Law / Frameworks / NIST CSF 2.0 / Recover
NIST CSF 2.0, RecoverRC.CO-04
Public updates on incident recovery are shared using approved methods and messagingNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), RC.CO-04
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 4
- laws
- 4
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 3 laws
- ENISA NIS2 guidance3.5 Incident response, 3 laws
- ENISA NIS2 guidance6.10 Vulnerability handling and disclosure, 3 laws
Security baseline statutes
3 laws, 3 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Cameroon |
Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) |
Inform your users of the dangers of using your network or service, the specific security risks it faces, and the technical means available to secure their communications. |
 Central African Republic |
Cybersecurity Law: Network and Information System Security Duty |
Inform your users of the dangers of using your network or information system, the particular security-violation risks involved, and the technical means available to secure their communications or restrict access to certain services. |
 Gabon |
Sécurité des systèmes d'information (dispositions communes) |
If your activity is to offer users access to an information system, inform them of the danger of using an unsecured system, the need for a parental-control device, the particular risks of a security breach, and the existence of a technical means to restrict access to certain services, and offer them at least one such means. |
Vulnerability and incident reporting
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Kosovo |
Law No. 08/L-173 on Cyber Security, Incident Reporting and Enforcement |
As an operator of essential services, notify the Agency for Cyber Security immediately, and no later than 24 hours after becoming aware, of a cyber incident with a significant impact on system security or service continuity, and notify affected persons or the public within a reasonable time where individual notice is impractical. |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.