Law / Frameworks / NIST CSF 2.0 / Identify
NIST CSF 2.0, IdentifyID.RA-07
Changes and exceptions are managed, assessed for risk impact, recorded, and trackedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), ID.RA-07
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 5
- laws
- 4
- jurisdictions
- 0
- with court rulings behind them
- 1
- not yet in force
A law in force is unmarked; the rest wear their state: not yet in force
Sector security regimes
4 laws, 3 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Austria |
Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria |
Where you cannot meet a Section 2 requirement, temporarily or because of your size, implement compensating measures suited to that requirement's purpose, document them with reasons and review their effectiveness at least once a year (Section 4). |
 European Union |
Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures |
Where the Annex applies a requirement where appropriate, where applicable or to the extent feasible and you consider it not appropriate, not applicable or not feasible for you to apply it, document your reasoning in a comprehensible manner (Article 2(2)). |
 New York |
New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information |
If you determine that encrypting nonpublic information at rest is infeasible, secure it instead with effective alternative compensating controls that your Chief Information Security Officer has reviewed and approved in writing, and have that officer review the feasibility of encryption and the effectiveness of the compensating controls at least annually. |
| New York |
New York Department of Financial Services Cybersecurity Regulation, Multi-Factor Authentication |
If you have a Chief Information Security Officer and rely on compensating controls in place of multi-factor authentication, have that officer approve in writing the use of reasonably equivalent or more secure compensating controls, and review those controls periodically and at least annually. |
AI sector rules
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Canada |
OSFI Guideline E-23, Model Risk Management (2027) from , in 6 months |
You should deploy models in an environment with quality and change control processes, test that the model operates as expected in production, document deployment procedures, and assess related risks such as cybersecurity risk and infrastructure vulnerabilities before deployment (see OSFI Guidelines B-13 and E-21). |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.