GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including... 1.1 Policy on the security of network and information systems
61
41
55 in force, 4 not yet in force, 2 proposed
The 61 laws behind GV.OC-03 and 1.1
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraSecurity Standards for Smart Devices , AustraliaCybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification , AustriaDORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties , AustriaNetz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria , AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLaw of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) , CameroonOSFI Guideline B-10, Third-Party Risk Management , Canadaand 51 more, every one in the free file .
1.2 Roles, responsibilities and authorities
61
41
55 in force, 4 not yet in force, 2 proposed
The 61 laws behind GV.OC-03 and 1.2
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraSecurity Standards for Smart Devices , AustraliaCybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification , AustriaDORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties , AustriaNetz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria , AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLaw of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) , CameroonOSFI Guideline B-10, Third-Party Risk Management , Canadaand 51 more, every one in the free file .
2.2 Compliance monitoring
61
41
55 in force, 4 not yet in force, 2 proposed
The 61 laws behind GV.OC-03 and 2.2
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraSecurity Standards for Smart Devices , AustraliaCybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification , AustriaDORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties , AustriaNetz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria , AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLaw of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) , CameroonOSFI Guideline B-10, Third-Party Risk Management , Canadaand 51 more, every one in the free file .
3.2 Monitoring and logging
61
41
55 in force, 4 not yet in force, 2 proposed
The 61 laws behind GV.OC-03 and 3.2
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraSecurity Standards for Smart Devices , AustraliaCybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification , AustriaDORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties , AustriaNetz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria , AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLaw of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) , CameroonOSFI Guideline B-10, Third-Party Risk Management , Canadaand 51 more, every one in the free file .
12.4 Asset inventory
61
41
55 in force, 4 not yet in force, 2 proposed
The 61 laws behind GV.OC-03 and 12.4
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraSecurity Standards for Smart Devices , AustraliaCybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification , AustriaDORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties , AustriaNetz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria , AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLaw of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) , CameroonOSFI Guideline B-10, Third-Party Risk Management , Canadaand 51 more, every one in the free file .
3.1 Incident handling policy
25
24
22 in force, 1 not yet in force, 2 proposed
The 25 laws behind GV.OC-03 and 3.1
Law No. 25/2024, On Cybersecurity , AlbaniaOSFI Guideline B-10, Third-Party Risk Management , CanadaCybersecurity Law: Mandatory Security Audit Regime , Central African RepublicCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaDigital Code, Book II: Electronic Communications Network and Service Security , DjiboutiDORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats , European UnionDORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers) , European UnionLaki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars , FinlandCybersecurity Act, Duty to Report Cybersecurity Incident , Ghanaand 15 more, every one in the free file .
3.4 Event assessment and classification
23
22
20 in force, 1 not yet in force, 2 proposed
The 23 laws behind GV.OC-03 and 3.4
Law No. 25/2024, On Cybersecurity , AlbaniaOSFI Guideline B-10, Third-Party Risk Management , CanadaCybersecurity Law: Mandatory Security Audit Regime , Central African RepublicCybersecurity Law, Network Product and Service Security Duties , ChinaDigital Code, Book II: Electronic Communications Network and Service Security , DjiboutiDORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats , European UnionDORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers) , European UnionLaki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars , FinlandCybersecurity Act, Duty to Report Cybersecurity Incident , GhanaDeterminazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification , Italyand 13 more, every one in the free file .
3.5 Incident response
23
22
20 in force, 1 not yet in force, 2 proposed
The 23 laws behind GV.OC-03 and 3.5
Law No. 25/2024, On Cybersecurity , AlbaniaOSFI Guideline B-10, Third-Party Risk Management , CanadaCybersecurity Law: Mandatory Security Audit Regime , Central African RepublicCybersecurity Law, Network Product and Service Security Duties , ChinaDigital Code, Book II: Electronic Communications Network and Service Security , DjiboutiDORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats , European UnionDORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers) , European UnionLaki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars , FinlandCybersecurity Act, Duty to Report Cybersecurity Incident , GhanaDeterminazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification , Italyand 13 more, every one in the free file .
3.6 Post-incident reviews
23
22
20 in force, 1 not yet in force, 2 proposed
The 23 laws behind GV.OC-03 and 3.6
Law No. 25/2024, On Cybersecurity , AlbaniaOSFI Guideline B-10, Third-Party Risk Management , CanadaCybersecurity Law: Mandatory Security Audit Regime , Central African RepublicCybersecurity Law, Network Product and Service Security Duties , ChinaDigital Code, Book II: Electronic Communications Network and Service Security , DjiboutiDORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats , European UnionDORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers) , European UnionLaki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars , FinlandCybersecurity Act, Duty to Report Cybersecurity Incident , GhanaDeterminazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification , Italyand 13 more, every one in the free file .
4.3 Crisis management
23
22
20 in force, 1 not yet in force, 2 proposed
The 23 laws behind GV.OC-03 and 4.3
Law No. 25/2024, On Cybersecurity , AlbaniaOSFI Guideline B-10, Third-Party Risk Management , CanadaCybersecurity Law: Mandatory Security Audit Regime , Central African RepublicCybersecurity Law, Network Product and Service Security Duties , ChinaDigital Code, Book II: Electronic Communications Network and Service Security , DjiboutiDORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats , European UnionDORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers) , European UnionLaki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars , FinlandCybersecurity Act, Duty to Report Cybersecurity Incident , GhanaDeterminazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification , Italyand 13 more, every one in the free file .
2.1 Risk management framework
3
3
3 in force
The 3 laws behind GV.OC-03 and 2.1
4.1 Business continuity and disaster recovery plan
3
3
3 in force
The 3 laws behind GV.OC-03 and 4.1
6.2 Secure development life cycle
3
3
3 in force
The 3 laws behind GV.OC-03 and 6.2
6.5 Security testing
3
3
3 in force
The 3 laws behind GV.OC-03 and 6.5
6.10 Vulnerability handling and disclosure
3
3
3 in force
The 3 laws behind GV.OC-03 and 6.10
9.1 Cryptography
3
3
3 in force
The 3 laws behind GV.OC-03 and 9.1
11.2 Management of access rights
3
3
3 in force
The 3 laws behind GV.OC-03 and 11.2
GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and... 1.1 Policy on the security of network and information systems
31
26
28 in force, 1 not yet in force, 2 proposed
The 31 laws behind GV.RR-01 and 1.1
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , Estoniaand 21 more, every one in the free file .
1.2 Roles, responsibilities and authorities
31
26
28 in force, 1 not yet in force, 2 proposed
The 31 laws behind GV.RR-01 and 1.2
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , Estoniaand 21 more, every one in the free file .
2.2 Compliance monitoring
31
26
28 in force, 1 not yet in force, 2 proposed
The 31 laws behind GV.RR-01 and 2.2
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , Estoniaand 21 more, every one in the free file .
3.2 Monitoring and logging
31
26
28 in force, 1 not yet in force, 2 proposed
The 31 laws behind GV.RR-01 and 3.2
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , Estoniaand 21 more, every one in the free file .
12.4 Asset inventory
31
26
28 in force, 1 not yet in force, 2 proposed
The 31 laws behind GV.RR-01 and 12.4
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , Estoniaand 21 more, every one in the free file .
GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are... 1.1 Policy on the security of network and information systems
24
18
22 in force, 1 not yet in force, 1 proposed
The 24 laws behind GV.RR-02 and 1.1
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraData Security Law, Data Security Protection Obligations , ChinaCommission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR) , European UnionCommission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLaw 5160/2024, Cybersecurity Risk-Management Measures and Governance , GreeceBRH Circulaire 126, Information Security Rules for Financial Institutions , HaitiCybersecurity Act, Risk-Management Measures , Hungaryand 14 more, every one in the free file .
1.2 Roles, responsibilities and authorities
24
18
22 in force, 1 not yet in force, 1 proposed
The 24 laws behind GV.RR-02 and 1.2
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraData Security Law, Data Security Protection Obligations , ChinaCommission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR) , European UnionCommission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLaw 5160/2024, Cybersecurity Risk-Management Measures and Governance , GreeceBRH Circulaire 126, Information Security Rules for Financial Institutions , HaitiCybersecurity Act, Risk-Management Measures , Hungaryand 14 more, every one in the free file .
2.2 Compliance monitoring
24
18
22 in force, 1 not yet in force, 1 proposed
The 24 laws behind GV.RR-02 and 2.2
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraData Security Law, Data Security Protection Obligations , ChinaCommission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR) , European UnionCommission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLaw 5160/2024, Cybersecurity Risk-Management Measures and Governance , GreeceBRH Circulaire 126, Information Security Rules for Financial Institutions , HaitiCybersecurity Act, Risk-Management Measures , Hungaryand 14 more, every one in the free file .
3.2 Monitoring and logging
24
18
22 in force, 1 not yet in force, 1 proposed
The 24 laws behind GV.RR-02 and 3.2
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraData Security Law, Data Security Protection Obligations , ChinaCommission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR) , European UnionCommission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLaw 5160/2024, Cybersecurity Risk-Management Measures and Governance , GreeceBRH Circulaire 126, Information Security Rules for Financial Institutions , HaitiCybersecurity Act, Risk-Management Measures , Hungaryand 14 more, every one in the free file .
12.4 Asset inventory
24
18
22 in force, 1 not yet in force, 1 proposed
The 24 laws behind GV.RR-02 and 12.4
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Cybersecurity Risk-Management Obligations , AndorraData Security Law, Data Security Protection Obligations , ChinaCommission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR) , European UnionCommission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLaw 5160/2024, Cybersecurity Risk-Management Measures and Governance , GreeceBRH Circulaire 126, Information Security Rules for Financial Institutions , HaitiCybersecurity Act, Risk-Management Measures , Hungaryand 14 more, every one in the free file .
3.1 Incident handling policy
3
3
3 in force
The 3 laws behind GV.RR-02 and 3.1
2.1 Risk management framework
2
2
2 in force
The 2 laws behind GV.RR-02 and 2.1
3.4 Event assessment and classification
2
2
2 in force
The 2 laws behind GV.RR-02 and 3.4
3.5 Incident response
2
2
2 in force
The 2 laws behind GV.RR-02 and 3.5
3.6 Post-incident reviews
2
2
2 in force
The 2 laws behind GV.RR-02 and 3.6
4.1 Business continuity and disaster recovery plan
2
2
2 in force
The 2 laws behind GV.RR-02 and 4.1
4.3 Crisis management
2
2
2 in force
The 2 laws behind GV.RR-02 and 4.3
6.2 Secure development life cycle
2
2
2 in force
The 2 laws behind GV.RR-02 and 6.2
6.5 Security testing
2
2
2 in force
The 2 laws behind GV.RR-02 and 6.5
6.10 Vulnerability handling and disclosure
2
2
2 in force
The 2 laws behind GV.RR-02 and 6.10
9.1 Cryptography
2
2
2 in force
The 2 laws behind GV.RR-02 and 9.1
11.2 Management of access rights
2
2
2 in force
The 2 laws behind GV.RR-02 and 11.2
GV.PO-01 Policy for managing cybersecurity risks is established based on organizational... 1.1 Policy on the security of network and information systems
60
40
56 in force, 4 not yet in force
The 60 laws behind GV.PO-01 and 1.1
Llei 22/2022, Cybersecurity Risk-Management Obligations , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaPrudential supervision of banks: the Office's objects and the Superintendent's directions to a bank , CanadaData Security Law, Data Security Protection Obligations , ChinaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures , Czech RepublicDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech Republicand 50 more, every one in the free file .
1.2 Roles, responsibilities and authorities
60
40
56 in force, 4 not yet in force
The 60 laws behind GV.PO-01 and 1.2
Llei 22/2022, Cybersecurity Risk-Management Obligations , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaPrudential supervision of banks: the Office's objects and the Superintendent's directions to a bank , CanadaData Security Law, Data Security Protection Obligations , ChinaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures , Czech RepublicDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech Republicand 50 more, every one in the free file .
2.2 Compliance monitoring
60
40
56 in force, 4 not yet in force
The 60 laws behind GV.PO-01 and 2.2
Llei 22/2022, Cybersecurity Risk-Management Obligations , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaPrudential supervision of banks: the Office's objects and the Superintendent's directions to a bank , CanadaData Security Law, Data Security Protection Obligations , ChinaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures , Czech RepublicDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech Republicand 50 more, every one in the free file .
3.2 Monitoring and logging
60
40
56 in force, 4 not yet in force
The 60 laws behind GV.PO-01 and 3.2
Llei 22/2022, Cybersecurity Risk-Management Obligations , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaPrudential supervision of banks: the Office's objects and the Superintendent's directions to a bank , CanadaData Security Law, Data Security Protection Obligations , ChinaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures , Czech RepublicDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech Republicand 50 more, every one in the free file .
12.4 Asset inventory
60
40
56 in force, 4 not yet in force
The 60 laws behind GV.PO-01 and 12.4
Llei 22/2022, Cybersecurity Risk-Management Obligations , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance , BelgiumCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaPrudential supervision of banks: the Office's objects and the Superintendent's directions to a bank , CanadaData Security Law, Data Security Protection Obligations , ChinaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures , Czech RepublicDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech Republicand 50 more, every one in the free file .
2.1 Risk management framework
5
5
4 in force, 1 not yet in force
The 5 laws behind GV.PO-01 and 2.1
Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements , LatviaDFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation , New YorkIdentity Theft Protection Act of 2015, risk-based information security program , Rhode IslandCybersecurity Law, Information System Classification and Protection Measures , Vietnam
3.1 Incident handling policy
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 3.1
4.1 Business continuity and disaster recovery plan
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 4.1
6.2 Secure development life cycle
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 6.2
6.5 Security testing
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 6.5
6.10 Vulnerability handling and disclosure
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 6.10
9.1 Cryptography
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 9.1
11.2 Management of access rights
4
4
3 in force, 1 not yet in force
The 4 laws behind GV.PO-01 and 11.2
ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on... 1.1 Policy on the security of network and information systems
3
3
2 in force, 1 not yet in force
The 3 laws behind ID.AM-05 and 1.1
1.2 Roles, responsibilities and authorities
3
3
2 in force, 1 not yet in force
The 3 laws behind ID.AM-05 and 1.2
2.2 Compliance monitoring
3
3
2 in force, 1 not yet in force
The 3 laws behind ID.AM-05 and 2.2
3.2 Monitoring and logging
3
3
2 in force, 1 not yet in force
The 3 laws behind ID.AM-05 and 3.2
12.4 Asset inventory
3
3
2 in force, 1 not yet in force
The 3 laws behind ID.AM-05 and 12.4
ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles 1.1 Policy on the security of network and information systems
10
10
10 in force
The 10 laws behind ID.AM-08 and 1.1
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaFlorida Information Protection Act, data security and disposal duty , FloridaDestruction of Personal Information Records , HawaiiKansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information , KansasData Classification Policy , KuwaitIdentity Theft Protection Act, destruction of data no longer needed , MichiganImpediment of Identity Theft, record destruction duty , MontanaIdentity Theft Protection Act, destruction of personal information records , North CarolinaSarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer , United StatesDocument Safe Destruction Act, safe destruction of records containing personal information , Vermont
3.2 Monitoring and logging
10
10
10 in force
The 10 laws behind ID.AM-08 and 3.2
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaFlorida Information Protection Act, data security and disposal duty , FloridaDestruction of Personal Information Records , HawaiiKansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information , KansasData Classification Policy , KuwaitIdentity Theft Protection Act, destruction of data no longer needed , MichiganImpediment of Identity Theft, record destruction duty , MontanaIdentity Theft Protection Act, destruction of personal information records , North CarolinaSarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer , United StatesDocument Safe Destruction Act, safe destruction of records containing personal information , Vermont
4.2 Backup and redundancy management
10
10
10 in force
The 10 laws behind ID.AM-08 and 4.2
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaFlorida Information Protection Act, data security and disposal duty , FloridaDestruction of Personal Information Records , HawaiiKansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information , KansasData Classification Policy , KuwaitIdentity Theft Protection Act, destruction of data no longer needed , MichiganImpediment of Identity Theft, record destruction duty , MontanaIdentity Theft Protection Act, destruction of personal information records , North CarolinaSarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer , United StatesDocument Safe Destruction Act, safe destruction of records containing personal information , Vermont
12.2 Handling of assets
10
10
10 in force
The 10 laws behind ID.AM-08 and 12.2
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaFlorida Information Protection Act, data security and disposal duty , FloridaDestruction of Personal Information Records , HawaiiKansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information , KansasData Classification Policy , KuwaitIdentity Theft Protection Act, destruction of data no longer needed , MichiganImpediment of Identity Theft, record destruction duty , MontanaIdentity Theft Protection Act, destruction of personal information records , North CarolinaSarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer , United StatesDocument Safe Destruction Act, safe destruction of records containing personal information , Vermont
2.1 Risk management framework
3
3
3 in force
The 3 laws behind ID.AM-08 and 2.1
3.1 Incident handling policy
3
3
3 in force
The 3 laws behind ID.AM-08 and 3.1
4.1 Business continuity and disaster recovery plan
3
3
3 in force
The 3 laws behind ID.AM-08 and 4.1
6.2 Secure development life cycle
3
3
3 in force
The 3 laws behind ID.AM-08 and 6.2
6.5 Security testing
3
3
3 in force
The 3 laws behind ID.AM-08 and 6.5
6.10 Vulnerability handling and disclosure
3
3
3 in force
The 3 laws behind ID.AM-08 and 6.10
9.1 Cryptography
3
3
3 in force
The 3 laws behind ID.AM-08 and 9.1
11.2 Management of access rights
3
3
3 in force
The 3 laws behind ID.AM-08 and 11.2
ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded 2.1 Risk management framework
6
4
6 in force
The 6 laws behind ID.RA-01 and 2.1
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
3.1 Incident handling policy
6
4
6 in force
The 6 laws behind ID.RA-01 and 3.1
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
4.1 Business continuity and disaster recovery plan
6
4
6 in force
The 6 laws behind ID.RA-01 and 4.1
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
6.2 Secure development life cycle
6
4
6 in force
The 6 laws behind ID.RA-01 and 6.2
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
6.5 Security testing
6
4
6 in force
The 6 laws behind ID.RA-01 and 6.5
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
6.10 Vulnerability handling and disclosure
6
4
6 in force
The 6 laws behind ID.RA-01 and 6.10
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
9.1 Cryptography
6
4
6 in force
The 6 laws behind ID.RA-01 and 9.1
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
11.2 Management of access rights
6
4
6 in force
The 6 laws behind ID.RA-01 and 11.2
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) , European UnionEUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New York
ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent... 1.1 Policy on the security of network and information systems
5
5
4 in force, 1 not yet in force
The 5 laws behind ID.RA-05 and 1.1
1.2 Roles, responsibilities and authorities
5
5
4 in force, 1 not yet in force
The 5 laws behind ID.RA-05 and 1.2
2.2 Compliance monitoring
5
5
4 in force, 1 not yet in force
The 5 laws behind ID.RA-05 and 2.2
3.2 Monitoring and logging
5
5
4 in force, 1 not yet in force
The 5 laws behind ID.RA-05 and 3.2
12.4 Asset inventory
5
5
4 in force, 1 not yet in force
The 5 laws behind ID.RA-05 and 12.4
ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated 1.1 Policy on the security of network and information systems
3
3
1 in force, 2 proposed
The 3 laws behind ID.RA-06 and 1.1
1.2 Roles, responsibilities and authorities
3
3
1 in force, 2 proposed
The 3 laws behind ID.RA-06 and 1.2
2.2 Compliance monitoring
3
3
1 in force, 2 proposed
The 3 laws behind ID.RA-06 and 2.2
3.1 Incident handling policy
3
3
3 in force
The 3 laws behind ID.RA-06 and 3.1
3.2 Monitoring and logging
3
3
1 in force, 2 proposed
The 3 laws behind ID.RA-06 and 3.2
12.4 Asset inventory
3
3
1 in force, 2 proposed
The 3 laws behind ID.RA-06 and 12.4
2.1 Risk management framework
2
2
2 in force
The 2 laws behind ID.RA-06 and 2.1
3.4 Event assessment and classification
2
2
2 in force
The 2 laws behind ID.RA-06 and 3.4
3.5 Incident response
2
2
2 in force
The 2 laws behind ID.RA-06 and 3.5
3.6 Post-incident reviews
2
2
2 in force
The 2 laws behind ID.RA-06 and 3.6
4.3 Crisis management
2
2
2 in force
The 2 laws behind ID.RA-06 and 4.3
ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established 2.1 Risk management framework
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 2.1
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
3.1 Incident handling policy
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 3.1
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
4.1 Business continuity and disaster recovery plan
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 4.1
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
6.2 Secure development life cycle
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 6.2
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
6.5 Security testing
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 6.5
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
6.10 Vulnerability handling and disclosure
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 6.10
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
9.1 Cryptography
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 9.1
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
11.2 Management of access rights
8
7
7 in force, 1 not yet in force
The 8 laws behind ID.RA-08 and 11.2
Security Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate , European UnionLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices , GreeceLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties , ItalyNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation , LatviaProduct Security Requirements for Connectable Products , United Kingdom
ID.IM-01 Improvements are identified from evaluations 2.1 Risk management framework
3
3
3 in force
The 3 laws behind ID.IM-01 and 2.1
2.3 Independent review of information and network security
3
3
3 in force
The 3 laws behind ID.IM-01 and 2.3
1.1 Policy on the security of network and information systems
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 1.1
1.2 Roles, responsibilities and authorities
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 1.2
2.2 Compliance monitoring
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 2.2
3.1 Incident handling policy
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 3.1
3.2 Monitoring and logging
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 3.2
3.4 Event assessment and classification
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 3.4
3.5 Incident response
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 3.5
3.6 Post-incident reviews
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 3.6
4.3 Crisis management
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 4.3
12.4 Asset inventory
2
2
1 in force, 1 not yet in force
The 2 laws behind ID.IM-01 and 12.4
ID.IM-02 Improvements are identified from security tests and exercises, including those done in... 1.1 Policy on the security of network and information systems
2
2
2 in force
The 2 laws behind ID.IM-02 and 1.1
1.2 Roles, responsibilities and authorities
2
2
2 in force
The 2 laws behind ID.IM-02 and 1.2
2.2 Compliance monitoring
2
2
2 in force
The 2 laws behind ID.IM-02 and 2.2
3.2 Monitoring and logging
2
2
2 in force
The 2 laws behind ID.IM-02 and 3.2
12.4 Asset inventory
2
2
2 in force
The 2 laws behind ID.IM-02 and 12.4
2.1 Risk management framework
2
1
2 in force
The 2 laws behind ID.IM-02 and 2.1
3.1 Incident handling policy
2
1
2 in force
The 2 laws behind ID.IM-02 and 3.1
4.1 Business continuity and disaster recovery plan
2
1
2 in force
The 2 laws behind ID.IM-02 and 4.1
6.2 Secure development life cycle
2
1
2 in force
The 2 laws behind ID.IM-02 and 6.2
6.5 Security testing
2
1
2 in force
The 2 laws behind ID.IM-02 and 6.5
6.10 Vulnerability handling and disclosure
2
1
2 in force
The 2 laws behind ID.IM-02 and 6.10
9.1 Cryptography
2
1
2 in force
The 2 laws behind ID.IM-02 and 9.1
11.2 Management of access rights
2
1
2 in force
The 2 laws behind ID.IM-02 and 11.2
ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are... 2.1 Risk management framework
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 2.1
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
3.1 Incident handling policy
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 3.1
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
4.1 Business continuity and disaster recovery plan
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 4.1
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
6.2 Secure development life cycle
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 6.2
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
6.5 Security testing
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 6.5
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
6.10 Vulnerability handling and disclosure
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 6.10
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
9.1 Cryptography
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 9.1
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
11.2 Management of access rights
24
18
23 in force, 1 not yet in force
The 24 laws behind ID.IM-04 and 11.2
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives , Czech RepublicDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification , EstoniaDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionBRH Circulaire 126, Information Security Rules for Financial Institutions , Haitiand 14 more, every one in the free file .
3.4 Event assessment and classification
7
6
6 in force, 1 not yet in force
The 7 laws behind ID.IM-04 and 3.4
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaMinistru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements , LatviaBank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit , TaiwanCyber Security Management Act, Cyber Security Incident Reporting , TaiwanCybersecurity Act 2025, Critical Infrastructure Operator Obligations , Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response , TunisiaCybersecurity Law, Incident Response and Reporting Duties , Vietnam
3.5 Incident response
7
6
6 in force, 1 not yet in force
The 7 laws behind ID.IM-04 and 3.5
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaMinistru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements , LatviaBank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit , TaiwanCyber Security Management Act, Cyber Security Incident Reporting , TaiwanCybersecurity Act 2025, Critical Infrastructure Operator Obligations , Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response , TunisiaCybersecurity Law, Incident Response and Reporting Duties , Vietnam
3.6 Post-incident reviews
7
6
6 in force, 1 not yet in force
The 7 laws behind ID.IM-04 and 3.6
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaMinistru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements , LatviaBank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit , TaiwanCyber Security Management Act, Cyber Security Incident Reporting , TaiwanCybersecurity Act 2025, Critical Infrastructure Operator Obligations , Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response , TunisiaCybersecurity Law, Incident Response and Reporting Duties , Vietnam
4.3 Crisis management
7
6
6 in force, 1 not yet in force
The 7 laws behind ID.IM-04 and 4.3
Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaMinistru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements , LatviaBank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit , TaiwanCyber Security Management Act, Cyber Security Incident Reporting , TaiwanCybersecurity Act 2025, Critical Infrastructure Operator Obligations , Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response , TunisiaCybersecurity Law, Incident Response and Reporting Duties , Vietnam
1.1 Policy on the security of network and information systems
2
2
2 in force
The 2 laws behind ID.IM-04 and 1.1
1.2 Roles, responsibilities and authorities
2
2
2 in force
The 2 laws behind ID.IM-04 and 1.2
2.2 Compliance monitoring
2
2
2 in force
The 2 laws behind ID.IM-04 and 2.2
3.2 Monitoring and logging
2
2
2 in force
The 2 laws behind ID.IM-04 and 3.2
12.4 Asset inventory
2
2
2 in force
The 2 laws behind ID.IM-04 and 12.4
PR.AA-03 Users, services, and hardware are authenticated 2.1 Risk management framework
4
3
4 in force
The 4 laws behind PR.AA-03 and 2.1
3.1 Incident handling policy
4
3
4 in force
The 4 laws behind PR.AA-03 and 3.1
4.1 Business continuity and disaster recovery plan
4
3
4 in force
The 4 laws behind PR.AA-03 and 4.1
6.2 Secure development life cycle
4
3
4 in force
The 4 laws behind PR.AA-03 and 6.2
6.5 Security testing
4
3
4 in force
The 4 laws behind PR.AA-03 and 6.5
6.10 Vulnerability handling and disclosure
4
3
4 in force
The 4 laws behind PR.AA-03 and 6.10
9.1 Cryptography
4
3
4 in force
The 4 laws behind PR.AA-03 and 9.1
11.2 Management of access rights
4
3
4 in force
The 4 laws behind PR.AA-03 and 11.2
PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed,... 2.1 Risk management framework
9
5
9 in force
The 9 laws behind PR.AA-05 and 2.1
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
3.1 Incident handling policy
9
5
9 in force
The 9 laws behind PR.AA-05 and 3.1
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
4.1 Business continuity and disaster recovery plan
9
5
9 in force
The 9 laws behind PR.AA-05 and 4.1
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
6.2 Secure development life cycle
9
5
9 in force
The 9 laws behind PR.AA-05 and 6.2
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
6.5 Security testing
9
5
9 in force
The 9 laws behind PR.AA-05 and 6.5
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
6.10 Vulnerability handling and disclosure
9
5
9 in force
The 9 laws behind PR.AA-05 and 6.10
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
9.1 Cryptography
9
5
9 in force
The 9 laws behind PR.AA-05 and 9.1
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
11.2 Management of access rights
9
5
9 in force
The 9 laws behind PR.AA-05 and 11.2
Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure , BelgiumData Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European UnionDORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsDFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks , New YorkDFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment , New YorkNew York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistan
PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge... 1.1 Policy on the security of network and information systems
2
2
2 in force
The 2 laws behind PR.AT-01 and 1.1
1.2 Roles, responsibilities and authorities
2
2
2 in force
The 2 laws behind PR.AT-01 and 1.2
2.2 Compliance monitoring
2
2
2 in force
The 2 laws behind PR.AT-01 and 2.2
3.2 Monitoring and logging
2
2
2 in force
The 2 laws behind PR.AT-01 and 3.2
12.4 Asset inventory
2
2
2 in force
The 2 laws behind PR.AT-01 and 12.4
PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they... 1.1 Policy on the security of network and information systems
24
21
23 in force, 1 proposed
The 24 laws behind PR.AT-02 and 1.1
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , EstoniaDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionNIS2 Directive, Cybersecurity Risk-Management Measures , European Unionand 14 more, every one in the free file .
1.2 Roles, responsibilities and authorities
24
21
23 in force, 1 proposed
The 24 laws behind PR.AT-02 and 1.2
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , EstoniaDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionNIS2 Directive, Cybersecurity Risk-Management Measures , European Unionand 14 more, every one in the free file .
2.2 Compliance monitoring
24
21
23 in force, 1 proposed
The 24 laws behind PR.AT-02 and 2.2
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , EstoniaDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionNIS2 Directive, Cybersecurity Risk-Management Measures , European Unionand 14 more, every one in the free file .
3.2 Monitoring and logging
24
21
23 in force, 1 proposed
The 24 laws behind PR.AT-02 and 3.2
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , EstoniaDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionNIS2 Directive, Cybersecurity Risk-Management Measures , European Unionand 14 more, every one in the free file .
12.4 Asset inventory
24
21
23 in force, 1 proposed
The 24 laws behind PR.AT-02 and 12.4
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures , AustriaCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS) , BulgariaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance , CroatiaSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance , CyprusDecree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.) , Czech RepublicAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures , DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration , DenmarkKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties , EstoniaDORA, Articles 5-16 (ICT Risk Management Framework) , European UnionNIS2 Directive, Cybersecurity Risk-Management Measures , European Unionand 14 more, every one in the free file .
PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected 2.1 Risk management framework
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 2.1
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
3.1 Incident handling policy
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 3.1
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
4.1 Business continuity and disaster recovery plan
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 4.1
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
6.2 Secure development life cycle
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 6.2
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
6.5 Security testing
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 6.5
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
6.10 Vulnerability handling and disclosure
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 6.10
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
9.1 Cryptography
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 9.1
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
11.2 Management of access rights
40
37
39 in force, 1 not yet in force
The 40 laws behind PR.DS-01 and 11.2
Data Breach Notification Act, reasonable security measures and disposal of records , AlabamaLei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaArkansas Personal Information Protection Act, reasonable security procedures , ArkansasLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40) , BelarusLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers , BurundiCustomer Records Act, Reasonable Security Procedures , CaliforniaData Security Law, Data Security Protection Obligations , ChinaProtection of personal identifying information, reasonable security procedures duty , ColoradoConnected device provider's duty to protect recorded personal information with reasonable security measures , ConnecticutProtection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty , Connecticutand 30 more, every one in the free file .
PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected 2.1 Risk management framework
8
7
8 in force
The 8 laws behind PR.DS-02 and 2.1
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
3.1 Incident handling policy
8
7
8 in force
The 8 laws behind PR.DS-02 and 3.1
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
4.1 Business continuity and disaster recovery plan
8
7
8 in force
The 8 laws behind PR.DS-02 and 4.1
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
6.2 Secure development life cycle
8
7
8 in force
The 8 laws behind PR.DS-02 and 6.2
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
6.5 Security testing
8
7
8 in force
The 8 laws behind PR.DS-02 and 6.5
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
6.10 Vulnerability handling and disclosure
8
7
8 in force
The 8 laws behind PR.DS-02 and 6.10
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
9.1 Cryptography
8
7
8 in force
The 8 laws behind PR.DS-02 and 9.1
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
11.2 Management of access rights
8
7
8 in force
The 8 laws behind PR.DS-02 and 11.2
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionTelekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures , GermanyWertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms , GermanyData Classification Policy , KuwaitStandards for the Protection of Personal Information of Residents of the Commonwealth , MassachusettsSecurity measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield , NevadaNew York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information , New YorkLaw on Information Security, ICT Systems of Special Importance and Security Measures , Serbia
PR.DS-11 Backups of data are created, protected, maintained, and tested 2.1 Risk management framework
3
3
3 in force
The 3 laws behind PR.DS-11 and 2.1
3.1 Incident handling policy
3
3
3 in force
The 3 laws behind PR.DS-11 and 3.1
4.1 Business continuity and disaster recovery plan
3
3
3 in force
The 3 laws behind PR.DS-11 and 4.1
6.2 Secure development life cycle
3
3
3 in force
The 3 laws behind PR.DS-11 and 6.2
6.5 Security testing
3
3
3 in force
The 3 laws behind PR.DS-11 and 6.5
6.10 Vulnerability handling and disclosure
3
3
3 in force
The 3 laws behind PR.DS-11 and 6.10
9.1 Cryptography
3
3
3 in force
The 3 laws behind PR.DS-11 and 9.1
11.2 Management of access rights
3
3
3 in force
The 3 laws behind PR.DS-11 and 11.2
PR.PS-01 Configuration management practices are established and applied 2.1 Risk management framework
2
2
2 in force
The 2 laws behind PR.PS-01 and 2.1
3.1 Incident handling policy
2
2
2 in force
The 2 laws behind PR.PS-01 and 3.1
4.1 Business continuity and disaster recovery plan
2
2
2 in force
The 2 laws behind PR.PS-01 and 4.1
6.2 Secure development life cycle
2
2
2 in force
The 2 laws behind PR.PS-01 and 6.2
6.5 Security testing
2
2
2 in force
The 2 laws behind PR.PS-01 and 6.5
6.10 Vulnerability handling and disclosure
2
2
2 in force
The 2 laws behind PR.PS-01 and 6.10
9.1 Cryptography
2
2
2 in force
The 2 laws behind PR.PS-01 and 9.1
11.2 Management of access rights
2
2
2 in force
The 2 laws behind PR.PS-01 and 11.2
PR.PS-02 Software is maintained, replaced, and removed commensurate with risk 3.1 Incident handling policy
3
2
2 in force, 1 not yet in force
The 3 laws behind PR.PS-02 and 3.1
6.10 Vulnerability handling and disclosure
3
2
2 in force, 1 not yet in force
The 3 laws behind PR.PS-02 and 6.10
3.5 Incident response
2
2
2 in force
The 2 laws behind PR.PS-02 and 3.5
2.1 Risk management framework
2
1
1 in force, 1 not yet in force
The 2 laws behind PR.PS-02 and 2.1
4.1 Business continuity and disaster recovery plan
2
1
1 in force, 1 not yet in force
The 2 laws behind PR.PS-02 and 4.1
6.2 Secure development life cycle
2
1
1 in force, 1 not yet in force
The 2 laws behind PR.PS-02 and 6.2
6.5 Security testing
2
1
1 in force, 1 not yet in force
The 2 laws behind PR.PS-02 and 6.5
9.1 Cryptography
2
1
1 in force, 1 not yet in force
The 2 laws behind PR.PS-02 and 9.1
11.2 Management of access rights
2
1
1 in force, 1 not yet in force
The 2 laws behind PR.PS-02 and 11.2
PR.PS-04 Log records are generated and made available for continuous monitoring 1.1 Policy on the security of network and information systems
7
6
6 in force, 1 not yet in force
The 7 laws behind PR.PS-04 and 1.1
DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionEuropean Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems , European Union from 26 Mar 2029 , in 2.4 years Sécurité des systèmes d'information (dispositions communes) , GabonLaw on Information Security, General Security Measures , MontenegroLoi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties , MoroccoDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New YorkCyber Security and Crime Act, 2021, Critical National Information Infrastructure , Sierra Leone
3.2 Monitoring and logging
7
6
6 in force, 1 not yet in force
The 7 laws behind PR.PS-04 and 3.2
DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionEuropean Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems , European Union from 26 Mar 2029 , in 2.4 years Sécurité des systèmes d'information (dispositions communes) , GabonLaw on Information Security, General Security Measures , MontenegroLoi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties , MoroccoDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New YorkCyber Security and Crime Act, 2021, Critical National Information Infrastructure , Sierra Leone
1.2 Roles, responsibilities and authorities
6
5
5 in force, 1 not yet in force
The 6 laws behind PR.PS-04 and 1.2
DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionEuropean Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems , European Union from 26 Mar 2029 , in 2.4 years Sécurité des systèmes d'information (dispositions communes) , GabonLaw on Information Security, General Security Measures , MontenegroDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New YorkCyber Security and Crime Act, 2021, Critical National Information Infrastructure , Sierra Leone
2.2 Compliance monitoring
6
5
5 in force, 1 not yet in force
The 6 laws behind PR.PS-04 and 2.2
DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionEuropean Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems , European Union from 26 Mar 2029 , in 2.4 years Sécurité des systèmes d'information (dispositions communes) , GabonLaw on Information Security, General Security Measures , MontenegroDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New YorkCyber Security and Crime Act, 2021, Critical National Information Infrastructure , Sierra Leone
12.4 Asset inventory
6
5
5 in force, 1 not yet in force
The 6 laws behind PR.PS-04 and 12.4
DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework , European UnionEuropean Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems , European Union from 26 Mar 2029 , in 2.4 years Sécurité des systèmes d'information (dispositions communes) , GabonLaw on Information Security, General Security Measures , MontenegroDFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models , New YorkCyber Security and Crime Act, 2021, Critical National Information Infrastructure , Sierra Leone
3.1 Incident handling policy
2
2
2 in force
The 2 laws behind PR.PS-04 and 3.1
PR.PS-06 Secure software development practices are integrated, and their performance is... 2.1 Risk management framework
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 2.1
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
3.1 Incident handling policy
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 3.1
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
4.1 Business continuity and disaster recovery plan
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 4.1
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
6.2 Secure development life cycle
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 6.2
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
6.5 Security testing
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 6.5
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
6.10 Vulnerability handling and disclosure
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 6.10
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
9.1 Cryptography
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 9.1
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
11.2 Management of access rights
29
18
25 in force, 4 not yet in force
The 29 laws behind PR.PS-06 and 11.2
Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases , AngolaSecurity Standards for Smart Devices , AustraliaAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilSecurity of Connected Devices , CaliforniaOSFI Guideline B-13, Technology and Cyber Risk Management , CanadaCybersecurity Law, Network Product and Service Security Duties , ChinaDecreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty , CubaSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements , CyprusCyber Resilience Act, Essential Requirements and Manufacturer Obligations , European Union from 11 Dec 2027 , in 14 months Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements , European Unionand 19 more, every one in the free file .
DE.CM-01 Networks and network services are monitored to find potentially adverse events 2.1 Risk management framework
2
2
2 in force
The 2 laws behind DE.CM-01 and 2.1
3.1 Incident handling policy
2
2
2 in force
The 2 laws behind DE.CM-01 and 3.1
4.1 Business continuity and disaster recovery plan
2
2
2 in force
The 2 laws behind DE.CM-01 and 4.1
6.2 Secure development life cycle
2
2
2 in force
The 2 laws behind DE.CM-01 and 6.2
6.5 Security testing
2
2
2 in force
The 2 laws behind DE.CM-01 and 6.5
6.10 Vulnerability handling and disclosure
2
2
2 in force
The 2 laws behind DE.CM-01 and 6.10
9.1 Cryptography
2
2
2 in force
The 2 laws behind DE.CM-01 and 9.1
11.2 Management of access rights
2
2
2 in force
The 2 laws behind DE.CM-01 and 11.2
DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to... 2.1 Risk management framework
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 2.1
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
3.1 Incident handling policy
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 3.1
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
4.1 Business continuity and disaster recovery plan
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 4.1
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
6.2 Secure development life cycle
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 6.2
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
6.5 Security testing
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 6.5
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
6.10 Vulnerability handling and disclosure
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 6.10
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
9.1 Cryptography
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 9.1
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
11.2 Management of access rights
12
11
9 in force, 2 not yet in force, 1 proposed
The 12 laws behind DE.CM-09 and 11.2
OSFI Guideline B-13, Technology and Cyber Risk Management , CanadaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaDigital Code, Livre IV: Digital Services Provider Security Obligations , Democratic Republic of the CongoDigital Code, Book VI: Critical Installation Protection and Operator Security Controls , DjiboutiCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations , Ethiopia from 21 Jul 2027 , in 9 months L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014) , European Union from 11 Dec 2027 , in 14 months Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations , Marshall IslandsFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock , Micronesia proposed New York Department of Financial Services Cybersecurity Regulation, Malicious Code Protection and Class A Company Monitoring Solutions , New YorkLaw on Information and Its Protection, information-security duty , Turkmenistanand 2 more, every one in the free file .
1.1 Policy on the security of network and information systems
2
2
1 in force, 1 not yet in force
The 2 laws behind DE.CM-09 and 1.1
1.2 Roles, responsibilities and authorities
2
2
1 in force, 1 not yet in force
The 2 laws behind DE.CM-09 and 1.2
2.2 Compliance monitoring
2
2
1 in force, 1 not yet in force
The 2 laws behind DE.CM-09 and 2.2
3.2 Monitoring and logging
2
2
1 in force, 1 not yet in force
The 2 laws behind DE.CM-09 and 3.2
12.4 Asset inventory
2
2
1 in force, 1 not yet in force
The 2 laws behind DE.CM-09 and 12.4
RS.CO-02 Internal and external stakeholders are notified of incidents 3.5 Incident response
101
69
92 in force, 4 not yet in force, 5 proposed
The 101 laws behind RS.CO-02 and 3.5
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraLei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaCyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident , BangladeshLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilCybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) , BulgariaCybersecurity Law, Network Product and Service Security Duties , Chinaand 91 more, every one in the free file .
3.1 Incident handling policy
100
67
91 in force, 4 not yet in force, 5 proposed
The 100 laws behind RS.CO-02 and 3.1
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraLei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaCyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident , BangladeshLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumCybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) , BulgariaCybersecurity Law, Network Product and Service Security Duties , ChinaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaNational Cybersecurity Incident Reporting Measures , Chinaand 90 more, every one in the free file .
3.4 Event assessment and classification
98
67
89 in force, 4 not yet in force, 5 proposed
The 98 laws behind RS.CO-02 and 3.4
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraLei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaCyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident , BangladeshLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumCybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) , BulgariaCybersecurity Law, Network Product and Service Security Duties , ChinaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaNational Cybersecurity Incident Reporting Measures , Chinaand 88 more, every one in the free file .
3.6 Post-incident reviews
97
66
88 in force, 4 not yet in force, 5 proposed
The 97 laws behind RS.CO-02 and 3.6
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraLei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaCyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident , BangladeshLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumCybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) , BulgariaCybersecurity Law, Network Product and Service Security Duties , ChinaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaNational Cybersecurity Incident Reporting Measures , Chinaand 87 more, every one in the free file .
4.3 Crisis management
97
66
88 in force, 4 not yet in force, 5 proposed
The 97 laws behind RS.CO-02 and 4.3
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraLei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties , AngolaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaCyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident , BangladeshLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumCybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) , BulgariaCybersecurity Law, Network Product and Service Security Duties , ChinaData Security Law, Risk Monitoring and Incident Reporting Duty , ChinaNational Cybersecurity Incident Reporting Measures , Chinaand 87 more, every one in the free file .
6.10 Vulnerability handling and disclosure
9
8
9 in force
The 9 laws behind RS.CO-02 and 6.10
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits , BeninAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment) , BrazilDigital Code, Livre II: Trust Service Provider Security Risk-Management Duty , Democratic Republic of the CongoDigital Code, Livre IV: ICT Product and Service Vendor Security Certification , Democratic Republic of the CongoPayment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication , European UnionLaki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators , FinlandLoi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties , MoroccoCybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure , MozambiqueCybersecurity Law, Incident Response and Reporting Duties , Vietnam
2.1 Risk management framework
3
3
3 in force
The 3 laws behind RS.CO-02 and 2.1
4.1 Business continuity and disaster recovery plan
3
3
3 in force
The 3 laws behind RS.CO-02 and 4.1
6.2 Secure development life cycle
3
3
3 in force
The 3 laws behind RS.CO-02 and 6.2
6.5 Security testing
3
3
3 in force
The 3 laws behind RS.CO-02 and 6.5
9.1 Cryptography
3
3
3 in force
The 3 laws behind RS.CO-02 and 9.1
11.2 Management of access rights
3
3
3 in force
The 3 laws behind RS.CO-02 and 11.2
RS.CO-03 Information is shared with designated internal and external stakeholders 3.1 Incident handling policy
49
37
45 in force, 2 not yet in force, 2 proposed
The 49 laws behind RS.CO-03 and 3.1
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumZakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations , CroatiaSecurity of Networks and Information Systems Law, Incident Notification Obligations , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification , Czech RepublicDigital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty , Democratic Republic of the CongoNIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties , DenmarkKüberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident , Estoniaand 39 more, every one in the free file .
3.4 Event assessment and classification
49
37
45 in force, 2 not yet in force, 2 proposed
The 49 laws behind RS.CO-03 and 3.4
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumZakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations , CroatiaSecurity of Networks and Information Systems Law, Incident Notification Obligations , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification , Czech RepublicDigital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty , Democratic Republic of the CongoNIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties , DenmarkKüberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident , Estoniaand 39 more, every one in the free file .
3.5 Incident response
49
37
45 in force, 2 not yet in force, 2 proposed
The 49 laws behind RS.CO-03 and 3.5
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumZakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations , CroatiaSecurity of Networks and Information Systems Law, Incident Notification Obligations , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification , Czech RepublicDigital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty , Democratic Republic of the CongoNIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties , DenmarkKüberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident , Estoniaand 39 more, every one in the free file .
3.6 Post-incident reviews
49
37
45 in force, 2 not yet in force, 2 proposed
The 49 laws behind RS.CO-03 and 3.6
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumZakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations , CroatiaSecurity of Networks and Information Systems Law, Incident Notification Obligations , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification , Czech RepublicDigital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty , Democratic Republic of the CongoNIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties , DenmarkKüberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident , Estoniaand 39 more, every one in the free file .
4.3 Crisis management
49
37
45 in force, 2 not yet in force, 2 proposed
The 49 laws behind RS.CO-03 and 4.3
Law No. 25/2024, On Cybersecurity , AlbaniaLlei 22/2022, Incident Handling and Notification Obligation , AndorraNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations , AustriaLoi du 26 avril 2024, Significant-Incident Notification Obligations , BelgiumZakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations , CroatiaSecurity of Networks and Information Systems Law, Incident Notification Obligations , CyprusCybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification , Czech RepublicDigital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty , Democratic Republic of the CongoNIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties , DenmarkKüberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident , Estoniaand 39 more, every one in the free file .
RS.MI-01 Incidents are contained 3.1 Incident handling policy
5
5
3 in force, 2 not yet in force
The 5 laws behind RS.MI-01 and 3.1
Data Security Law, Risk Monitoring and Incident Reporting Duty , ChinaCritical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT , Ethiopia from 21 Jul 2027 , in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident , Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification , LatviaCybersecurity Incident Reporting and Emergency Response , Tunisia
3.4 Event assessment and classification
5
5
3 in force, 2 not yet in force
The 5 laws behind RS.MI-01 and 3.4
Data Security Law, Risk Monitoring and Incident Reporting Duty , ChinaCritical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT , Ethiopia from 21 Jul 2027 , in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident , Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification , LatviaCybersecurity Incident Reporting and Emergency Response , Tunisia
3.5 Incident response
5
5
3 in force, 2 not yet in force
The 5 laws behind RS.MI-01 and 3.5
Data Security Law, Risk Monitoring and Incident Reporting Duty , ChinaCritical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT , Ethiopia from 21 Jul 2027 , in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident , Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification , LatviaCybersecurity Incident Reporting and Emergency Response , Tunisia
3.6 Post-incident reviews
5
5
3 in force, 2 not yet in force
The 5 laws behind RS.MI-01 and 3.6
Data Security Law, Risk Monitoring and Incident Reporting Duty , ChinaCritical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT , Ethiopia from 21 Jul 2027 , in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident , Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification , LatviaCybersecurity Incident Reporting and Emergency Response , Tunisia
4.3 Crisis management
5
5
3 in force, 2 not yet in force
The 5 laws behind RS.MI-01 and 4.3
Data Security Law, Risk Monitoring and Incident Reporting Duty , ChinaCritical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT , Ethiopia from 21 Jul 2027 , in 9 months Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident , Kiribati from a date not yet set Nacionālās kiberdrošības likums, Incident Notification , LatviaCybersecurity Incident Reporting and Emergency Response , Tunisia