Law / Frameworks / NIST CSF 2.0 / Respond
NIST CSF 2.0, RespondRS.AN-08
An incident's magnitude is estimated and validatedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), RS.AN-08
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 3
- laws
- 2
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Vulnerability and incident reporting
2 laws, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 European Union |
Commission Implementing Regulation (EU) 2024/2690, Significant Incidents under NIS2 Article 23 |
When you calculate the number of users impacted by an incident under Articles 7 and 9 to 14, consider the number of customers that have a contract with you granting access to your network and information systems or services, and the number of natural and legal persons associated with business customers that use them (Article 3(3)). |
| European Union |
DORA Technical Standards on the Classification of ICT-Related Incidents and Cyber Threats and the Materiality Thresholds for Major Incidents |
Count the affected clients, financial counterparts and transactions as Article 1 requires and estimate the numbers from comparable reference periods where the actual figures cannot be determined, measure the duration and the service downtime of the incident as Article 3 requires, assess data losses against the availability, authenticity, integrity and confidentiality of data as Article 5 requires, and add up the direct and indirect costs and losses listed in Article 7(1), without accounting for financial recoveries (Articles 1, 3, 5 and 7). |
Breach notification
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 El Salvador |
Ley para la Protección de Datos Personales, personal data breach notification |
Within that same seventy two hours, begin a thorough review of the breach's magnitude, adopt corrective and preventive measures, and update your security policies to prevent a recurrence. |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.