NIST Privacy Framework, Protect-PPR.PO-P7

Adopt measures on security roles, security policy and documentation, risk management, suppliers, human-resources security, change management, acquisition, development and maintenance, access management, handling of events and incidents, cybersecurity audit, identity administration, detection, logging and evaluation of events, application security, cryptographic algorithms and availability of the regulated service (Sections 5 to 26).

Prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of your services in the event of technical failures or cessation of activity.

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use and to prevent incidents or minimise their impact, covering at least risk-analysis and information-system security policies, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability handling and disclosure, effectiveness assessment, cyber hygiene and training, cryptography, personnel security, access control and asset management, and multi-factor authentication and secured communications (Section 5(1)).

Cover at minimum: risk-analysis and information-system-security policies; incident handling; operational continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in acquiring, developing and maintaining your network and information systems, including vulnerability handling and disclosure; policies and procedures for assessing the effectiveness of your cybersecurity risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies and procedures on the use of cryptography and, where relevant, encryption; personnel security, access-control policies and asset management; and, where relevant, multi-factor or continuous authentication, secured voice, video and text communication, and secured internal emergency-communication systems.

Develop, manage and test ICT business-continuity policies and ICT response and recovery plans as part of your business continuity plan, in line with DORA Article 11 (Section 82^4(2)).

Set up, implement and maintain an information security management system that sets a policy on information security, identifies and reviews information security risks, defines and implements risk treatment measures, implements internal and external reporting schemes, detects information security events, responds to and recovers from incidents, applies the measures the competent authority notifies, addresses its findings, and monitors your compliance (point IS.D.OR.200(a)).

Establish an internal reporting scheme to collect and evaluate information security events, implement measures to detect incidents and vulnerabilities and to respond to events that may develop into an information security incident, and implement measures to recover from incidents (points IS.D.OR.215 and IS.D.OR.220).

Set up, implement and maintain an information security management system that sets a policy on information security, identifies and reviews information security risks, defines and implements risk treatment measures, implements internal and external reporting schemes, detects information security events, responds to and recovers from incidents, applies the measures the competent authority notifies, addresses its findings, and monitors your compliance (point IS.I.OR.200(a)).

Establish an internal reporting scheme to collect and evaluate information security events, implement measures to detect incidents and vulnerabilities and to respond to events that may develop into an information security incident, and implement measures to recover from incidents (points IS.I.OR.215 and IS.I.OR.220).

Establish and implement an incident handling policy, monitor and log activity on your network and information systems to detect events that could be incidents, assess suspicious events to determine whether they are incidents, and assess the existence of recurring incidents under Article 4 on a quarterly basis (points 3.1.1, 3.2.1, 3.4.1 and 3.4.2(b)).

Lay down and maintain a business continuity and disaster recovery plan, carry out a business impact analysis, and maintain backup copies of data (points 4.1.1, 4.1.3 and 4.2.1).

A user of the EU Cybersecurity Reserve takes all appropriate measures to mitigate the effects of the incident for which it requests support (Article 15(2)).

Develop, document and implement an ICT-related incident policy that documents the incident management process, lists the relevant internal and external contacts, sets up mechanisms to support incident management, retains evidence relating to ICT-related incidents in a secure manner, and analyses significant or recurring incidents (Article 22). Set clear roles and responsibilities to detect and respond to ICT-related incidents and anomalous activities, collect, monitor and analyze logs, cyber threat information and incident notifications from ICT third-party service providers, implement tools that generate alerts at least for the ICT assets and information assets supporting critical or important functions, and log the date, time and type of each detected anomalous activity (Article 23).

Include in the ICT business continuity policy the objectives, scope, timeframe, activation and deactivation criteria, governance and recovery objectives set out in Article 24(1). If you are a central counterparty, set a maximum recovery time for your critical functions of not longer than 2 hours. If you are a central securities depository, ensure a recovery time objective of not longer than 2 hours for your critical or important functions. If you are a trading venue, ensure that trading can be resumed within or close to 2 hours of a disruptive incident and that the maximum amount of data lost is close to zero (Article 24(2) to (4)). Test the plans on scenarios that simulate potential disruptions, including severe but plausible scenarios, include the ICT services provided by ICT third-party service providers where applicable, document the results, and report identified deficiencies to the management body (Article 25).

Define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents (Article 17(1)).

Record all ICT-related incidents and significant cyber threats, and establish procedures and processes that ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents so that root causes are identified, documented and addressed (Article 17(2)).

Have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk. Have your management body define, approve, oversee and answer for all arrangements under the ICT risk management framework, bear the ultimate responsibility for managing ICT risk, set and approve the digital operational resilience strategy and risk tolerance level, and approve and review your ICT business continuity policy, response and recovery plans, ICT internal audit plans and policy on the use of ICT third-party services (Article 5(1) and (2)).

Put in place a comprehensive ICT business continuity policy and ICT response and recovery plans, and conduct a business impact analysis of your exposures to severe business disruptions. Test the continuity and the response and recovery plans at least yearly and on substantive changes to systems supporting critical or important functions, and test your crisis communication plans. Keep readily accessible records of activities before and during disruption events. Unless you are a microenterprise, include cyber-attack and switchover scenarios in the tests, have a crisis management function, and report to your competent authority on request an estimate of the aggregated annual costs and losses caused by major ICT-related incidents (Article 11).

Take technical, operational and organisational measures appropriate to the risk your network and information systems face, covering at minimum a risk analysis and information-system-security policy, incident handling, business continuity and crisis management, supply chain security, and security in the acquisition, development and maintenance of your systems.

Maintain basic cyber hygiene practices and cybersecurity training, policies on cryptography and encryption where appropriate, human resources security and access control, and multi-factor authentication or continuous authentication solutions where appropriate.

If you have a dedicated interface, ensure that it offers at all times the same level of availability and performance, including support, as the interfaces made available to your users, define transparent key performance indicators and service level targets at least as stringent, do not create obstacles to the provision of payment initiation and account information services, monitor the availability and performance of the interface and publish quarterly statistics on your website, and include in its design a strategy and plans for contingency measures with communication plans for payment service providers using the interface (Articles 32 and 33(1) and (2)).

Maintain a documented cybersecurity risk-management operating model covering at minimum: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of your direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources.

Meet DORA's duties on ICT risk management (Articles 5 to 14), ICT-related incident management, classification and reporting (Articles 17 to 19), digital operational resilience testing (Articles 24 to 27) and management of ICT third-party risk (Articles 28 to 30) (section 40, second paragraph, item 13).

Cover each of: the security of your systems and installations; incident management; business-continuity management; monitoring, audit and control; and compliance with international standards.

In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.

Cover at least: risk analysis and information-security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluation of your measures' effectiveness; basic cyber-hygiene training; cryptography; personnel security and access control; and multi-factor or continuous authentication.

If you are an essential or important entity under Section 28 of the BSI Act, base those measures on an all-hazards approach that covers at least risk analysis and security concepts, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability management and disclosure, effectiveness assessment, basic cyber hygiene and training, cryptography, personnel security and access control, and multi-factor or continuous authentication (Section 165(2a)); have your management implement and monitor them and take part in regular training (Section 165(2b) and (2d)).

Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where relevant, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication and secure voice, video, text and emergency communications.

Develop, test and maintain a risk-based contingency plan, including an offsite recovery center kept separate from your main site, and a regularly checked backup system.

Keep effective business-continuity arrangements for any failure of your trading systems, including the ICT business continuity policy and plans and the ICT response and recovery plans set up under DORA Article 11, and fully test and monitor your systems so that they always meet Section 26/B and DORA Chapters II and IV (Section 26/B(2)).

Maintain a documented security policy and risk-management process, assess and re-assess risk on a regular basis, and put in place technical and organisational security measures, including access control, tested regularly against current international best practice.

Maintain a documented incident-response plan and a business-continuity plan covering incident logging, root-cause analysis, restoration of normal operation, and prevention of recurrence, and operate an active internal-control system consistent with this Act and any sector-specific law.

As a credit institution or investment firm, have contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, established, managed and tested in accordance with Article 11 of the DORA Regulation (regulation 4).

As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.

Cover at least: risk-analysis and information-system security policies; incident handling, including the procedures and tools to carry out the Article 25 and 26 notifications; business continuity, including backup management, disaster recovery and crisis management; and supply-chain security.

Appoint a member of senior management as Chief Information Security Officer, and develop, implement, communicate to staff and keep records of technical and organisational policies, practices and processes to manage risk to your network and information infrastructure and to prevent, mitigate and remedy a cybersecurity incident.

Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28).

Review and update the cyber-risk-management and ICT-business-continuity plan at least once a year if you are an ICT critical infrastructure owner or an essential service provider holding a class A system, at least once in two years if you are another essential service provider, and at least once in three years if you are an important service provider (point 40).

Draft a cyber-risk-management and ICT-business-continuity plan and give your staff regular training on carrying it out; the Cabinet sets the plan's required content (Article 28(2)), and Cabinet Regulation No. 397 of 25 June 2025, 'Minimālās kiberdrošības prasības', sets the minimum cybersecurity requirements your systems must meet.

Prepare policies and take preventive measures and procedures against crimes committed by electronic means, including a cybercrime risk analysis, a budget for an information-technology security policy, insurance covering electronic-crime risk, a continuously updated incident-response and business-continuity plan, a dedicated prevention team, and employee and customer awareness training.

Adopt at least two-factor authentication for any user accessing the system from outside the bank or financial institution, fully encrypt highly sensitive data, filter inbound email, verify the security of devices employees use outside the institution, run penetration testing, monitor network traffic, and verify data integrity.

Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and disaster recovery, and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluating your measures' effectiveness; basic cyber-hygiene procedures and training; cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, plus secured voice, video and text communication.

Adopt and keep current cybersecurity policy documents, periodically analyse and manage your cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure your supply chain, and deploy technical cybersecurity measures.

If you are a CRR institution in Luxembourg, keep adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, and establish, manage and test them in accordance with Article 11 of the DORA Regulation (Loi du 1er juillet 2024, Article 5).

Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and crisis management; supply-chain security, including the security of your relationships with direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; evaluating the effectiveness of your own risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; personnel security, access-control policy and asset management; and multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency communication systems as needed.

Base those measures on an all-hazards approach and cover at least: policies on risk analysis and information system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies and procedures to assess the effectiveness of the measures; basic cyber hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; human resources security, insider risk management, access control and asset management; multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems where appropriate; and logging and traceability (article 19(2)).

At minimum: conduct rolling cybersecurity risk assessments at a frequency the Chief Information Security Officer prescribes; develop and implement internal cybersecurity policies and procedures, an internal incident-reporting policy, and an internal cybersecurity awareness program; and transmit the resulting mitigation actions to the Director within thirty days of completing each risk assessment.

If designated, adopt a cyber-security risk and security analysis, an incident-handling policy, a business-continuity and cyber-crisis plan, a supply-chain security act and system-governance acts, apply cryptographic protection where your work requires it, and assess the effectiveness of these measures (Article 16).

If you are a private critical-infrastructure operator, additionally establish an institutional CSIRT.

Record in writing, and apply demonstrably, policies on the security of your network and information systems, on risk management (with a risk-management method and risk-acceptance criteria), on incident handling, and on business continuity and crisis management (Articles 6 to 9).

Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in acquiring, developing and maintaining your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.

The Department says your incident response, business continuity and disaster recovery plans should be reasonably designed to address all types of cybersecurity events and other disruptions, including those relating to AI.

Maintain a cybersecurity program, based on your risk assessment, designed to protect the confidentiality, integrity and availability of your information systems and the nonpublic information stored on them, and designed to identify and assess risks, protect against unauthorized access, detect cybersecurity events, respond to and recover from them, and fulfill applicable regulatory reporting obligations.

Base the policy and procedures on your risk assessment and address, at a minimum and to the extent applicable to your operations: information security; data governance, classification and retention; asset inventory, device management and end of life management; access controls, including remote access and identity management; business continuity and disaster recovery planning and resources; systems operations and availability concerns; systems and network security and monitoring; security awareness and training; systems and application security and development and quality assurance; physical security and environmental controls; customer data privacy; vendor and third-party service provider management; risk assessment; incident response and notification; and vulnerability management.

Establish written plans, as part of your cybersecurity program, that contain proactive measures to investigate and mitigate cybersecurity events and to ensure operational resilience, including incident response, business continuity and disaster recovery plans.

Design the incident response plan to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of your information systems or the continuing functionality of any aspect of your business or operations, and address in it, for different types of events including ransomware: its goals; internal response processes; roles, responsibilities and levels of decision-making authority; external and internal communications and information sharing; remediation of identified weaknesses; documentation and reporting; recovery from backups; root cause analysis; and updating of the plan.

Implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.

Cover at minimum: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training, including for your top management; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.

Cover at least: risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of your risk-management measures; cryptography and encryption policy; supply-chain security, including the security of your relationship with your direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access control and asset management; incident management; business continuity, including backups, disaster recovery and crisis management; basic cyber-hygiene practices and training; and multi-factor or continuous authentication.

Take technical, operational, organisational and physical protection measures across the areas Article 10 lists, including multi-factor authentication or a continuous-authentication solution, secured voice, video and text communication, and secured communication channels for emergencies.

If you are an operator under the Zakon o elektronskih komunikacijah (ZEKom-2), establish and maintain a documented information security management system (SUVI) and continuity management system (SUNP) in line with the information security law, and take appropriate, effective and proportionate technical, operational and organizational measures to protect the integrity, authenticity, confidentiality and availability of your network and information systems and to limit the effect of incidents on your customers (Article 115(1)).

Treat the SUVI and SUNP as a business secret, review the emergency-communication part of the SUNP at least once a year, and obtain the prior approval of the competent bodies before adopting or changing it (Article 115(2) and (3)).

Adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems you use to provide the service, and take measures to prevent and minimise the impact of incidents that affect you; as a digital service provider, determine the security measures you apply, taking into account at least the state of the art and the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.

As a 5G operator, guarantee the secure installation, deployment and operation of public 5G networks and the secure provision of 5G services, including technical and operational measures for the physical and logical integrity of the networks, contingency plans for essential services that depend on them, control of who can access network assets, use of only certified products, resources, services and systems to operate them, compliance with applicable technical standards and European certification schemes, supplier security requirements, control of your own supply chain, and a security audit at your cost (Article 12(1) and (2)).

Take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems you use for your operations or to provide your services, and their physical environment, against an incident, at minimum covering risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition/development/maintenance, effectiveness-assessment procedures, basic cyber hygiene and staff training, cryptography and encryption policies, personnel security, access control and asset management, and, where relevant, authentication, secure communications and secure emergency-communication systems.

Have the dedicated unit plan, manage and execute the information security system to control information security risk, supervise every unit's compliance with it, and build the mechanisms for cyber security protection, threat-intelligence assessment, and cyber security incident notification and response.

Draw up an info-communications security maintenance plan covering the management scope and classification of covered systems, compliance-verification measures, plan-implementation measures, and joint-defense and incident-response measures, and implement it.

Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.

Within that same seventy two hours, begin a thorough review of the breach's magnitude, adopt corrective and preventive measures, and update your security policies to prevent a recurrence.

Document every breach that risks the security of personal data, noting its date, cause, related facts, effects and corrective measures, and keep that record available to the Agencia de Ciberseguridad del Estado.

Document every personal data breach, its facts, its effects and the remedial action taken, so the Authority can assess compliance.

Assess whether the breach is likely to adversely affect a subscriber or individual by taking account of, in particular, the nature and content of the personal data (financial information, special categories of data referred to in Article 8(1) of Directive 95/46/EC, location data, internet log files, web browsing histories, e-mail data and itemized call lists), the likely consequences for the person (identity theft or fraud, physical harm, psychological distress, humiliation or damage to reputation), and the circumstances of the breach, in particular where the data has been stolen or you know it is in the possession of an unauthorized third party (Article 3(2)).

Maintain an inventory of personal data breaches comprising the facts surrounding each breach, its effects and the remedial action taken, sufficient to enable the competent national authorities to verify compliance with the notification duty, and include in it only the information necessary for that purpose (Article 4(4)).

Keep an up-to-date register of every personal-data breach, its circumstances, its impact and the remedial measures taken, and make it available to the APDPVP.

Take steps to restore the integrity of the information system after unauthorised access or acquisition of personal data, and delay notifying the data subject only where the Commission or a security agency says notification would impede a criminal investigation.

Keep a register of those breaches that records their essential circumstances and effects and the corrective measures you took, and make it cover every fact the Authority needs to check that you notified the person concerned as the Act requires (Eht. section 156, paragraph 4).

Conduct a good-faith, reasonable, and prompt investigation on becoming aware of a breach of system security involving personal information about a Kansas resident.

Keep a record of every personal data breach, regardless of whether it meets that threshold, including the facts, its effects and the remedial action taken, and make your threshold analysis available to the Office on request.

Document every personal data breach, its facts, effects and remedial action, so the Agency can verify your compliance.

Record every personal data breach, with its causes, its effects and the measures taken (Article 74, paragraph 8).

Document every personal data breach, its facts, its effects, and the remedial steps you took, and expect the Authority to be able to require you to communicate the breach to the affected person if you have not already done so.

Conduct a reasonable and prompt investigation upon becoming aware of a breach of security involving a Nebraska resident's personal information.

Keep an overview of all personal data breaches, with at least the facts and the details that the notification contains (Article 11.3a, paragraph 6).

If you have cause to believe a confidentiality incident involving personal information you hold has occurred, take reasonable measures to reduce the risk of injury and prevent further incidents of the same nature.

Keep a register of every confidentiality incident, and send a copy to the Commission d’accès à l’information on request.

Keep a record of all personal data breaches that describes what happened, its effects and the remedial measures taken (Article 3, paragraph 12).

Keep a record of every personal data breach, its effects, and the remedial action taken, sufficient to demonstrate compliance with the Act's breach notification duties.

Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences and the measures taken, and document every breach, its effects and the remedial action.

Document every breach, including its facts, effects and remedial action, so the Commissioner can assess compliance.

An app that experiences a data breach affecting an individual's personal data in Singapore must assess whether the breach is likely to cause significant harm or is of significant scale, and if so must notify the PDPC as soon as practicable and in any case within 3 calendar days of that assessment, and must also notify each affected individual unless a statutory exception applies.

Keep a sufficient inventory of personal data breaches (Article 227, paragraph 7).

Keep a record of every personal data breach.

Document every breach relating to personal data, including the facts, its effects, and the corrective measures taken, in a form that lets the Commissioner verify your compliance with this duty.

If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.

Keep robust breach detection, investigation and internal reporting procedures in place, and keep a record of all personal data breaches.