LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / NIST CSF 2.0 / Govern

NIST CSF 2.0, GovernGV.PO-02

Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational missionNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), GV.PO-02

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

4
laws
4
jurisdictions
0
with court rulings behind them
0
not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

  • El Salvador
  • European Union
  • New York
  • Utah

Sector security regimes

2 laws, 2 jurisdictions
JurisdictionLawWhat it asks, as read here
European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures

Maintain a policy on the security of network and information systems that your management bodies approve and review at least annually and when significant incidents or significant changes to operations or risks occur, and have at least one person report directly to your management bodies on network and information system security (Annex points 1.1.1(k), 1.1.2 and 1.2.3).
New York DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation

The Department says your written policies and procedures must be approved at least annually by a senior officer or your senior governing body, that, where applicable, you must designate a chief information security officer or a senior officer to oversee the risk assessment process, and that the chief information security officer must report material cybersecurity risks to the senior governing body (23 NYCRR 500.4(b)(3)); it adds that Part 500 does not require formal approval of risk assessments from a board of directors or senior management.

Breach notification

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
El Salvador Ley para la Protección de Datos Personales, personal data breach notification

Within that same seventy two hours, begin a thorough review of the breach's magnitude, adopt corrective and preventive measures, and update your security policies to prevent a recurrence.

Security baseline statutes

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
Utah Cybersecurity Affirmative Defense Act

Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.