Law / Frameworks / NIST CSF 2.0 / Respond
NIST CSF 2.0, RespondRS.MI-01
Incidents are containedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), RS.MI-01
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 7
- laws
- 7
- jurisdictions
- 0
- with court rulings behind them
- 2
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery..., 4 laws
- FINOS AIGFAIR-DET-004 AI System Observability, 5 laws
- FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 5 laws
- ENISA NIS2 guidance3.1 Incident handling policy, 5 laws
- ENISA NIS2 guidance3.4 Event assessment and classification, 5 laws
- ENISA NIS2 guidance3.5 Incident response, 5 laws
- 2 more in the ENISA NIS2 guidance
A law in force is unmarked; the rest wear their state: not yet in force
Vulnerability and incident reporting
6 laws, 6 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 China |
Data Security Law, Risk Monitoring and Incident Reporting Duty |
On an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness. |
 Democratic Republic of the Congo |
Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty |
Comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption. |
 Ethiopia |
Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT from , in 8 months |
Notify the National Computer Emergency Response Center of a cyber incident within 48 hours of becoming aware of it, using the system the Administration establishes, and implement the mandatory recommendations or directions the Center provides within the time it sets. |
 Kiribati |
Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident from a date not yet set |
When you are the subject of a cybersecurity incident or threat of one, gather information about it, assess the risk to your critical infrastructure, customers, suppliers and other stakeholders, take appropriate preventative, mitigating and remedial measures to limit that risk, and report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after you detect it, in the form or manner the CERT prescribes. |
 Latvia |
Nacionālās kiberdrošības likums, Incident Notification |
Immediately take all action necessary to contain a detected cyber incident, immediately inform the competent cyber incident prevention institution (for most private-sector and civilian public-sector subjects, the Institute of Mathematics and Computer Science of the University of Latvia), and follow its instructions. |
 Tunisia |
Cybersecurity Incident Reporting and Emergency Response |
Immediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders. |
Sector security regimes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 European Union |
Cyber Solidarity Act, European Cybersecurity Alert System, Cybersecurity Emergency Mechanism and Incident Review Mechanism |
A user of the EU Cybersecurity Reserve takes all appropriate measures to mitigate the effects of the incident for which it requests support (Article 15(2)). |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.