Law / Frameworks / NIST CSF 2.0 / Identify

NIST CSF 2.0, IdentifyID.IM-04

Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improvedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), ID.IM-04

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

25: laws
19: jurisdictions
0: with court rulings behind them
1: not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery..., 24 laws
NIST Privacy FrameworkPR.PO-P8 Response and recovery plans are tested., 6 laws
NIST Privacy FrameworkPR.PO-P3 Backups of information are conducted, maintained, and tested., 2 laws
FINOS AIGFAIR-DET-001 AI Data Leakage Prevention and Detection, 24 laws
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 23 laws
FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 23 laws
10 more in the FINOS AIGF
ENISA NIS2 guidance2.1 Risk management framework, 22 laws
ENISA NIS2 guidance3.1 Incident handling policy, 22 laws
ENISA NIS2 guidance4.1 Business continuity and disaster recovery plan, 22 laws
14 more in the ENISA NIS2 guidance

A law in force is unmarked; the rest wear their state: not yet in force

Sector security regimes

20 laws, 15 jurisdictions

Jurisdiction	Law	What it asks, as read here
Canada	OSFI Guideline B-13, Technology and Cyber Risk Management	Establish and maintain an enterprise disaster recovery program, and validate it against severe but plausible scenarios that test your backup and recovery capabilities and critical third-party technologies and integration points.
Czech Republic	Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives	Cover, among the matters Section 8b(1) of the Banks Act lists, the establishment and management of the networks and information systems you use, as the EU rule on digital operational resilience requires, and ICT business-continuity policies and ICT response and recovery plans that are introduced, managed and tested under DORA Article 11 (Section 8b(1)(f) and (h)).
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of your services in the event of technical failures or cessation of activity.
Estonia	Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification	Develop, manage and test ICT business-continuity policies and ICT response and recovery plans as part of your business continuity plan, in line with DORA Article 11 (Section 82^4(2)).
European Union	Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures	Lay down and maintain a business continuity and disaster recovery plan, carry out a business impact analysis, and maintain backup copies of data (points 4.1.1, 4.1.3 and 4.2.1).
European Union	DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework	Develop, document and implement an ICT-related incident policy that documents the incident management process, lists the relevant internal and external contacts, sets up mechanisms to support incident management, retains evidence relating to ICT-related incidents in a secure manner, and analyses significant or recurring incidents (Article 22). Set clear roles and responsibilities to detect and respond to ICT-related incidents and anomalous activities, collect, monitor and analyze logs, cyber threat information and incident notifications from ICT third-party service providers, implement tools that generate alerts at least for the ICT assets and information assets supporting critical or important functions, and log the date, time and type of each detected anomalous activity (Article 23). Include in the ICT business continuity policy the objectives, scope, timeframe, activation and deactivation criteria, governance and recovery objectives set out in Article 24(1). If you are a central counterparty, set a maximum recovery time for your critical functions of not longer than 2 hours. If you are a central securities depository, ensure a recovery time objective of not longer than 2 hours for your critical or important functions. If you are a trading venue, ensure that trading can be resumed within or close to 2 hours of a disruptive incident and that the maximum amount of data lost is close to zero (Article 24(2) to (4)). Test the plans on scenarios that simulate potential disruptions, including severe but plausible scenarios, include the ICT services provided by ICT third-party service providers where applicable, document the results, and report identified deficiencies to the management body (Article 25).
European Union	DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents)	Define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents (Article 17(1)).
European Union	DORA, Articles 5-16 (ICT Risk Management Framework)	Put in place a comprehensive ICT business continuity policy and ICT response and recovery plans, and conduct a business impact analysis of your exposures to severe business disruptions. Test the continuity and the response and recovery plans at least yearly and on substantive changes to systems supporting critical or important functions, and test your crisis communication plans. Keep readily accessible records of activities before and during disruption events. Unless you are a microenterprise, include cyber-attack and switchover scenarios in the tests, have a crisis management function, and report to your competent authority on request an estimate of the aggregated annual costs and losses caused by major ICT-related incidents (Article 11).
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Develop, test and maintain a risk-based contingency plan, including an offsite recovery center kept separate from your main site, and a regularly checked backup system.
Hungary	2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems	Keep effective business-continuity arrangements for any failure of your trading systems, including the ICT business continuity policy and plans and the ICT response and recovery plans set up under DORA Article 11, and fully test and monitor your systems so that they always meet Section 26/B and DORA Chapters II and IV (Section 26/B(2)).

Show the other 10 laws

Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Maintain a documented incident-response plan and a business-continuity plan covering incident logging, root-cause analysis, restoration of normal operation, and prevention of recurrence, and operate an active internal-control system consistent with this Act and any sector-specific law.
Ireland	European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms	As a credit institution or investment firm, have contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, established, managed and tested in accordance with Article 11 of the DORA Regulation (regulation 4).
Latvia	Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements	Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28). Review and update the cyber-risk-management and ICT-business-continuity plan at least once a year if you are an ICT critical infrastructure owner or an essential service provider holding a class A system, at least once in two years if you are another essential service provider, and at least once in three years if you are an important service provider (point 40).
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Draft a cyber-risk-management and ICT-business-continuity plan and give your staff regular training on carrying it out; the Cabinet sets the plan's required content (Article 28(2)), and Cabinet Regulation No. 397 of 25 June 2025, 'Minimālās kiberdrošības prasības', sets the minimum cybersecurity requirements your systems must meet.
Luxembourg	Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms	If you are a CRR institution in Luxembourg, keep adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, and establish, manage and test them in accordance with Article 11 of the DORA Regulation (Loi du 1er juillet 2024, Article 5).
New York	DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks	The Department says your incident response, business continuity and disaster recovery plans should be reasonably designed to address all types of cybersecurity events and other disruptions, including those relating to AI.
New York	New York Department of Financial Services Cybersecurity Regulation, Incident Response and Business Continuity Management	Establish written plans, as part of your cybersecurity program, that contain proactive measures to investigate and mitigate cybersecurity events and to ensure operational resilience, including incident response, business continuity and disaster recovery plans. Design the incident response plan to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of your information systems or the continuing functionality of any aspect of your business or operations, and address in it, for different types of events including ransomware: its goals; internal response processes; roles, responsibilities and levels of decision-making authority; external and internal communications and information sharing; remediation of identified weaknesses; documentation and reporting; recovery from backups; root cause analysis; and updating of the plan. +2 more
Slovenia	ZEKom-2, Operator Security Measures (Articles 115 and 116)	Treat the SUVI and SUNP as a business secret, review the emergency-communication part of the SUNP at least once a year, and obtain the prior approval of the competent bodies before adopting or changing it (Article 115(2) and (3)).
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Have the dedicated unit plan, manage and execute the information security system to control information security risk, supervise every unit's compliance with it, and build the mechanisms for cyber security protection, threat-intelligence assessment, and cyber security incident notification and response.
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.

Vulnerability and incident reporting

3 laws, 3 jurisdictions

Jurisdiction	Law	What it asks, as read here
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Establish a notification and response mechanism for a cyber security incident before one occurs.
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Create your own cybersecurity emergency response center, or join a public, sectoral or private one, and have it coordinate with the national emergency-response contact point.
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.

Breach notification

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Zimbabwe	Cyber and Data Protection Regulations 2024, security breach notification	Keep robust breach detection, investigation and internal reporting procedures in place, and keep a record of all personal data breaches.

Security baseline statutes

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Uzbekistan	Law on Cybersecurity, general cybersecurity duties on cybersecurity subjects	Maintain a functioning capability to respond to cybersecurity incidents, or use an outsourced provider with the State Security Service's authorization if you have none of your own.

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.