Law / Frameworks / NIST CSF 2.0 / Protect
NIST CSF 2.0, ProtectPR.PS-01
Configuration management practices are established and appliedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), PR.PS-01
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 6
- laws
- 5
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST Privacy FrameworkPR.PT-P2 The principle of least functionality is incorporated by configuring systems..., 2 laws
- FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 2 laws
- FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 2 laws
- FINOS AIGFAIR-PREV-012 Role-Based Access Control for AI Data, 2 laws
- 4 more in the FINOS AIGF
- ENISA NIS2 guidance2.1 Risk management framework, 2 laws
- ENISA NIS2 guidance3.1 Incident handling policy, 2 laws
- ENISA NIS2 guidance4.1 Business continuity and disaster recovery plan, 2 laws
- 5 more in the ENISA NIS2 guidance
Product security requirements
3 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Brazil |
Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment) |
Do not hard-code credentials or cryptographic keys in the device's software or firmware source code, encrypt or hash any password, key, or credential you store or transmit, implement inactive-session timeouts, ship with unused communication ports and services disabled, and let the user disable non-essential communication features. |
 European Union |
In Vitro Diagnostic Medical Devices Regulation, Software Development, Information Security and IT Security Information Requirements |
Set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorized access, necessary to run the software as intended (section 16.4). |
| European Union |
Medical Devices Regulation, Software Development, Information Security and IT Security Information Requirements |
Set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorized access, necessary to run the software as intended (section 17.4). |
Sector security regimes
3 laws, 3 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Canada |
OSFI Guideline B-13, Technology and Cyber Risk Management |
Implement approved, risk-based security configuration baselines for technology assets and security defense tools, including those provided by third parties. |
 Netherlands |
Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details |
Apply a policy for the risks of acquiring software, hardware or services, apply secure-development processes across all development phases where they apply, and apply maintenance processes that cover at least configuration management and change management (Article 11). |
 New York |
New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management |
Disable or securely configure all protocols that permit remote control of devices. |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.