Law / Frameworks / NIST CSF 2.0 / Identify
NIST CSF 2.0, IdentifyID.RA-03
Internal and external threats to the organization are identified and recordedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), ID.RA-03
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 4
- laws
- 3
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Sector security regimes
3 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 European Union |
DORA, Articles 5-16 (ICT Risk Management Framework) |
Identify, classify and document all ICT supported business functions, the information assets and ICT assets that support them and their dependencies, and review that classification at least yearly. Identify all sources of ICT risk on a continuous basis and review the risk scenarios that affect you at least yearly. Map the assets you consider critical, and identify the processes that depend on ICT third-party service providers. Unless you are a microenterprise, perform a risk assessment on each major change in your network and information system infrastructure and at least yearly on all legacy ICT systems (Article 8). |
 New York |
DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks |
The Department says your risk assessment should address AI-related risks in your own use of AI, in the AI technologies your third-party service providers and vendors use, and in any vulnerabilities stemming from AI applications that could affect your information systems or nonpublic information. |
| New York |
DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation |
The Department says you should adopt a clear and repeatable methodology, although it does not require a specific one, that defines at a minimum reasonable estimates of the likelihood and impact of risks and applies consistent rating criteria; and it says you should evaluate both external and internal threats. |
Comprehensive regime
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 South Africa |
Protection of Personal Information Act 4 of 2013 (POPIA) |
Secure the integrity and confidentiality of personal information in your possession with appropriate technical and organisational measures, identify the foreseeable risks to it, and keep those measures updated as risks change. |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.