Law / Frameworks / NIST Privacy Framework / Protect-P
NIST Privacy Framework, Protect-PPR.PO-P5
Protection processes are improved.NIST Privacy Framework, version 1.0, January 2020, PR.PO-P5
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 7
- laws
- 5
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST CSF 2.0GV.OV-03 Organizational cybersecurity risk management performance is evaluated and..., 2 laws
- NIST CSF 2.0ID.IM-01 Improvements are identified from evaluations, 2 laws
- NIST CSF 2.0ID.IM-03 Improvements are identified from execution of operational processes,..., 2 laws
Sector security regimes
4 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Czech Republic |
Decree on the Security Measures of a Provider of a Regulated Service in the Lower-Obligations Regime (Vyhláška č. 410/2025 Sb.) |
Keep an overview of the security measures you have introduced, will introduce with deadlines, priority and a responsible person, and have not introduced with reasons; update it and evaluate the measures' effectiveness at least once a year; keep each version for at least four years (Section 3(2)). |
 European Union |
Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR) |
Run a continuous improvement process and document your key processes, procedures, roles and responsibilities (points IS.D.OR.200(b) and (c)). |
| European Union |
Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR) |
Run a continuous improvement process and document your key processes, procedures, roles and responsibilities (points IS.I.OR.200(b) and (c)). |
| European Union |
Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures |
Establish a policy and procedures to assess whether your cybersecurity risk-management measures are effectively implemented and maintained (point 7.1), offer your employees an awareness raising programme and give those whose roles require security skills regular training (points 8.1.2 and 8.2.1), and apply the Annex's requirements on cryptography, human resources security, access control, asset management, and environmental and physical security (points 9 to 13). |
Security baseline statutes
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Cameroon |
Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC) |
Evaluate and revise your security systems as technology evolves, and make the changes your security practices, measures, and techniques need. |
 Central African Republic |
Cybersecurity Law: Network and Information System Security Duty |
Periodically evaluate and revise your security systems, and introduce necessary changes as technology evolves, under the Agence Nationale de la Cybersécurité's oversight. |
Comprehensive regime
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Nigeria |
Nigeria Data Protection Act, 2023 (NDPA), general data protection duties |
Follow schedules for monitoring, evaluating and maintaining the data security system, and for organisation-wide internal sensitisation and training on data privacy. |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.