NIST CSF 2.0, GovernGV.OC-03

If you are a DNS provider, top-level-domain registry, domain-name-registration-service provider, or a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services, register with the relevant competent authority within 3 months of first falling within the Act's scope, stating your name, address, sector and sub-sector, contact details, and the EU member states where you provide services. Other essential and important entities register within 2 weeks of first falling within scope. Anyone already in scope when the Act commenced had to register by 1 October 2025.

Take all technical and organizational measures necessary to secure your network and services at a level adapted to the existing risk, and comply with the technical security prescriptions the national cybersecurity authority issues.

Give the cybersecurity authority confidential access, on request, to the arrangements you have made to secure your network, and submit your network to a security and integrity inspection the authority conducts or commissions.

Hold a conformity certificate the national cybersecurity authority issues before hosting digital health data, if your activity is making available and maintaining the physical site, the physical or virtual infrastructure, or an application-hosting platform for a health-data information system, administering or operating such a system, or backing up health data.

Comply with the requirements of Regulation (EU) 2022/2554, including by using and managing network and information systems as the Regulation provides (Credit Institutions Act Section 82^4(1)).

Within 12 months after your Article 24(6) notification, and every three years thereafter, give your competent authority a report listing the controls selected for your entity-level risk mitigation plan with the implementation status of each, an estimate of the risk to each Union-wide high-impact or critical-impact process, and your critical ICT service providers for critical-impact processes (Article 27).

If you are a high-impact entity, apply the minimum cybersecurity controls within your high-impact perimeter, and if you are a critical-impact entity, apply the advanced cybersecurity controls within your critical-impact perimeter, within 12 months after the controls are approved or updated (Articles 28(2) and (3) and 29(6)).

Submit the report on the review of the ICT risk management framework in a searchable electronic format and include the information that Article 27(2) lists (Article 27).

When the testing ends and reports and remediation plans are agreed, give the designated authority a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT was conducted in accordance with the requirements, and notify your competent authority of the attestation you receive, the summary and the remediation plans (Article 26(6) and (7)).

If you are part of a group, designate one legal person as the coordination point for adequate representation and communication with the Lead Overseer, and notify the financial entities to which you provide services of your designation as critical (Article 31(4) and (5)).

If you are established in a third country, establish a subsidiary in the Union within the 12 months following your designation, because financial entities may use your services only if you have, and notify the Lead Overseer of any changes to the structure of the management of that subsidiary (Article 31(12) and (13)).

If you operate an online marketplace, online search engine or social networking services platform, are not established in the Union, and offer it within the Union, designate a representative in the Union, established in one of the Member States where you offer the service; you then fall under the jurisdiction of the Member State where the representative is established.

Report problems with a dedicated interface to your national competent authority without delay, whether you are the account servicing payment service provider or a provider referred to in Article 30(1) (Article 33(3)).

If you are a financial entity under DORA Article 2(2) supervised by Finanssivalvonta, meet the ICT risk-management duty in DORA Article 16 (Act 878/2008, section 38, first paragraph, item 12).

Meet DORA's duties on ICT risk management (Articles 5 to 14), ICT-related incident management, classification and reporting (Articles 17 to 19), digital operational resilience testing (Articles 24 to 27) and management of ICT third-party risk (Articles 28 to 30) (section 40, second paragraph, item 13).

As a registrar, notify the Finnish Transport and Communications Agency of your name, contact details, EU establishments, IP address ranges and the EU Member States where you offer services, and report changes to those details within two weeks (three months for establishment details) (section 172 b).

Where you are instead designated as an operator of essential services, apply the security rules the Premier ministre sets under Article 6 at your own expense, covering governance, protection, defence and resilience of your networks and systems.

In that committee text, where you are an essential or important entity that provides DNS, domain-name registry, cloud computing, data-centre, content-delivery, managed or managed security services, an online marketplace, an online search engine, a social-networking platform or a trust service, implement the technical and methodological requirements set by Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, and you may rely on qualified service providers during an inspection to show your compliance with some or all of the objectives.

Obtain a licence from the Cyber Security Authority before providing the cybersecurity service; the Authority acknowledges an application within fourteen days and decides it within thirty days.

A granted licence is valid for two years from the date it is granted; apply in writing for renewal not later than one month before it expires.

Notify the Supervisory Authority, and the supervisory authority of the seat of each trading venue where you are a member or participant, that you engage in algorithmic trading (Section 26/B(3)).

If you are a financial entity in Ireland that falls under the DORA Regulation, comply with it and with these Regulations; credit unions are outside both until 17 January 2028 (regulations 2 and 3).

Stop conduct that breaches the DORA Regulation when the Central Bank orders you to cease and desist, and do not repeat it (regulation 6(4)(a)).

If you are a financial entity supervised by Banca d'Italia, Consob, IVASS or COVIP, comply with the DORA Regulation and with the provisions those authorities issue to implement it and the decree (Legislative Decree 23/2025, Articles 3 and 9).

If you are a financial intermediary or Bancoposta, comply with the obligations the decree places on you, which Banca d'Italia supervises (Article 3(3)).

Comply with cybersecurity standards the DTO issues, submit to its periodic or ad hoc audits, inspections and penetration testing, and conduct and submit periodic cybersecurity assessments of the infrastructure's risk, vulnerability and preparedness.

Comply with any order the DTO, a Sectoral CERT, the Minister or your sector's regulatory authority makes to take preventative, mitigating or remedial action, and tell the DTO where you cannot meet an obligation under this framework for financial, legal or technical reasons, which lets the Director grant an exception or modify a prescribed standard.

If you are a financial market participant listed in Article 4 of the Law (for example a credit institution, payment institution, electronic money institution, investment firm, insurance or reinsurance undertaking, trading venue or crypto-asset service provider), meet the digital operational resilience requirements of Regulation (EU) 2022/2554 (DORA); if you are one of the Article 5 entities, meet DORA's simplified framework.

Follow the detailed technical and organisational measures the Government's Cybersecurity Requirements Description sets out; if you are newly registered, you have 12 months from registration to implement the requirements and 24 months to implement the technical requirements the Description names.

If you apply for radio frequencies for electronic communications in Lithuania, in a tender, an auction or on direct request, give the Communications Regulatory Authority information on the manufacturers, suppliers and maintenance and support providers of the equipment, devices and software you plan to use that appear on the list set by the Minister of National Defence (Article 69(2)).

If you are a person supervised by the CSSF or the CAA under the DORA Regulation, stop conduct that breaches it when ordered and do not repeat it, and do not obstruct the authorities' supervisory powers or give them inaccurate or incomplete information (Articles 20-24 and 20-23).

Notify the measures you take under this duty to the competent authority in the form, format and timeframe it sets by règlement or circulaire.

If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA), comply with DORA as implemented in Malta by these regulations; DORA prevails if the two differ (regulations 1(3) and 3).

Give the Malta Financial Services Authority the documents and data it asks for, attend on-site inspections and investigations and answer its questions, and carry out the corrective and remedial measures it requires (regulation 7).

Register on the national self-registration mechanism of the CIP Department with your name, the CSIRT providing monitoring services to you, your contact details and IP ranges, your sector and the Member States where you provide services, and notify it of any change without delay and within two weeks (article 7(4) and (5)); a DNS service provider, top-level domain name registry, domain name registration service, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider also submits the article 24(1) registry information by the prescribed date and notifies changes within three months.

Notify the Department of Justice of a change of ownership or control of your designated critical information infrastructure no later than seven days after the change.

Provide, within the reasonable period the Secretary of Justice specifies in an order, information on the design, configuration, and security of your critical information infrastructure and of any interconnected computer or computer system under your control, and comply with any written direction the Secretary issues to you to manage a cybersecurity threat or risk.

Report any change to your registration details to the competent ministry within 14 days of the change (Article 26).

Take the protective measures the national cybersecurity authority directs to prevent and neutralize the effects of a threat or breach affecting your clients' information systems.

If you are an essential or important entity under the Cyberbeveiligingswet, take at least the measures of Articles 6 to 18 of the Cyberbeveiligingsbesluit to implement Article 21 of the Act (Article 5). A DNS service provider, top-level domain registry, cloud-computing, data-centre, content-delivery-network, managed-service or managed-security-service provider, online marketplace, online search engine, social-networking platform or trust service provider answers to Implementing Regulation (EU) 2024/2690 instead (Article 4).

Make all documentation and information relevant to your cybersecurity program, including any provisions you adopt from an affiliate's program, available to the Superintendent on request.

If you are a financial entity within Article 2(2) of Regulation (EU) 2022/2554 (DORA) and not excluded by Article 2(3), give the Komisja Nadzoru Finansowego the information, documents and explanations it requires within the scope of DORA, and submit to its inspections of your DORA compliance (Articles 18za to 18zc).

Notify the Komisja Nadzoru Finansowego when you join or leave cyber-threat information-sharing arrangements under DORA Article 45 (Article 18zj).

If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA) established in Portugal, including an insurance or reinsurance undertaking or a pension fund management entity, comply with DORA as this Act executes it; the former Caixas Económicas that Article 2(2) lists are outside DORA and the Act.

If you are an entity in a sector of Annex 1 or 2 of Ordonanța de urgență nr. 155/2024, use the NIS2@RO platform or the NIS2@RO tool to evaluate whether you are an essential or important entity and to generate the notification form for registration (Articles 2 and 3).

Complete the notification form's six sections: general data, specific data (including size, services, contact points and your network address ranges), specific situations, attached documents, preliminary assessment and entity representation (Articles 4 and 5).

If your own impact or probability values differ from the sector base values, send DNSC an analysis with a sound reason for each value you ask to change (Article 5(3)).

Apply for registration of your ICT system in the Ministry's registry of priority and important ICT systems.

If your system, data, or traffic data is designated, meet the minimum standards, guidelines, rules, or procedures the Presidential Order prescribes, which section 7(2) requires to cover at least securing systems by default and logging system and user activity for audit, and permit the National Computer Security Incidence Response Team to audit and inspect the designated infrastructure at any time.

If you are an essential service operator in rail or road transport under Act 69/2018 on cyber security, apply the sector security measures in Annex 1 (rail) or Annex 2 (road) of this decree as part of your security measures (§ 1).

If you operate a mobile communications network that you supply to critical infrastructure operators, essential service providers, government bodies or holders of key parts of the state security system, also observe the additional security requirements and restrictions of Article 116.

If the Law is enacted, a designated Critical Information Infrastructure operator would have to meet the cybersecurity standards the National Communications Authority sets and comply with its incident reporting obligations; the Authority's description does not state a reporting clock, a reporting threshold, or a penalty for a missed report.

If the Law is enacted, you would need a current National Communications Authority licence or registration before providing cybersecurity services, or working as a cybersecurity professional, in Somalia.

Cooperate with the Authority's own efforts to protect communication networks against intrusion and vandalism, and discourage and prevent disruptive, unethical or malicious practices contrary to the Authority's policies and regulations (Sec. 88(1)).

If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.

Meet the ICT risk-management obligations of Chapter II of Regulation (EU) 2022/2554, reading the Regulation's references to financial entities as references to you (Article 4(1)).

Comply with the security and protection systems and procedures the Palestine Monetary Authority prescribes by instruction for a licensed payment-service or financial-technology company, apply them, and keep pace with their required development (Art. 8(2)(b)).

If you are an operator within a sector that the Cybersäkerhetslag (2025:1506) covers, send your registration notification under chapter 2, section 2 of the Act to the single point of contact (section 5 of the ordinance).

Register with the authority the government designates as soon as you can, per Cybersäkerhetsförordning (2025:1507) 5 §, and notify a change in what you registered within 14 days of the change.

If you are a financial entity within Regulation (EU) 2022/2554 (DORA) supervised in Sweden, comply with DORA as the Act supplements it; the Finansinspektionen is your competent authority and supervises compliance (chapter 1, section 2, and chapter 3, section 1).

If the Finansinspektionen designates you to carry out threat-led penetration tests under DORA Article 26, carry them out as often as it decides, and give the Riksbank the information it requests for its oversight and coordination of the tests (chapter 2, sections 1 and 4).

Report to the competent authority for approval or recordation of the agency's assigned cyber security responsibility level, based on the sensitivity, volume and nature of the information the agency holds and the scale and nature of its information and communication systems.

Where the competent authority designates the enterprise's PSTN, in whole or in part, as critical telecommunications infrastructure, additionally draw up a critical telecommunications infrastructure protection plan before the competent authority's own deadline, submit it for the competent authority's evaluation before implementing it, and comply with the technical specifications for info-communications security evaluation the competent authority sets for that infrastructure.

Once designated, comply with the cybersecurity rules for protecting your essential infrastructure that a decree in Council of Ministers fixes under Article 3, and expect the Agence nationale de la cybersécurité (ANCy) to control, audit and inspect your compliance with them.

Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.

Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.

If you operate a data center service, give the designated competent authority your name, proper address, the names of your directors or partners and up-to-date contact details within three months of being deemed designated or of notice of your designation, and tell it of any change within seven days of the change taking effect (new regulation 8ZA).

If you provide a relevant digital service, have regard to any relevant guidance from the Information Commission when carrying out your duties under regulation 12(1) (new regulation 12(2A)); notify the Information Commission of any change to your registered details within seven days of the change taking effect, those details now including the names of your directors or partners and which relevant digital services you provide (regulation 14, as amended); and, if your principal office is outside the United Kingdom, nominate a representative in the United Kingdom within three months (regulation 14A, as amended).

Do not knowingly alter, destroy, mutilate, conceal, cover up, falsify, or make a false entry in a record, document or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of such a matter or case, or in relation to or in contemplation of one.

Comply with the Central Bank of Yemen's Bank Law, Banks Law, and the related regulations and instructions issued for electronic funds transfer operations.

Follow the Secretaria de Economia's Norma Mexicana for electronic commerce, which requires among other things reliable technical security mechanisms that guarantee the protection and confidentiality of the consumer's personal information and of the transaction itself.

If you accept a payment card in connection with a sale of goods or services to a Nevada resident, comply with the current version of the Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, by the compliance date the standard itself sets.

If you are a governmental agency, additionally comply, to the extent practicable, with the current version of the CIS Controls published by the Center for Internet Security or the corresponding National Institute of Standards and Technology standards, with respect to the collection, dissemination, and maintenance of those records.

Make the program reasonably conform to the current version of the NIST Cybersecurity Framework, NIST Special Publication 800-171, NIST Special Publications 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family, alone or in combination, or, if already regulated under it, reasonably conform to the entirety of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act, or HITECH, or comply with the PCI Data Security Standard together with one of the first group's frameworks.

Cooperate with public entities to maintain national cybersecurity where you operate as a private legal person in Peru (article 8).

Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.

Comply with the cybersecurity requirements the State Security Service sets for protecting information systems and resources.

At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.

Do not put a Class A system or application into production use until it is certified and registered, or after its information-security assessment certificate has expired (section 81).

For a Class B system, give a written statement that, properly installed, maintained and used, it meets the essential requirements for its purpose (section 85).

As a manufacturer, supply each such device with a declaration of conformity to the technical security specifications set by ministerial decision under Article 113, paragraph 12α, together with instructions for use and security information that end users can easily understand, keep the declaration, and give it to the National Cybersecurity Authority or the competent response team on request (Article 33(1) to (3)).

As a manufacturer that learns a device does not comply with those specifications, inform the importer, the National Cybersecurity Authority and the competent response team immediately (Article 33(5)).

If you make available on the Irish market, or put into service, radio equipment in a class or category covered by a Commission delegated act under Article 3(3) of the Radio Equipment Directive, make it comply with the Article 3(3)(a) to (i) essential requirements that the delegated act requires (S.I. No. 14 of 2026, regulation 4(5)).

Make radio equipment available on the market, or put it into service, only if it complies with the Regulations, when properly installed, maintained and used in accordance with its intended purpose (regulation 4(3) and (4)).