NIST Cybersecurity Framework

Where your product or service collects user information, disclose that collection and obtain consent, and where personal information is involved, also follow this Law's and the Personal Information Protection Law's personal-information rules, already this jurisdiction's privacy row.

Do not misuse the mark or label of a European cybersecurity certification scheme, a European cybersecurity certificate or an EU declaration of conformity, and do not forge or alter any of them (Section 61(1)(a) and (b)).

Make functionality updates available to the user at the latest 6 months after the corresponding release (Annex II, point (6)(d) or (5)(d)).

For a smartphone or a slate tablet, where a functionality update you provide shows a negative impact on device performance, modify the released operating system to ensure at least the same performance as before the update, within a reasonable period of time, free of charge and without causing significant inconvenience to the end-user, unless the end-user gave explicit consent to the negative impact before the update (Annex II, Part B point (6)(f), Part D point (5)(f)).

Provide, where the EHR system is designed to store or intermediate personal electronic health data, an interface enabling access to that data in the European electronic health record exchange format and the ability to receive it in that format; where it is designed to provide access to such data, be able to receive it in that format; and where it includes a functionality for entering structured data, enable entry with sufficient granularity to provide the entered data in that format (Annex II, points 2.1 to 2.4).

Do not include in the harmonised software components features that prohibit, restrict or place an undue burden on authorized access, sharing or use of personal electronic health data for permitted purposes, or on authorized export of that data for the purpose of replacing the EHR system by another product (Annex II, points 2.5 and 2.6).

It reaches you if you are a manufacturer that places on the EU market a product intended for consumers, or likely to be used by them, including a product interconnected to other items: ensure it is a safe product, designed and manufactured in accordance with the general safety requirement (Articles 3, point (1), 5 and 9(1)).

Take into account, where required by the nature of the product, its evolving, learning and predictive functionalities (point (h)) and the effect of non-embedded items that are meant to determine, change or complete the way the product works (point (c)).

Where the software is intended to be used in combination with mobile computing platforms, design and manufacture it taking into account the specific features of the mobile platform and the external factors related to their use (section 16.3).

Include those minimum requirements in the instructions for use of a device that incorporates electronic programmable systems, including software, or of software that is a device in itself (section 20.4.1, point (ah)).

Where the software is intended to be used in combination with mobile computing platforms, design and manufacture it taking into account the specific features of the mobile platform and the external factors related to their use (section 17.3).

Include those minimum requirements in the instructions for use of a device that incorporates electronic programmable systems, including software, or of software that is a device in itself (section 23.4, point (ab)).

If you design or run a national cybersecurity certification scheme for ICT products, services or processes in Hungary, make the scheme meet the Section 38 security objectives, including protection of data across the life cycle, identification and documentation of known dependencies and vulnerabilities, security by default and by design, up-to-date software and hardware, and mechanisms for secure updating (Section 38).

Maintain an operational management center for your critical infrastructure on Burundian national territory.

If you are an account servicing payment service provider, give account information service providers the same information from designated payment accounts and associated payment transactions that you make available to the user when the user requests it directly, excluding sensitive payment data, give payment initiation service providers immediately after receipt of the payment order the same information on the initiation and execution of the transaction, confirm immediately upon request in a simple yes or no format whether the amount necessary for a payment transaction is available, and notify the other provider of the reason for an unexpected event or error (Article 36(1) and (2)). If you are an account information service provider, prevent access to information other than from designated payment accounts and associated payment transactions in accordance with the user's explicit consent, and access the information only when the user is actively requesting it or otherwise no more than four times in a 24-hour period unless the account servicing payment service provider agrees a higher frequency with you, with the user's consent (Article 36(3) and (5)). If you are a payment initiation service provider, give the account servicing payment service provider the same information as requested from the user when initiating the payment transaction directly (Article 36(4)).

Collect and maintain domain registration data that includes the data NIS 2 Directive Article 28(2) lists, and keep and publish policies and procedures that ensure the database is accurate and correct (section 172 c).

Publish the registration data that is not personal data without undue delay after a domain is registered, and answer a lawful and duly reasoned request for access to the other registration data without undue delay and within 72 hours of receiving it (section 172 d).

Present the audit result to the consumer in a legible, clear and comprehensible form, with a colour-coded presentation, in the conditions a joint ministerial order fixes.

Inform Latvijas Banka of all material changes, including any circumstance that may adversely affect your further operation, and of changes in the information you gave it (Article 9).

Pay the annual fee that funds the Finansinspektionen's work under DORA and the Act (chapter 1, section 3).

Include the certifications as an exhibit to each annual and quarterly report, in the form the report's exhibit requirements specify, with each certifying officer signing personally: a certification may not be signed on an officer's behalf under a power of attorney or other form of confirming authority.

Have each signing officer certify that he or she has reviewed the report; that, based on his or her knowledge, the report contains no untrue statement of a material fact and omits no material fact necessary to make the statements, in light of the circumstances under which they were made, not misleading; and that the financial statements and other financial information in the report fairly present in all material respects the financial condition and results of operations of the issuer.

Maintain internal control over financial reporting: a process designed by or under the supervision of your principal executive and principal financial officers, and effected by your board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles, including policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect your transactions and dispositions of assets.

Maintain disclosure controls and procedures, and have management evaluate their effectiveness, with the participation of your principal executive and principal financial officers, as of the end of each fiscal quarter (each fiscal year for a foreign private issuer; for a registered investment company, within the 90-day period before the filing date of each report requiring certification under Rule 30a-2).

Obtain the data provider's written consent, by letter, fax, or email, before collecting their sensitive personal data or information, let them decline or withdraw that consent, publish a privacy policy on your website, and designate a Grievance Officer who must resolve a complaint within one month.

If your own service is itself a data centre, a virtual private server provider, a cloud service provider, a virtual private network service, or a virtual asset (crypto) service provider, a narrower and heavier duty also applies: register and retain specified customer KYC information and financial-transaction records for five years. That narrower bound-party class is not one this profile's declared activities can identify on their own, so confirm applicability directly against the text if this describes your service.