LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / NIST CSF 2.0 / Identify

NIST CSF 2.0, IdentifyID.AM-04

Inventories of services provided by suppliers are maintainedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), ID.AM-04

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

2
laws
2
jurisdictions
0
with court rulings behind them
0
not yet in force
  • European Union
  • New York

Sector security regimes

2 laws, 2 jurisdictions
JurisdictionLawWhat it asks, as read here
European Union DORA, Articles 28-30 (ICT Third-Party Risk Management)

Maintain and update a register of all your ICT services contracts, distinguishing those supporting a critical or important function, report on it at least yearly to your competent authority, and produce it in full on the authority's request.
New York DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models

The Department says you should develop and maintain dependency maps, coordinate with your critical third-party service providers and material downstream providers to address significant vulnerabilities and operational risks, and monitor and validate third-party code and engage with critical providers, including to communicate the specific responsibilities of each side.

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.