Law / Frameworks / NIST CSF 2.0 / Identify

NIST CSF 2.0, IdentifyID.AM-05

Assets are prioritized based on classification, criticality, resources, and impact on the missionNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), ID.AM-05

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

7: laws
6: jurisdictions
0: with court rulings behind them
1: not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkID.IM-P1 Systems/products/services that process data are inventoried., 3 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 3 laws
FINOS AIGFAIR-PREV-006 Data Quality & Classification/Sensitivity, 3 laws
FINOS AIGFAIR-PREV-024 Human-in-the-Loop Action Approval Gate, 3 laws
3 more in the FINOS AIGF
ENISA NIS2 guidance1.1 Policy on the security of network and information systems, 3 laws
ENISA NIS2 guidance1.2 Roles, responsibilities and authorities, 3 laws
ENISA NIS2 guidance2.2 Compliance monitoring, 3 laws
2 more in the ENISA NIS2 guidance

A law in force is unmarked; the rest wear their state: not yet in force

Sector security regimes

6 laws, 5 jurisdictions

Jurisdiction	Law	What it asks, as read here
Canada	OSFI Guideline B-13, Technology and Cyber Risk Management	Maintain an updated inventory of the technology assets that support business processes or functions, which may include third-party assets that store or process your information or provide critical business services, and classify the assets by criticality.
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 8 months	Formulate and implement your own cybersecurity program and cybersecurity framework consistent with the mandatory national cybersecurity frameworks the Administration issues, classify and protect your critical assets to the Administration's standard, create the cybersecurity organizational structure the national framework calls for, and establish and manage a center responsible for monitoring, reporting, and responding to cyberattacks.
Hungary	Cybersecurity Act, Risk-Management Measures	Survey and register every electronic information system, central service and supporting system you use, appoint or designate the person responsible for the security of those systems, classify them into a security category, and apply protective measures proportionate to their risk.
Latvia	Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA	Identify, classify and document your critical and important functions, the information and ICT assets that support them and their dependencies (points 10 and 11), and carry out and document an ICT risk assessment at least once a year (point 13).
Latvia	Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements	Update the catalogue of ICT resources and information systems within one month of a change, and assign each information system a confidentiality, integrity and availability security class of A, B or C (points 31 and 32).
Taiwan	Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management	Report to the competent authority for approval or recordation of the agency's assigned cyber security responsibility level, based on the sensitivity, volume and nature of the information the agency holds and the scale and nature of its information and communication systems.

Security baseline statutes

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Determine which of the five statutory levels your information system falls into, based on the damage an incident or a cybersecurity-law violation could cause to lawful rights and interests, public interests, social order and safety, or national security.

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.