Law / Frameworks / Crosswalk / FINOS AIGF to NIST CSF 2.0

The FINOS AI Governance Framework, mapped to the NIST Cybersecurity Framework

13 of FINOS AIGF's controls connect to 38 of NIST CSF 2.0's through 469 laws in 177 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
To: NIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), National Institute of Standards and Technology
See also: NIST CSF 2.0 to FINOS AIGF, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-csf--finos-ai-governance-framework.csv · nist-csf--finos-ai-governance-framework.json

FINOS AIGF	NIST CSF 2.0	Laws	Jurisdictions	Where the laws stand
AIR-PREV-005System Acceptance Testing	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind AIR-PREV-005 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind AIR-PREV-005 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind AIR-PREV-005 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	25	18	23 in force, 1 not yet in force, 1 proposed
	The 25 laws behind AIR-PREV-005 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 15 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind AIR-PREV-005 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	15	8	10 in force, 5 not yet in force
	The 15 laws behind AIR-PREV-005 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 5 more, every one in the free file.
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	7	7	6 in force, 1 proposed
	The 7 laws behind AIR-PREV-005 and ID.AM-07 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon General Data Protection Regulation, Records of Processing Activities (Article 30), European Union Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	6	6	6 in force
	The 6 laws behind AIR-PREV-005 and PR.DS-01 Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categories, Cabo Verde Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.IM-01Improvements are identified from evaluations	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-005 and ID.IM-01 Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Law on Information Security, Essential and Important Entities, Montenegro Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind AIR-PREV-005 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	4	4	3 in force, 1 not yet in force
	The 4 laws behind AIR-PREV-005 and ID.AM-08 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Personal Health Information Protection Act, 2004, offences and damages for breach of privacy, Ontario Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	4	4	2 in force, 2 proposed
	The 4 laws behind AIR-PREV-005 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-005 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and...	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and GV.PO-02 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind AIR-PREV-005 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-005 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-006Data Quality & Classification/Sensitivity	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind AIR-PREV-006 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind AIR-PREV-006 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind AIR-PREV-006 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	25	18	23 in force, 1 not yet in force, 1 proposed
	The 25 laws behind AIR-PREV-006 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 15 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind AIR-PREV-006 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	15	8	10 in force, 5 not yet in force
	The 15 laws behind AIR-PREV-006 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 5 more, every one in the free file.
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	7	7	6 in force, 1 proposed
	The 7 laws behind AIR-PREV-006 and ID.AM-07 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon General Data Protection Regulation, Records of Processing Activities (Article 30), European Union Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-006 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	5	5	5 in force
	The 5 laws behind AIR-PREV-006 and PR.DS-01 Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind AIR-PREV-006 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-006 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-PREV-006 and ID.AM-08 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel), Cameroon Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind AIR-PREV-006 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and...	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and GV.PO-02 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-006 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind AIR-PREV-006 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-006 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-PREV-007Legal and Contractual Frameworks for AI Systems	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	113	96	104 in force, 5 not yet in force, 4 proposed
	The 113 laws behind AIR-PREV-007 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 103 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-PREV-007 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	25	18	24 in force, 1 not yet in force
	The 25 laws behind AIR-PREV-007 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 15 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	14	14	12 in force, 2 not yet in force
	The 14 laws behind AIR-PREV-007 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Personal Data Protection Law, cross-border transfer of personal data, Burkina Faso Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali and 4 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-PREV-007 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-PREV-007 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-007 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-PREV-007 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-007 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-PREV-007 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	4	4	4 in force
	The 4 laws behind AIR-PREV-007 and ID.AM-08 Ley 25.326, Ley de Protección de los Datos Personales, Argentina Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-PREV-007 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-PREV-007 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-PREV-007 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind AIR-PREV-007 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-PREV-007 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-007 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-007 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	112	96	103 in force, 5 not yet in force, 4 proposed
	The 112 laws behind AIR-PREV-008 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 102 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-PREV-008 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	25	18	24 in force, 1 not yet in force
	The 25 laws behind AIR-PREV-008 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 15 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-PREV-008 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-PREV-008 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	11	11	9 in force, 2 not yet in force
	The 11 laws behind AIR-PREV-008 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set and 1 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-008 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-PREV-008 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-008 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-PREV-008 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-PREV-008 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-PREV-008 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind AIR-PREV-008 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-PREV-008 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-PREV-008 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-008 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-008 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-PREV-012Role-Based Access Control for AI Data	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	112	96	103 in force, 5 not yet in force, 4 proposed
	The 112 laws behind AIR-PREV-012 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 102 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-PREV-012 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	25	18	24 in force, 1 not yet in force
	The 25 laws behind AIR-PREV-012 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 15 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-PREV-012 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-PREV-012 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	11	11	9 in force, 2 not yet in force
	The 11 laws behind AIR-PREV-012 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set and 1 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-012 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-PREV-012 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-012 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-PREV-012 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-PREV-012 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-PREV-012 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind AIR-PREV-012 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-PREV-012 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-PREV-012 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-012 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-012 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-PREV-014Encryption of AI Data at Rest	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	112	96	103 in force, 5 not yet in force, 4 proposed
	The 112 laws behind AIR-PREV-014 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 102 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-PREV-014 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	25	18	24 in force, 1 not yet in force
	The 25 laws behind AIR-PREV-014 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 15 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-PREV-014 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-PREV-014 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	11	11	9 in force, 2 not yet in force
	The 11 laws behind AIR-PREV-014 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set and 1 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-014 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-PREV-014 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-014 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-PREV-014 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-PREV-014 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-PREV-014 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind AIR-PREV-014 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-PREV-014 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-PREV-014 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-014 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-014 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-PREV-017AI Firewall Implementation and Management	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	112	96	103 in force, 5 not yet in force, 4 proposed
	The 112 laws behind AIR-PREV-017 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 102 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-PREV-017 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	25	18	24 in force, 1 not yet in force
	The 25 laws behind AIR-PREV-017 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 15 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-PREV-017 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-PREV-017 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	11	11	9 in force, 2 not yet in force
	The 11 laws behind AIR-PREV-017 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set and 1 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-017 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-PREV-017 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-017 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-PREV-017 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-PREV-017 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-PREV-017 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind AIR-PREV-017 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-PREV-017 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-PREV-017 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-017 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-017 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-PREV-020MCP Server Security Governance	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	112	96	103 in force, 5 not yet in force, 4 proposed
	The 112 laws behind AIR-PREV-020 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 102 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-PREV-020 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	25	18	24 in force, 1 not yet in force
	The 25 laws behind AIR-PREV-020 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 15 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-PREV-020 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-PREV-020 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	11	11	9 in force, 2 not yet in force
	The 11 laws behind AIR-PREV-020 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set and 1 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-PREV-020 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-PREV-020 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-PREV-020 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-PREV-020 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-PREV-020 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-PREV-020 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	RS.CO-02Internal and external stakeholders are notified of incidents	3	3	3 in force
	The 3 laws behind AIR-PREV-020 and RS.CO-02 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-PREV-020 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-PREV-020 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-020 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-020 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-PREV-024Human-in-the-Loop Action Approval Gate	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind AIR-PREV-024 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind AIR-PREV-024 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind AIR-PREV-024 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	25	18	23 in force, 1 not yet in force, 1 proposed
	The 25 laws behind AIR-PREV-024 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 15 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind AIR-PREV-024 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	15	8	10 in force, 5 not yet in force
	The 15 laws behind AIR-PREV-024 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 5 more, every one in the free file.
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	7	7	6 in force, 1 proposed
	The 7 laws behind AIR-PREV-024 and ID.AM-07 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon General Data Protection Regulation, Records of Processing Activities (Article 30), European Union Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-PREV-024 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	5	5	5 in force
	The 5 laws behind AIR-PREV-024 and PR.DS-01 Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind AIR-PREV-024 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-024 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind AIR-PREV-024 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and...	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and GV.PO-02 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and ID.AM-08 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-024 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind AIR-PREV-024 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-PREV-024 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-DET-001AI Data Leakage Prevention and Detection	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	112	96	103 in force, 5 not yet in force, 4 proposed
	The 112 laws behind AIR-DET-001 and PR.DS-01 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 124/2024 On the Protection of Personal Data, Albania Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria LQPD, Llei 29/2021 del 28 d'octubre, Andorra Law on the Protection of Personal Data, Angola Law on the Protection of Personal Data, sensitive data categories, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Data Protection Act, 2013, Antigua and Barbuda Ley 25.326, Ley de Protección de los Datos Personales, Argentina Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act, Arkansas and 102 more, every one in the free file.
	RS.CO-02Internal and external stakeholders are notified of incidents	88	80	79 in force, 5 not yet in force, 4 proposed
	The 88 laws behind AIR-DET-001 and RS.CO-02 Law No. 124/2024, notification of a personal data breach, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations, Belarus Data Protection Act 2021, personal data breach notification, Belize from a date not yet set Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité, Benin Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina Data Protection Act, 2024, personal data breach notification, Botswana LGPD, security incident notification, Brazil and 78 more, every one in the free file.
	PR.PS-06Secure software development practices are integrated, and their performance is...	32	18	27 in force, 5 not yet in force
	The 32 laws behind AIR-DET-001 and PR.PS-06 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil Security of Connected Devices, California OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements, Cyprus AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months and 22 more, every one in the free file.
	RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and...	26	26	25 in force, 1 proposed
	The 26 laws behind AIR-DET-001 and RS.AN-06 Law No. 124/2024, notification of a personal data breach, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina Electronic Communications Act Articles 261в to 261д, Personal Data Breach Notification by Providers of Public Electronic Communications Services, Bulgaria Law No. 133/V/2001 on the Protection of Personal Data, personal data breach notification, Cabo Verde Digital Code, Book I: personal-data breach notification, Djibouti Ley para la Protección de Datos Personales, personal data breach notification, El Salvador Personal Data Protection Proclamation, personal data breach notification, Ethiopia and 16 more, every one in the free file.
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	26	19	25 in force, 1 not yet in force
	The 26 laws behind AIR-DET-001 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union and 16 more, every one in the free file.
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	14	11	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind AIR-DET-001 and DE.CM-09 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: Digital Services Provider Security Obligations, Democratic Republic of the Congo Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations, Marshall Islands FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock, Micronesia proposed and 4 more, every one in the free file.
	PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed,...	13	9	13 in force
	The 13 laws behind AIR-DET-001 and PR.AA-05 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Digital Code, Title III: Personal Data Protection, Democratic Republic of the Congo Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Personal Data Protection Act 2025, government personal-data protection principles, Marshall Islands Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York and 3 more, every one in the free file.
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	11	11	9 in force, 2 not yet in force
	The 11 laws behind AIR-DET-001 and GV.SC-05 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11, Algeria Data Protection Act, 2013, Antigua and Barbuda Law No. 133/V/2001 on the Protection of Personal Data, Cabo Verde Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Data Protection Act, Ghana Data Protection Act, No. 1 of 2023, Grenada from a date not yet set Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Loi n° 2013-015, protection des données à caractère personnel, Mali Data Protection Act, 2018, Saint Kitts and Nevis from a date not yet set and 1 more, every one in the free file.
	ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established	9	7	8 in force, 1 not yet in force
	The 9 laws behind AIR-DET-001 and ID.RA-08 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties, Italy Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation, Latvia Product Security Requirements for Connectable Products, United Kingdom
	PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected	8	7	8 in force
	The 8 laws behind AIR-DET-001 and PR.DS-02 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, Germany Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Standards for the Protection of Personal Information of Residents of the Commonwealth, Massachusetts Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	6	6	5 in force, 1 not yet in force
	The 6 laws behind AIR-DET-001 and GV.PO-01 Law on the Protection of Personal Data, Angola Ley No. 172-13 sobre Protección Integral de los Datos Personales, Dominican Republic Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Identity Theft Protection Act of 2015, risk-based information security program, Rhode Island Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.RA-01Vulnerabilities in assets are identified, validated, and recorded	6	4	6 in force
	The 6 laws behind AIR-DET-001 and ID.RA-01 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin OSFI Guideline B-13, Technology and Cyber Risk Management, Canada DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	PR.DS-11Backups of data are created, protected, maintained, and tested	4	4	4 in force
	The 4 laws behind AIR-DET-001 and PR.DS-11 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
	PR.AA-03Users, services, and hardware are authenticated	4	3	4 in force
	The 4 laws behind AIR-DET-001 and PR.AA-03 Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	3	3	3 in force
	The 3 laws behind AIR-DET-001 and GV.OC-03 Cybersecurity Law, Network Product and Service Security Duties, China Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty, Cuba Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	3	3	3 in force
	The 3 laws behind AIR-DET-001 and ID.AM-08 Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty, Connecticut Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty, Nebraska Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information, Oregon
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	2	2	2 in force
	The 2 laws behind AIR-DET-001 and GV.RR-02 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	2	2	2 in force
	The 2 laws behind AIR-DET-001 and ID.RA-06 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-DET-001 and PR.AT-01 Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia Data Protection Act, Saint Lucia
	PR.PS-01Configuration management practices are established and applied	2	2	2 in force
	The 2 laws behind AIR-DET-001 and PR.PS-01 Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	DE.CM-01Networks and network services are monitored to find potentially adverse events	2	2	2 in force
	The 2 laws behind AIR-DET-001 and DE.CM-01 Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts), Lebanon
	RS.CO-03Information is shared with designated internal and external stakeholders	2	2	2 in force
	The 2 laws behind AIR-DET-001 and RS.CO-03 Personal Information Protection Act, data breach notification, Illinois Law 506/2004 Article 3, Personal Data Breach Notification by Electronic Communications Providers, Romania
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	1	2 in force
	The 2 laws behind AIR-DET-001 and ID.IM-02 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-001 and PR.PS-02 Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	1	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-001 and PR.IR-03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
AIR-DET-004AI System Observability	RS.CO-02Internal and external stakeholders are notified of incidents	184	122	165 in force, 9 not yet in force, 10 proposed
	The 184 laws behind AIR-DET-004 and RS.CO-02 Law No. 124/2024, notification of a personal data breach, Albania Law No. 25/2024, On Cybersecurity, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria Llei 22/2022, Incident Handling and Notification Obligation, Andorra LQPD, personal data breach notification, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Data Protection Act, 2019, personal data breach notification, Barbados Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations, Belarus and 174 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	71	49	63 in force, 4 not yet in force, 4 proposed
	The 71 laws behind AIR-DET-004 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 61 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind AIR-DET-004 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	52	39	48 in force, 2 not yet in force, 2 proposed
	The 52 laws behind AIR-DET-004 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 42 more, every one in the free file.
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	37	34	35 in force, 2 not yet in force
	The 37 laws behind AIR-DET-004 and ID.AM-08 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Ley 25.326, Ley de Protección de los Datos Personales, Argentina HB2112, internet pornography, minors, age verification, Arizona Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel), Cameroon Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Personal Data Protection Proclamation, Ethiopia Act on the Protection of Privacy in Working Life, Sections 15 to 17, Genetic Testing and Camera Surveillance of Employees, Finland Florida Information Protection Act, data security and disposal duty, Florida and 27 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind AIR-DET-004 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and...	28	28	27 in force, 1 proposed
	The 28 laws behind AIR-DET-004 and RS.AN-06 Law No. 124/2024, notification of a personal data breach, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina Electronic Communications Act Articles 261в to 261д, Personal Data Breach Notification by Providers of Public Electronic Communications Services, Bulgaria Law No. 133/V/2001 on the Protection of Personal Data, personal data breach notification, Cabo Verde Digital Code, Book I: personal-data breach notification, Djibouti Ley para la Protección de Datos Personales, personal data breach notification, El Salvador Personal Data Protection Proclamation, personal data breach notification, Ethiopia and 18 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	25	18	23 in force, 1 not yet in force, 1 proposed
	The 25 laws behind AIR-DET-004 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 15 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind AIR-DET-004 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	17	10	12 in force, 5 not yet in force
	The 17 laws behind AIR-DET-004 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, India Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy and 7 more, every one in the free file.
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	8	8	7 in force, 1 proposed
	The 8 laws behind AIR-DET-004 and PR.DS-01 Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Ley 81 de 2019, Sobre Protección de Datos Personales, Panama Ley N° 6534/2020, de Protección de Datos Personales Crediticios, Paraguay Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-004 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cyber and Data Protection Regulations 2024, security breach notification, Zimbabwe
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	7	7	6 in force, 1 proposed
	The 7 laws behind AIR-DET-004 and ID.AM-07 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon General Data Protection Regulation, Records of Processing Activities (Article 30), European Union Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-004 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	5	5	3 in force, 2 proposed
	The 5 laws behind AIR-DET-004 and ID.RA-06 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-DET-004 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind AIR-DET-004 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and...	3	3	3 in force
	The 3 laws behind AIR-DET-004 and GV.PO-02 Ley para la Protección de Datos Personales, personal data breach notification, El Salvador Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-004 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.IM-01Improvements are identified from evaluations	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-004 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	RS.MA-03Incidents are categorized and prioritized	3	3	3 in force
	The 3 laws behind AIR-DET-004 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Commission Regulation on Personal Data Breach Notification by Electronic Communications Providers (Regulation (EU) No 611/2013), European Union Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind AIR-DET-004 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-004 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-004 and GV.SC-05 AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA, Latvia
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind AIR-DET-004 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-DET-004 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	2	2	2 in force
	The 2 laws behind AIR-DET-004 and PR.PS-02 Security Standards for Smart Devices, Australia Cybersecurity Law, Network Product and Service Security Duties, China
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind AIR-DET-004 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
AIR-DET-011Human Feedback Loop for AI Systems	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	61	41	55 in force, 4 not yet in force, 2 proposed
	The 61 laws behind AIR-DET-011 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 51 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind AIR-DET-011 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind AIR-DET-011 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	25	18	23 in force, 1 not yet in force, 1 proposed
	The 25 laws behind AIR-DET-011 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 15 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind AIR-DET-011 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	15	8	10 in force, 5 not yet in force
	The 15 laws behind AIR-DET-011 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 5 more, every one in the free file.
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	7	7	6 in force, 1 proposed
	The 7 laws behind AIR-DET-011 and ID.AM-07 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon General Data Protection Regulation, Records of Processing Activities (Article 30), European Union Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-011 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	5	5	5 in force
	The 5 laws behind AIR-DET-011 and PR.DS-01 Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind AIR-DET-011 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-011 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	3	3	1 in force, 2 proposed
	The 3 laws behind AIR-DET-011 and ID.RA-06 Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and...	2	2	2 in force
	The 2 laws behind AIR-DET-011 and GV.PO-02 Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	2	2	2 in force
	The 2 laws behind AIR-DET-011 and ID.AM-08 Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde Ley 29733, Ley de Protección de Datos Personales, Peru
	ID.IM-01Improvements are identified from evaluations	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-011 and ID.IM-01 Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind AIR-DET-011 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	2	2	2 in force
	The 2 laws behind AIR-DET-011 and ID.IM-04 Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-DET-011 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind AIR-DET-011 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-011 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
AIR-DET-021Agent Decision Audit and Explainability	RS.CO-02Internal and external stakeholders are notified of incidents	150	102	133 in force, 8 not yet in force, 9 proposed
	The 150 laws behind AIR-DET-021 and RS.CO-02 Law No. 124/2024, notification of a personal data breach, Albania Law No. 25/2024, On Cybersecurity, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria Llei 22/2022, Incident Handling and Notification Obligation, Andorra LQPD, personal data breach notification, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Data Protection Act, 2019, personal data breach notification, Barbados Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations, Belarus and 140 more, every one in the free file.
	GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including...	71	49	63 in force, 4 not yet in force, 4 proposed
	The 71 laws behind AIR-DET-021 and GV.OC-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon OSFI Guideline B-10, Third-Party Risk Management, Canada and 61 more, every one in the free file.
	GV.PO-01Policy for managing cybersecurity risks is established based on organizational...	60	40	56 in force, 4 not yet in force
	The 60 laws behind AIR-DET-021 and GV.PO-01 Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank, Canada Data Security Law, Data Security Protection Obligations, China Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 50 more, every one in the free file.
	RS.CO-03Information is shared with designated internal and external stakeholders	50	38	46 in force, 2 not yet in force, 2 proposed
	The 50 laws behind AIR-DET-021 and RS.CO-03 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification, Czech Republic Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 40 more, every one in the free file.
	ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles	37	34	35 in force, 2 not yet in force
	The 37 laws behind AIR-DET-021 and ID.AM-08 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Ley 25.326, Ley de Protección de los Datos Personales, Argentina HB2112, internet pornography, minors, age verification, Arizona Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision, Cabo Verde AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel), Cameroon Data Protection Act, 2022 (Act No. 5 of 2022), Eswatini Personal Data Protection Proclamation, Ethiopia Act on the Protection of Privacy in Working Life, Sections 15 to 17, Genetic Testing and Camera Surveillance of Employees, Finland Florida Information Protection Act, data security and disposal duty, Florida and 27 more, every one in the free file.
	GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and...	31	26	28 in force, 1 not yet in force, 2 proposed
	The 31 laws behind AIR-DET-021 and GV.RR-01 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia and 21 more, every one in the free file.
	GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are...	25	18	23 in force, 1 not yet in force, 1 proposed
	The 25 laws behind AIR-DET-021 and GV.RR-02 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Data Security Law, Data Security Protection Obligations, China Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR), European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR), European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 15 more, every one in the free file.
	PR.AT-02Individuals in specialized roles are provided with awareness and training so that they...	24	21	23 in force, 1 proposed
	The 24 laws behind AIR-DET-021 and PR.AT-02 Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures, Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration, Denmark Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties, Estonia DORA, Articles 5-16 (ICT Risk Management Framework), European Union NIS2 Directive, Cybersecurity Risk-Management Measures, European Union and 14 more, every one in the free file.
	RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and...	19	19	19 in force
	The 19 laws behind AIR-DET-021 and RS.AN-06 Law No. 124/2024, notification of a personal data breach, Albania Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données, Algeria LQPD, personal data breach notification, Andorra Data Protection Act, 2019, personal data breach notification, Barbados Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Bosnia and Herzegovina Law No. 133/V/2001 on the Protection of Personal Data, personal data breach notification, Cabo Verde Digital Code, Book I: personal-data breach notification, Djibouti Ley para la Protección de Datos Personales, personal data breach notification, El Salvador Personal Data Protection Proclamation, personal data breach notification, Ethiopia Law No. 025/2023, personal-data breach notification, Gabon and 9 more, every one in the free file.
	PR.PS-04Log records are generated and made available for continuous monitoring	17	10	12 in force, 5 not yet in force
	The 17 laws behind AIR-DET-021 and PR.PS-04 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, India Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy and 7 more, every one in the free file.
	PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected	9	9	8 in force, 1 proposed
	The 9 laws behind AIR-DET-021 and PR.DS-01 Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation), Chad Protection of Children (Online Age Verification) Bill 2026, Ireland proposed Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg Ley No. 787, Ley de Protección de Datos Personales, Nicaragua Ley 81 de 2019, Sobre Protección de Datos Personales, Panama Ley N° 6534/2020, de Protección de Datos Personales Crediticios, Paraguay Law No. 12 of 2024 on Protection of Electronic Personal Data, Syria General Regulation on the Protection of Personal Data for Vatican City State, Vatican City Data Protection Act, 2021, personal data processing framework, Zambia
	ID.IM-04Incident response plans and other cybersecurity plans that affect operations are...	8	7	7 in force, 1 not yet in force
	The 8 laws behind AIR-DET-021 and ID.IM-04 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cyber and Data Protection Regulations 2024, security breach notification, Zimbabwe
	ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained	7	7	6 in force, 1 proposed
	The 7 laws behind AIR-DET-021 and ID.AM-07 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon General Data Protection Regulation, Records of Processing Activities (Article 30), European Union Data Classification Policy, Kuwait DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname proposed General Regulation on the Protection of Personal Data for Vatican City State, Vatican City
	ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent...	5	5	4 in force, 1 not yet in force
	The 5 laws behind AIR-DET-021 and ID.RA-05 Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure, Iceland Cybersecurity Act 2026, Critical Infrastructure Operator Obligations, Kiribati from a date not yet set Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure, Marshall Islands DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation, Slovakia
	ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated	5	5	3 in force, 2 proposed
	The 5 laws behind AIR-DET-021 and ID.RA-06 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2), France proposed National Cyber Security Bill, Cybersecurity Risk-Management Measures, Ireland proposed Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Cybersäkerhetslag, Cybersecurity Risk-Management Measures, Sweden
	RS.MI-01Incidents are contained	5	5	3 in force, 2 not yet in force
	The 5 laws behind AIR-DET-021 and RS.MI-01 Data Security Law, Risk Monitoring and Incident Reporting Duty, China Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification, Latvia Cybersecurity Incident Reporting and Emergency Response, Tunisia
	ID.AM-02Inventories of software, services, and systems managed by the organization are maintained	4	4	4 in force
	The 4 laws behind AIR-DET-021 and ID.AM-02 Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and...	3	3	3 in force
	The 3 laws behind AIR-DET-021 and GV.PO-02 Ley para la Protección de Datos Personales, personal data breach notification, El Salvador Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
	ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on...	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-021 and ID.AM-05 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Act, Risk-Management Measures, Hungary Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management, Taiwan
	ID.IM-01Improvements are identified from evaluations	3	3	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-021 and ID.IM-01 Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Law on Information Security, ICT Systems of Special Importance and Security Measures, Serbia Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set
	PR.PS-02Software is maintained, replaced, and removed commensurate with risk	3	3	3 in force
	The 3 laws behind AIR-DET-021 and PR.PS-02 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Law, Network Product and Service Security Duties, China
	RC.RP-06The end of incident recovery is declared based on criteria, and incident-related...	3	3	3 in force
	The 3 laws behind AIR-DET-021 and RC.RP-06 Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium National Cybersecurity Incident Reporting Measures, China Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan
	RC.CO-04Public updates on incident recovery are shared using approved methods and messaging	3	3	3 in force
	The 3 laws behind AIR-DET-021 and RC.CO-04 Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon Cybersecurity Law: Network and Information System Security Duty, Central African Republic Sécurité des systèmes d'information (dispositions communes), Gabon
	DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to...	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-021 and DE.CM-09 Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	GV.SC-05Requirements to address cybersecurity risks in supply chains are established,...	2	2	1 in force, 1 not yet in force
	The 2 laws behind AIR-DET-021 and GV.SC-05 AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA, Latvia
	ID.IM-02Improvements are identified from security tests and exercises, including those done in...	2	2	2 in force
	The 2 laws behind AIR-DET-021 and ID.IM-02 DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York Lag (2024:1278), DORA Supplementary Provisions, Sweden
	PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge...	2	2	2 in force
	The 2 laws behind AIR-DET-021 and PR.AT-01 Data Security Law, Data Security Protection Obligations, China Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
	PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	2	2	2 in force
	The 2 laws behind AIR-DET-021 and PR.IR-03 Sécurité des systèmes d'information (dispositions communes), Gabon ZEKom-2, Operator Security Measures (Articles 115 and 116), Slovenia
	RS.MA-03Incidents are categorized and prioritized	2	2	2 in force
	The 2 laws behind AIR-DET-021 and RS.MA-03 Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad, Cuba Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia

Not connected to the NIST CSF 2.0: 12 of FINOS AIGF's controls

Short of 2 laws

The same duties reach these and a NIST CSF 2.0 control, in fewer than 2 of the laws we track.

AIR-PREV-018 Agent Authority Least Privilege Framework: with PR.AA-05 and PR.DS-01 through Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda
AIR-PREV-023 Agentic System Credential Protection Framework: with PR.AA-05 and PR.DS-01 through Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data, Rwanda

No NIST CSF 2.0 control on the same duties

Laws reach these, but no duty that reaches one of them also reaches a NIST CSF 2.0 control.

AIR-DET-013 Providing Citations and Source Traceability for AI-Generated Information, 33 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

AIR-PREV-002 Data Filtering From External Knowledge Bases
AIR-PREV-003 User/App/Model Firewalling/Filtering
AIR-PREV-010 AI Model Version Pinning
AIR-PREV-019 Tool Chain Validation and Sanitization
AIR-PREV-022 Multi-Agent Isolation and Segmentation
AIR-PREV-025 Skill/Plugin Integrity and Governance
AIR-DET-009 AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring
AIR-DET-015 Using Large Language Models for Automated Evaluation (LLM-as-a-Judge)
AIR-DET-016 Preserving Source Data Access Controls in AI Systems

Lines of the scraping, news aggregation and communications laws we track were not read against the NIST CSF 2.0, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the FINOS AIGF through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws on	Read against the NIST CSF 2.0
AI	such lines on security, robustness, resilience, vulnerabilities and logs
scraping	not read
news aggregation	not read
privacy	such lines on breaches and incidents, security measures, encryption and pseudonymization, retention and disposal, and processor contracts
communications	not read
age assurance	every such line

Every duty line in the AI, privacy, age assurance and cybersecurity laws we track has been read against the framework for its subject.

The FINOS AI Governance Framework, mapped to the NIST Cybersecurity Framework

Short of 2 laws

No NIST CSF 2.0 control on the same duties

No law we track reaches these

How these connections are drawn

Sources and licenses