NIST CSF 2.0, GovernGV.OC-03

If you are not established in the Union but offer a covered service within it, designate a representative established in a Member State where you offer the service.

Where you are instead designated as an operator of essential services, apply the security rules the Premier ministre sets under Article 6 at your own expense, covering governance, protection, defence and resilience of your networks and systems.

Obtain a licence from the Cyber Security Authority before providing the cybersecurity service; the Authority acknowledges an application within fourteen days and decides it within thirty days.

A granted licence is valid for two years from the date it is granted; apply in writing for renewal not later than one month before it expires.

Once designated, register with the DTO and notify it of any change in ownership of the infrastructure or in the person or entity operating it within 30 days; furnish the DTO whatever information it requires by written notice to assess the infrastructure's security and cybersecurity measures; and report a material change to the infrastructure's design, configuration, security or operation to the DTO within 30 days of the change.

Comply with cybersecurity standards the DTO issues, submit to its periodic or ad hoc audits, inspections and penetration testing, and conduct and submit periodic cybersecurity assessments of the infrastructure's risk, vulnerability and preparedness.

Follow the detailed technical and organisational measures the Government's Cybersecurity Requirements Description sets out; if you are newly registered, you have 12 months from registration to implement the organisational measures and 24 months to implement the technical measures.

Notify the measures you take under this duty to the competent authority in the form, format and timeframe it sets by règlement or circulaire.

Notify the Department of Justice of a change of ownership or control of your designated critical information infrastructure no later than seven days after the change.

Report any change to your registration details to the competent ministry within 14 days of the change (Article 26).

Take the protective measures the national cybersecurity authority directs to prevent and neutralize the effects of a threat or breach affecting your clients' information systems.

Apply for registration of your ICT system in the Ministry's registry of priority and important ICT systems.

If your system, data, or traffic data is designated, meet the minimum standards, guidelines, rules, or procedures the Presidential Order prescribes, which section 7(2) requires to cover at least securing systems by default and logging system and user activity for audit, and permit the National Computer Security Incidence Response Team to audit and inspect the designated infrastructure at any time.

Where you also operate a service the Act designates a "critical basic service" (broadly: a large enterprise, above the medium-enterprise threshold, active in an Annex 1 sector other than public administration, or a qualified trust service, TLD registry, DNS service, or an at-least-medium-sized public electronic communications network or service), report that status to the Authority and expect a higher administrative-fine ceiling for the same duties.

As a designated Critical Information Infrastructure operator, meet the cybersecurity standards the National Communications Authority sets and comply with its incident reporting obligations; the located text does not state a reporting clock, a reporting threshold, or a penalty for a missed report.

If you provide cybersecurity services, or work as a cybersecurity professional, in Somalia, hold a current National Communications Authority licence or registration before operating.

Cooperate with the Authority's own efforts to protect communication networks against intrusion and vandalism, and discourage and prevent disruptive, unethical or malicious practices contrary to the Authority's policies and regulations (Sec. 88(1)).

If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.

Comply with the security and protection systems and procedures the Palestine Monetary Authority prescribes by instruction for a licensed payment-service or financial-technology company, apply them, and keep pace with their required development (Art. 8(2)(b)).

Register with the authority the government designates as soon as you can, per Cybersäkerhetsförordning (2025:1507) 5 §, and notify a change in what you registered within 14 days of the change.

Report to the competent authority for approval or recordation of the agency's assigned cyber security responsibility level, based on the sensitivity, volume and nature of the information the agency holds and the scale and nature of its information and communication systems.

Comply with the central competent authority's periodic or ad hoc audits of the maintenance plan's implementation; a designated critical infrastructure provider's audit results are forwarded to the Ministry of Digital Affairs.

Where the competent authority designates the enterprise's PSTN, in whole or in part, as critical telecommunications infrastructure, additionally draw up a critical telecommunications infrastructure protection plan before the competent authority's own deadline, submit it for the competent authority's evaluation before implementing it, and comply with the technical specifications for info-communications security evaluation the competent authority sets for that infrastructure.

Once designated, comply with the cybersecurity rules for protecting your essential infrastructure that a decree in Council of Ministers fixes under Article 3, and expect the Agence nationale de la cybersécurité (ANCy) to control, audit and inspect your compliance with them.

Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.

Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.

Comply with the Central Bank of Yemen's Bank Law, Banks Law, and the related regulations and instructions issued for electronic funds transfer operations.

Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.

Follow the Secretaria de Economia's Norma Mexicana for electronic commerce, which requires among other things reliable technical security mechanisms that guarantee the protection and confidentiality of the consumer's personal information and of the transaction itself.

If you accept a payment card in connection with a sale of goods or services to a Nevada resident, comply with the current version of the Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, by the compliance date the standard itself sets.

If you are a governmental agency, additionally comply, to the extent practicable, with the current version of the CIS Controls published by the Center for Internet Security or the corresponding National Institute of Standards and Technology standards, with respect to the collection, dissemination, and maintenance of those records.

Make the program reasonably conform to the current version of the NIST Cybersecurity Framework, NIST Special Publication 800-171, NIST Special Publications 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family, alone or in combination, or, if already regulated under it, reasonably conform to the entirety of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act, or HITECH, or comply with the PCI Data Security Standard together with one of the first group's frameworks.

If enacted as introduced, expect a duty to cooperate with public authorities on national cybersecurity matters where you operate as a private legal person in Peru, and expect the Comite de Ciberseguridad the bill creates to address you with guidelines on countering security breaches rather than a specific, clock-bound technical duty.

Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.

Comply with the cybersecurity requirements the State Security Service sets for protecting information systems and resources.

At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.