Law / Frameworks / NIST CSF 2.0 / Identify
NIST CSF 2.0, IdentifyID.AM-07
Inventories of data and corresponding metadata for designated data types are maintainedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), ID.AM-07
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 6
- laws
- 6
- jurisdictions
- 1
- with court rulings behind it
- 0
- not yet in force
- 1
- proposed, not law
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST Privacy FrameworkID.IM-P4 Data actions of the systems/products/services are inventoried., 4 laws
- FINOS AIGFAIR-PREV-005 System Acceptance Testing, 6 laws
- FINOS AIGFAIR-PREV-006 Data Quality & Classification/Sensitivity, 6 laws
- FINOS AIGFAIR-PREV-024 Human-in-the-Loop Action Approval Gate, 6 laws
- 3 more in the FINOS AIGF
- ENISA NIS2 guidance1.1 Policy on the security of network and information systems, 2 laws
- ENISA NIS2 guidance1.2 Roles, responsibilities and authorities, 2 laws
- ENISA NIS2 guidance2.2 Compliance monitoring, 2 laws
- 2 more in the ENISA NIS2 guidance
A law in force is unmarked; the rest wear their state: proposed
Comprehensive regime
4 laws, 4 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Benin |
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel) |
Keep a written record of your processing activities, covering the purposes, the categories of data subjects and data, the recipients, retention periods, and security measures, and make it available to the Autorité on request. |
 European Union |
General Data Protection Regulation, Records of Processing Activities (Article 30) |
In the controller's record, include where possible the envisaged time limits for erasure of the different categories of data and a general description of the technical and organizational security measures referred to in Article 32(1) (Article 30(1), points (f) and (g)). If you are a processor or the processor's representative, maintain a record of all categories of processing activities carried out on behalf of a controller, containing the name and contact details of the processor and of each controller, the categories of processing carried out on behalf of each controller, where applicable the transfers to a third country or international organization, and where possible a general description of the technical and organizational security measures referred to in Article 32(1) (Article 30(2)). |
 Suriname |
Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed |
Keep a written or electronic register of your processing activities, covering the categories of data, recipients, retention periods, and security measures, and notify it to the Commissioner for Personal Data Protection, updating the notification whenever needed and at least once a year. |
 Vatican City |
General Regulation on the Protection of Personal Data for Vatican City State |
Where this Regulation binds your processing, identify the Data Controller as the Governorate, represented by the General Secretary, and put in place organizational and technical security measures suitable to protect the personal data you process. Appoint a Representative in writing where the Regulation calls for one, and record the activity in the Register of treatment activities. |
Sector security regimes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 New York |
DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks |
The Department states that you are required to dispose of nonpublic information that is no longer necessary for business operations or other legitimate business purposes, including nonpublic information used for AI purposes, and says that, although not required until , you should maintain and update data inventories and should identify all information systems that use or rely on AI and maintain an inventory of them. |
Security baseline statutes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Kuwait |
Data Classification Policy |
Classify all digital data you process, store, modify, or transfer into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, Highly Sensitive Data) and label it accordingly. Maintain a unified data catalog with metadata describing your classified data, and review the classification periodically. |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.