Law / Frameworks / NIST CSF 2.0 / Govern
NIST CSF 2.0, GovernGV.RR-04
Cybersecurity is included in human resources practicesNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), GV.RR-04
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 7
- laws
- 7
- jurisdictions
- 0
- with court rulings behind them
- 1
- not yet in force
- 1
- proposed, not law
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST Privacy FrameworkPR.PO-P9 Privacy procedures are included in human resources practices (e.g.,..., 5 laws
- NIST Privacy FrameworkID.DE-P3 Contracts with data processing ecosystem parties are used to implement..., 4 laws
A law in force is unmarked; the rest wear their state: not yet in force proposed
Comprehensive regime
5 laws, 5 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Albania |
Law No. 124/2024 On the Protection of Personal Data |
Keep personal data confidential wherever an employee or processor has access to it for professional reasons, bind that confidentiality into every processor contract and employment contract, and continue it after the contract or employment ends. |
 Gabon |
Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023 |
Keep processing confidential, bind everyone who processes the data under your authority to a signed written undertaking, and impose the same security and confidentiality guarantees on any processor by contract. |
 Morocco |
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data |
Bind any processor you use to security guarantees equivalent to your own by contract, and hold anyone with authorized access to personal data, including after they leave that role, to professional secrecy. |
 Suriname |
Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed |
Take appropriate technical and organizational measures so you can demonstrate compliance with this law on request, and require anyone with access to personal data under your authority to keep it confidential or be bound by a legal duty of confidentiality. |
 Togo |
Loi n° 2019-014, protection des données à caractère personnel |
Choose a processor that offers sufficient guarantees, govern the engagement with a written contract confining the processor to your instructions, and keep processing confidential under the authority of persons who have signed a written confidentiality undertaking. |
Sector security regimes
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Ethiopia |
Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from , in 8 months |
Employ cybersecurity professionals who hold a certification the Administration issues or recognizes, ensure the security of the supply chain of the technology products you use, obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system acquired by purchase, donation, development, or any other means, and ensure that any employee or officer with access to your critical assets holds a security clearance from the relevant government body. |
 Latvia |
Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures |
Since , do not give privileged access to your ICT systems to a staff member convicted of an intentional crime linked to terrorism, against the state, the administrative order or property, or in the economy, unless they are rehabilitated or the conviction has been cleared; if such a person is convicted and not cleared, decide individually on their employment after weighing the security risk (Article 26.1). |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.