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.1 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 4.1 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.1 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 4.1 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 4.1 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 4.1 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 4.1 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 4.1 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 4.1 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 4.1 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind 4.1 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 4.1 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 4.1 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 4.1 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 4.1 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind 4.1 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
4.2Backup and redundancy management	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	10	10	10 in force
4.2Backup and redundancy management	The 10 laws behind 4.2 and ID.AM-08 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
4.3Crisis management	RS.CO-02Internal and external stakeholders are notified of incidents	97	66	88 in force, 4 not yet in force, 5 proposed
	The 97 laws behind 4.3 and RS.CO-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Cybersecurity Law, Network Product and Service Security Duties, China Data Security Law, Risk Monitoring and Incident Reporting Duty, China National Cybersecurity Incident Reporting Measures, China and 87 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	49	37	45 in force, 2 not yet in force, 2 proposed
	The 49 laws behind 4.3 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 39 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	23	22	20 in force, 1 not yet in force, 2 proposed
	The 23 laws behind 4.3 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats, European Union DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Cybersecurity Act, Duty to Report Cybersecurity Incident, Ghana Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy and 13 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 4.3 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind 4.3 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind 4.3 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 4.3 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind 4.3 and ID.RA-06 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.3 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	RS.MA-03Incidents are categorized and prioritized	2	2	2 in force
	The 2 laws behind 4.3 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia
6.2Secure development life cycle	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 6.2 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 6.2 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 6.2 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 6.2 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 6.2 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 6.2 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 6.2 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 6.2 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 6.2 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 6.2 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 6.2 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 6.2 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 6.2 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind 6.2 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 6.2 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 6.2 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 6.2 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 6.2 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind 6.2 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
6.5Security testing	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 6.5 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 6.5 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 6.5 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 6.5 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 6.5 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 6.5 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 6.5 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 6.5 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 6.5 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 6.5 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 6.5 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 6.5 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 6.5 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind 6.5 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 6.5 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 6.5 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 6.5 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 6.5 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind 6.5 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
6.10Vulnerability handling and disclosure	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 6.10 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 6.10 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 6.10 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 6.10 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	RS.CO-02Internal and external stakeholders are notified of incidents	9	8	9 in force
	The 9 laws behind 6.10 and RS.CO-02 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Digital Code, Livre IV: ICT Product and Service Vendor Security Certification, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators, Finland Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties, Morocco Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure, Mozambique Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 6.10 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 6.10 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 6.10 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 6.10 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 6.10 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 6.10 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 6.10 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 6.10 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 6.10 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RC.CO-04Public updates on incident recovery are shared using approved methods and messaging	3	3	3 in force
	The 3 laws behind 6.10 and RC.CO-04 Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon Cybersecurity Law: Network and Information System Security Duty, Central African Republic Sécurité des systèmes d'information (dispositions communes), Gabon
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	3	2	2 in force, 1 not yet in force
	The 3 laws behind 6.10 and PR.PS-02 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 6.10 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 6.10 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 6.10 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 6.10 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
9.1Cryptography	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 9.1 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 9.1 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 9.1 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 9.1 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 9.1 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 9.1 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 9.1 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 9.1 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 9.1 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 9.1 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 9.1 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 9.1 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 9.1 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind 9.1 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 9.1 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 9.1 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 9.1 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 9.1 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind 9.1 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
11.2Management of access rights	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	40	37	39 in force, 1 not yet in force
	The 40 laws behind 11.2 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut and 30 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	29	18	25 in force, 4 not yet in force
	The 29 laws behind 11.2 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union and 19 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	24	18	23 in force, 1 not yet in force
	The 24 laws behind 11.2 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 14 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	12	11	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 11.2 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions, New York Law on Information and Its Protection, information-security duty, Turkmenistan and 2 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	9	5	9 in force
	The 9 laws behind 11.2 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Law on Information and Its Protection, information-security duty, Turkmenistan
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	8	7	7 in force, 1 not yet in force
	The 8 laws behind 11.2 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind 11.2 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind 11.2 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 11.2 and GV.PO-01 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind 11.2 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind 11.2 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind 11.2 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	3	3	3 in force
	The 3 laws behind 11.2 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind 11.2 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind 11.2 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind 11.2 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind 11.2 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind 11.2 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind 11.2 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
12.2Handling of assets	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	10	10	10 in force
12.2Handling of assets	The 10 laws behind 12.2 and ID.AM-08 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
12.4Asset inventory	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind 12.4 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind 12.4 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind 12.4 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind 12.4 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	24	18	22 in force, 1 not yet in force, 1 proposed
	The 24 laws behind 12.4 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti Cybersecurity Act, Risk-Management Measures, Hungary and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	6	5	5 in force, 1 not yet in force
	The 6 laws behind 12.4 and PR.PS-04 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Cyber Security and Crime Act, 2021, Critical National Information Infrastructure, Sierra Leone
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind 12.4 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 12.4 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind 12.4 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	2	2	2 in force
	The 2 laws behind 12.4 and ID.AM-07 Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind 12.4 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind 12.4 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind 12.4 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind 12.4 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind 12.4 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 12.4 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam

Not connected to the NIST CSF 2.0: 29 of ENISA NIS2 guidance's requirements

Short of 2 laws

The same duties reach these and a NIST CSF 2.0 control, in fewer than 2 of the laws we track.

5.1 Supply chain security policy: with RS.CO-02 through Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia

No law we track reaches these

No duty in the laws we track reaches these requirements.

3.3 Event reporting
5.2 Directory of suppliers and service providers
6.1 Security in acquisition of ICT services or ICT products
6.3 Configuration management
6.4 Change management, repairs and maintenance
6.6 Security patch management
6.7 Network security
6.8 Network segmentation
6.9 Protection against malicious and unauthorised software
7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
8.1 Awareness raising and basic cyber hygiene practices
8.2 Security training
10.1 Human resources security
10.2 Verification of background
10.3 Termination or change of employment procedures
10.4 Disciplinary process
11.1 Access control policy
11.3 Privileged accounts and system administration accounts
11.4 Administration systems
11.5 Identification
11.6 Authentication
11.7 Multi-factor authentication
12.1 Asset classification
12.3 Removable media policy
12.5 Deposit, return or deletion of assets upon termination of employment
13.1 Supporting utilities
13.2 Protection against physical and environmental threats
13.3 Perimeter and physical access control

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the ENISA NIS2 guidance through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two requirements connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the cybersecurity laws we track has been read against the framework for its subject.

Sources and licenses

ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.