Law / Frameworks / Crosswalk / FINOS AIGF to ENISA NIS2 guidance

The FINOS AI Governance Framework, mapped to the ENISA NIS2 Technical Implementation Guidance

13 of FINOS AIGF's controls connect to 20 of ENISA NIS2 guidance's through 276 laws in 112 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
To: ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, European Union Agency for Cybersecurity (ENISA)
See also: ENISA NIS2 guidance to FINOS AIGF, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: finos-ai-governance-framework--enisa-nis2-guidance.csv · finos-ai-governance-framework--enisa-nis2-guidance.json

FINOS AIGF	ENISA NIS2 guidance	Laws	Jurisdictions	Where the laws stand
AIR-PREV-005System Acceptance Testing	1.1Policy on the security of network and information systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-005 and 1.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	1.2Roles, responsibilities and authorities	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-005 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	2.2Compliance monitoring	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-005 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.2Monitoring and logging	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-005 and 3.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	12.4Asset inventory	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-005 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.1Incident handling policy	17	17	15 in force, 2 not yet in force
	The 17 laws behind AIR-PREV-005 and 3.1 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	3.4Event assessment and classification	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-005 and 3.4 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.5Incident response	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-005 and 3.5 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.6Post-incident reviews	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-005 and 3.6 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	4.3Crisis management	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-005 and 4.3 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	2.1Risk management framework	9	9	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-005 and 2.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Law on Information Security, Essential and Important Entities, Montenegro DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	4.1Business continuity and disaster recovery plan	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and 4.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.2Secure development life cycle	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and 6.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.5Security testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and 6.5 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.10Vulnerability handling and disclosure	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and 6.10 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	9.1Cryptography	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and 9.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	11.2Management of access rights	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and 11.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.3Independent review of information and network security	4	4	4 in force
	The 4 laws behind AIR-PREV-005 and 2.3 Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Law on Information Security, Essential and Important Entities, Montenegro DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
AIR-PREV-006Data Quality & Classification/Sensitivity	1.1Policy on the security of network and information systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-006 and 1.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	1.2Roles, responsibilities and authorities	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-006 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	2.2Compliance monitoring	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-006 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.2Monitoring and logging	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-006 and 3.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	12.4Asset inventory	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-006 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.1Incident handling policy	17	17	15 in force, 2 not yet in force
	The 17 laws behind AIR-PREV-006 and 3.1 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	3.4Event assessment and classification	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-006 and 3.4 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.5Incident response	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-006 and 3.5 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.6Post-incident reviews	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-006 and 3.6 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	4.3Crisis management	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-006 and 4.3 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	2.1Risk management framework	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-006 and 2.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	4.1Business continuity and disaster recovery plan	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and 4.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.2Secure development life cycle	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and 6.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.5Security testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and 6.5 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.10Vulnerability handling and disclosure	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and 6.10 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	9.1Cryptography	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and 9.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	11.2Management of access rights	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and 11.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.1Incident handling policy	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-007 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-007 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-007 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-007 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-007 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-007 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-007 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-007 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-007 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-007 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.1Incident handling policy	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-008 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-008 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-008 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-008 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-008 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-008 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-008 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-008 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-008 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-008 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-012Role-Based Access Control for AI Data	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.1Incident handling policy	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-012 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-012 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-012 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-012 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-012 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-012 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-012 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-012 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-012 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-012 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-014Encryption of AI Data at Rest	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.1Incident handling policy	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-014 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-014 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-014 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-014 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-014 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-014 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-014 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-014 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-014 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-014 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-017AI Firewall Implementation and Management	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.1Incident handling policy	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-017 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-017 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-017 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-017 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-017 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-017 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-017 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-017 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-017 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-017 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-020MCP Server Security Governance	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.1Incident handling policy	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-PREV-020 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-020 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-020 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-020 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-PREV-020 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-020 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-020 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-020 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-020 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-020 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-024Human-in-the-Loop Action Approval Gate	1.1Policy on the security of network and information systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-024 and 1.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	1.2Roles, responsibilities and authorities	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-024 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	2.2Compliance monitoring	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-024 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.2Monitoring and logging	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-024 and 3.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	12.4Asset inventory	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-PREV-024 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.1Incident handling policy	17	17	15 in force, 2 not yet in force
	The 17 laws behind AIR-PREV-024 and 3.1 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	3.4Event assessment and classification	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-024 and 3.4 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.5Incident response	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-024 and 3.5 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.6Post-incident reviews	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-024 and 3.6 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	4.3Crisis management	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-PREV-024 and 4.3 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	2.1Risk management framework	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-024 and 2.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	4.1Business continuity and disaster recovery plan	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and 4.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.2Secure development life cycle	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and 6.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.5Security testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and 6.5 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.10Vulnerability handling and disclosure	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and 6.10 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	9.1Cryptography	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and 9.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	11.2Management of access rights	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and 11.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-DET-001AI Data Leakage Prevention and Detection	3.1Incident handling policy	108	71	101 in force, 6 not yet in force, 1 proposed
	The 108 laws behind AIR-DET-001 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 98 more, every one in the free file.
	2.1Risk management framework	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.2Secure development life cycle	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.5Security testing	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	6.10Vulnerability handling and disclosure	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	9.1Cryptography	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	11.2Management of access rights	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind AIR-DET-001 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	3.4Event assessment and classification	9	8	8 in force, 1 not yet in force
	The 9 laws behind AIR-DET-001 and 3.4 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.5Incident response	9	8	8 in force, 1 not yet in force
	The 9 laws behind AIR-DET-001 and 3.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	3.6Post-incident reviews	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-001 and 3.6 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	4.3Crisis management	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-001 and 4.3 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	1.1Policy on the security of network and information systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-001 and 1.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	1.2Roles, responsibilities and authorities	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-001 and 1.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	2.2Compliance monitoring	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-001 and 2.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	3.2Monitoring and logging	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-001 and 3.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	12.4Asset inventory	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-001 and 12.4 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-DET-004AI System Observability	1.1Policy on the security of network and information systems	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind AIR-DET-004 and 1.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	3.2Monitoring and logging	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind AIR-DET-004 and 3.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	3.1Incident handling policy	110	69	99 in force, 6 not yet in force, 5 proposed
	The 110 laws behind AIR-DET-004 and 3.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 100 more, every one in the free file.
	3.4Event assessment and classification	108	69	98 in force, 5 not yet in force, 5 proposed
	The 108 laws behind AIR-DET-004 and 3.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 98 more, every one in the free file.
	3.5Incident response	108	69	98 in force, 5 not yet in force, 5 proposed
	The 108 laws behind AIR-DET-004 and 3.5 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 98 more, every one in the free file.
	3.6Post-incident reviews	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind AIR-DET-004 and 3.6 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	4.3Crisis management	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind AIR-DET-004 and 4.3 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	1.2Roles, responsibilities and authorities	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-004 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	2.2Compliance monitoring	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-004 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	12.4Asset inventory	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-004 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	6.10Vulnerability handling and disclosure	13	11	11 in force, 2 not yet in force
	The 13 laws behind AIR-DET-004 and 6.10 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators, Finland Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties, Morocco Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure, Mozambique Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set and 3 more, every one in the free file.
	4.2Backup and redundancy management	11	11	11 in force
	The 11 laws behind AIR-DET-004 and 4.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
	12.2Handling of assets	11	11	11 in force
	The 11 laws behind AIR-DET-004 and 12.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
	2.1Risk management framework	11	9	9 in force, 2 not yet in force
	The 11 laws behind AIR-DET-004 and 2.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam and 1 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-004 and 4.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.2Secure development life cycle	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-004 and 6.2 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.5Security testing	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-004 and 6.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	9.1Cryptography	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-004 and 9.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	11.2Management of access rights	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-004 and 11.2 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-DET-011Human Feedback Loop for AI Systems	1.1Policy on the security of network and information systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-011 and 1.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	1.2Roles, responsibilities and authorities	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-011 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	2.2Compliance monitoring	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-011 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.2Monitoring and logging	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-011 and 3.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	12.4Asset inventory	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-011 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	3.1Incident handling policy	17	17	15 in force, 2 not yet in force
	The 17 laws behind AIR-DET-011 and 3.1 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	3.4Event assessment and classification	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-DET-011 and 3.4 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.5Incident response	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-DET-011 and 3.5 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	3.6Post-incident reviews	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-DET-011 and 3.6 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	4.3Crisis management	15	15	14 in force, 1 not yet in force
	The 15 laws behind AIR-DET-011 and 4.3 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	2.1Risk management framework	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-DET-011 and 2.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	4.1Business continuity and disaster recovery plan	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and 4.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.2Secure development life cycle	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and 6.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.5Security testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and 6.5 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.10Vulnerability handling and disclosure	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and 6.10 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	9.1Cryptography	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and 9.1 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	11.2Management of access rights	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and 11.2 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-DET-021Agent Decision Audit and Explainability	1.1Policy on the security of network and information systems	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind AIR-DET-021 and 1.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	3.2Monitoring and logging	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind AIR-DET-021 and 3.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	3.5Incident response	113	72	103 in force, 5 not yet in force, 5 proposed
	The 113 laws behind AIR-DET-021 and 3.5 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon and 103 more, every one in the free file.
	3.1Incident handling policy	109	68	98 in force, 6 not yet in force, 5 proposed
	The 109 laws behind AIR-DET-021 and 3.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 99 more, every one in the free file.
	3.4Event assessment and classification	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind AIR-DET-021 and 3.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	3.6Post-incident reviews	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind AIR-DET-021 and 3.6 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	4.3Crisis management	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind AIR-DET-021 and 4.3 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	1.2Roles, responsibilities and authorities	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-021 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	2.2Compliance monitoring	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-021 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	12.4Asset inventory	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind AIR-DET-021 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	6.10Vulnerability handling and disclosure	19	17	17 in force, 2 not yet in force
	The 19 laws behind AIR-DET-021 and 6.10 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon Cybersecurity Law: Network and Information System Security Duty, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Livre IV: ICT Product and Service Vendor Security Certification, Democratic Republic of the Congo Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators, Finland Sécurité des systèmes d'information (dispositions communes), Gabon and 9 more, every one in the free file.
	4.2Backup and redundancy management	11	11	11 in force
	The 11 laws behind AIR-DET-021 and 4.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
	12.2Handling of assets	11	11	11 in force
	The 11 laws behind AIR-DET-021 and 12.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
	2.1Risk management framework	11	9	9 in force, 2 not yet in force
	The 11 laws behind AIR-DET-021 and 2.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam and 1 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-021 and 4.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.2Secure development life cycle	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-021 and 6.2 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	6.5Security testing	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-021 and 6.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	9.1Cryptography	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-021 and 9.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	11.2Management of access rights	10	8	8 in force, 2 not yet in force
	The 10 laws behind AIR-DET-021 and 11.2 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam

Not connected to the ENISA NIS2 guidance: 12 of FINOS AIGF's controls

No ENISA NIS2 guidance requirement on the same duties

Laws reach these, but no duty that reaches one of them also reaches a ENISA NIS2 guidance requirement.

AIR-PREV-018 Agent Authority Least Privilege Framework, 147 laws
AIR-PREV-023 Agentic System Credential Protection Framework, 147 laws
AIR-DET-013 Providing Citations and Source Traceability for AI-Generated Information, 33 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

AIR-PREV-002 Data Filtering From External Knowledge Bases
AIR-PREV-003 User/App/Model Firewalling/Filtering
AIR-PREV-010 AI Model Version Pinning
AIR-PREV-019 Tool Chain Validation and Sanitization
AIR-PREV-022 Multi-Agent Isolation and Segmentation
AIR-PREV-025 Skill/Plugin Integrity and Governance
AIR-DET-009 AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring
AIR-DET-015 Using Large Language Models for Automated Evaluation (LLM-as-a-Judge)
AIR-DET-016 Preserving Source Data Access Controls in AI Systems

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the cybersecurity laws we track has been read against the framework for its subject.

Sources and licenses

ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.