Law / Frameworks / Crosswalk / NIST Privacy Framework to ENISA NIS2 guidance

The NIST Privacy Framework, mapped to the ENISA NIS2 Technical Implementation Guidance

12 of NIST Privacy Framework's controls connect to 19 of ENISA NIS2 guidance's through 176 laws in 91 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
To: ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, European Union Agency for Cybersecurity (ENISA)
See also: ENISA NIS2 guidance to NIST Privacy Framework, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-privacy-framework--enisa-nis2-guidance.csv · nist-privacy-framework--enisa-nis2-guidance.json

NIST Privacy Framework	ENISA NIS2 guidance	Laws	Jurisdictions	Where the laws stand
ID.IM-P1Systems/products/services that process data are inventoried.	1.1Policy on the security of network and information systems	5	4	5 in force
	The 5 laws behind ID.IM-P1 and 1.1 Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	1.2Roles, responsibilities and authorities	5	4	5 in force
	The 5 laws behind ID.IM-P1 and 1.2 Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	2.2Compliance monitoring	5	4	5 in force
	The 5 laws behind ID.IM-P1 and 2.2 Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	3.2Monitoring and logging	5	4	5 in force
	The 5 laws behind ID.IM-P1 and 3.2 Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
	12.4Asset inventory	5	4	5 in force
	The 5 laws behind ID.IM-P1 and 12.4 Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance, Greece Cybersecurity Act, Risk-Management Measures, Hungary Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
CT.DM-P5Data are destroyed according to policy.	1.1Policy on the security of network and information systems	9	9	9 in force
	The 9 laws behind CT.DM-P5 and 1.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Identity Theft Protection Act, destruction of personal information records, North Carolina Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
	3.2Monitoring and logging	9	9	9 in force
	The 9 laws behind CT.DM-P5 and 3.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York Identity Theft Protection Act, destruction of personal information records, North Carolina Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
	4.2Backup and redundancy management	8	8	8 in force
	The 8 laws behind CT.DM-P5 and 4.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Identity Theft Protection Act, destruction of personal information records, North Carolina Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
	12.2Handling of assets	8	8	8 in force
	The 8 laws behind CT.DM-P5 and 12.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Identity Theft Protection Act, destruction of personal information records, North Carolina Document Safe Destruction Act, safe destruction of records containing personal information, Vermont
CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	1.1Policy on the security of network and information systems	5	4	4 in force, 1 not yet in force
	The 5 laws behind CT.DM-P8 and 1.1 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco
	3.2Monitoring and logging	5	4	4 in force, 1 not yet in force
	The 5 laws behind CT.DM-P8 and 3.2 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco
	1.2Roles, responsibilities and authorities	4	3	3 in force, 1 not yet in force
	The 4 laws behind CT.DM-P8 and 1.2 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro
	2.2Compliance monitoring	4	3	3 in force, 1 not yet in force
	The 4 laws behind CT.DM-P8 and 2.2 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro
	12.4Asset inventory	4	3	3 in force, 1 not yet in force
	The 4 laws behind CT.DM-P8 and 12.4 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems, European Union from 26 Mar 2029, in 2.4 years Sécurité des systèmes d'information (dispositions communes), Gabon Law on Information Security, General Security Measures, Montenegro
CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.	3.1Incident handling policy	38	30	34 in force, 4 proposed
	The 38 laws behind CM.AW-P7 and 3.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Data Security Law, Risk Monitoring and Incident Reporting Duty, China Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Digital Code, Livre II: Trust Service Provider Security-Incident Notification, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti and 28 more, every one in the free file.
	3.4Event assessment and classification	36	30	32 in force, 4 proposed
	The 36 laws behind CM.AW-P7 and 3.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Data Security Law, Risk Monitoring and Incident Reporting Duty, China Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Digital Code, Livre II: Trust Service Provider Security-Incident Notification, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 26 more, every one in the free file.
	3.5Incident response	36	30	32 in force, 4 proposed
	The 36 laws behind CM.AW-P7 and 3.5 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Data Security Law, Risk Monitoring and Incident Reporting Duty, China Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Digital Code, Livre II: Trust Service Provider Security-Incident Notification, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 26 more, every one in the free file.
	3.6Post-incident reviews	35	29	31 in force, 4 proposed
	The 35 laws behind CM.AW-P7 and 3.6 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Data Security Law, Risk Monitoring and Incident Reporting Duty, China Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Digital Code, Livre II: Trust Service Provider Security-Incident Notification, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 25 more, every one in the free file.
	4.3Crisis management	35	29	31 in force, 4 proposed
	The 35 laws behind CM.AW-P7 and 4.3 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Data Security Law, Risk Monitoring and Incident Reporting Duty, China Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations, Croatia Security of Networks and Information Systems Law, Incident Notification Obligations, Cyprus Digital Code, Livre II: Trust Service Provider Security-Incident Notification, Democratic Republic of the Congo NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties, Denmark Digital Code, Book II: Electronic Communications Network and Service Security, Djibouti Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident, Estonia and 25 more, every one in the free file.
	6.10Vulnerability handling and disclosure	5	5	5 in force
	The 5 laws behind CM.AW-P7 and 6.10 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators, Finland Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties, Morocco Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure, Mozambique
	2.1Risk management framework	2	2	2 in force
	The 2 laws behind CM.AW-P7 and 2.1 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	4.1Business continuity and disaster recovery plan	2	2	2 in force
	The 2 laws behind CM.AW-P7 and 4.1 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	6.2Secure development life cycle	2	2	2 in force
	The 2 laws behind CM.AW-P7 and 6.2 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	6.5Security testing	2	2	2 in force
	The 2 laws behind CM.AW-P7 and 6.5 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	9.1Cryptography	2	2	2 in force
	The 2 laws behind CM.AW-P7 and 9.1 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
	11.2Management of access rights	2	2	2 in force
	The 2 laws behind CM.AW-P7 and 11.2 Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans...	1.1Policy on the security of network and information systems	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind PR.PO-P7 and 1.1 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	1.2Roles, responsibilities and authorities	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind PR.PO-P7 and 1.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	2.2Compliance monitoring	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind PR.PO-P7 and 2.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	3.2Monitoring and logging	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind PR.PO-P7 and 3.2 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	12.4Asset inventory	50	36	47 in force, 2 not yet in force, 1 proposed
	The 50 laws behind PR.PO-P7 and 12.4 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance, Croatia Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance, Cyprus Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures, Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.), Czech Republic and 40 more, every one in the free file.
	3.1Incident handling policy	32	24	30 in force, 2 not yet in force
	The 32 laws behind PR.PO-P7 and 3.1 Law No. 25/2024, On Cybersecurity, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union and 22 more, every one in the free file.
	2.1Risk management framework	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 2.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 4.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	6.2Secure development life cycle	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 6.2 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	6.5Security testing	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 6.5 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	6.10Vulnerability handling and disclosure	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 6.10 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	9.1Cryptography	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 9.1 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	11.2Management of access rights	28	21	27 in force, 1 not yet in force
	The 28 laws behind PR.PO-P7 and 11.2 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives, Czech Republic Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty, Democratic Republic of the Congo Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti and 18 more, every one in the free file.
	3.4Event assessment and classification	11	9	9 in force, 2 not yet in force
	The 11 laws behind PR.PO-P7 and 3.4 Law No. 25/2024, On Cybersecurity, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Nacionālās kiberdrošības likums, Incident Notification, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia and 1 more, every one in the free file.
	3.5Incident response	11	9	9 in force, 2 not yet in force
	The 11 laws behind PR.PO-P7 and 3.5 Law No. 25/2024, On Cybersecurity, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Nacionālās kiberdrošības likums, Incident Notification, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia and 1 more, every one in the free file.
	3.6Post-incident reviews	11	9	9 in force, 2 not yet in force
	The 11 laws behind PR.PO-P7 and 3.6 Law No. 25/2024, On Cybersecurity, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Nacionālās kiberdrošības likums, Incident Notification, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia and 1 more, every one in the free file.
	4.3Crisis management	11	9	9 in force, 2 not yet in force
	The 11 laws behind PR.PO-P7 and 4.3 Law No. 25/2024, On Cybersecurity, Albania Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident, Kiribati from a date not yet set Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Nacionālās kiberdrošības likums, Incident Notification, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia and 1 more, every one in the free file.
PR.PO-P8Response and recovery plans are tested.	2.1Risk management framework	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 2.1 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	3.1Incident handling policy	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 3.1 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	4.1Business continuity and disaster recovery plan	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 4.1 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	6.2Secure development life cycle	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 6.2 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	6.5Security testing	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 6.5 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	6.10Vulnerability handling and disclosure	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 6.10 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	9.1Cryptography	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 9.1 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	11.2Management of access rights	6	5	6 in force
	The 6 laws behind PR.PO-P8 and 11.2 OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification, Estonia DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 5-16 (ICT Risk Management Framework), European Union European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms, Ireland Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms, Luxembourg
	1.1Policy on the security of network and information systems	2	2	2 in force
	The 2 laws behind PR.PO-P8 and 1.1 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	1.2Roles, responsibilities and authorities	2	2	2 in force
	The 2 laws behind PR.PO-P8 and 1.2 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	2.2Compliance monitoring	2	2	2 in force
	The 2 laws behind PR.PO-P8 and 2.2 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	3.2Monitoring and logging	2	2	2 in force
	The 2 laws behind PR.PO-P8 and 3.2 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
	12.4Asset inventory	2	2	2 in force
	The 2 laws behind PR.PO-P8 and 12.4 DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models, New York
PR.PO-P10A vulnerability management plan is developed and implemented.	6.10Vulnerability handling and disclosure	16	12	14 in force, 2 not yet in force
	The 16 laws behind PR.PO-P10 and 6.10 Security Standards for Smart Devices, Australia Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Digital Code, Livre IV: ICT Product and Service Vendor Security Certification, Democratic Republic of the Congo Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union and 6 more, every one in the free file.
	3.1Incident handling policy	16	10	14 in force, 2 not yet in force
	The 16 laws behind PR.PO-P10 and 3.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union and 6 more, every one in the free file.
	2.1Risk management framework	14	10	12 in force, 2 not yet in force
	The 14 laws behind PR.PO-P10 and 2.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece and 4 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	14	10	12 in force, 2 not yet in force
	The 14 laws behind PR.PO-P10 and 4.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece and 4 more, every one in the free file.
	6.2Secure development life cycle	14	10	12 in force, 2 not yet in force
	The 14 laws behind PR.PO-P10 and 6.2 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece and 4 more, every one in the free file.
	6.5Security testing	14	10	12 in force, 2 not yet in force
	The 14 laws behind PR.PO-P10 and 6.5 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece and 4 more, every one in the free file.
	9.1Cryptography	14	10	12 in force, 2 not yet in force
	The 14 laws behind PR.PO-P10 and 9.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece and 4 more, every one in the free file.
	11.2Management of access rights	14	10	12 in force, 2 not yet in force
	The 14 laws behind PR.PO-P10 and 11.2 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil OSFI Guideline B-13, Technology and Cyber Risk Management, Canada Data Security Law, Risk Monitoring and Incident Reporting Duty, China Cyber Resilience Act, Essential Requirements and Manufacturer Obligations, European Union from 11 Dec 2027, in 14 months DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing), European Union EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union L-Category Vehicles, Protection Against Cyberattacks Under UN Regulation No 155 (Annex XVIII to Delegated Regulation (EU) No 44/2014), European Union from 11 Dec 2027, in 14 months Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece and 4 more, every one in the free file.
	3.5Incident response	5	5	5 in force
	The 5 laws behind PR.PO-P10 and 3.5 Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Livre IV: ICT Product and Service Vendor Security Certification, Democratic Republic of the Congo EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union
	1.1Policy on the security of network and information systems	2	2	1 in force, 1 not yet in force
	The 2 laws behind PR.PO-P10 and 1.1 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	1.2Roles, responsibilities and authorities	2	2	1 in force, 1 not yet in force
	The 2 laws behind PR.PO-P10 and 1.2 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	2.2Compliance monitoring	2	2	1 in force, 1 not yet in force
	The 2 laws behind PR.PO-P10 and 2.2 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	3.2Monitoring and logging	2	2	1 in force, 1 not yet in force
	The 2 laws behind PR.PO-P10 and 3.2 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
	3.4Event assessment and classification	2	2	2 in force
	The 2 laws behind PR.PO-P10 and 3.4 Cybersecurity Law, Network Product and Service Security Duties, China EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union
	3.6Post-incident reviews	2	2	2 in force
	The 2 laws behind PR.PO-P10 and 3.6 Cybersecurity Law, Network Product and Service Security Duties, China EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union
	4.3Crisis management	2	2	2 in force
	The 2 laws behind PR.PO-P10 and 4.3 Cybersecurity Law, Network Product and Service Security Duties, China EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure, European Union
	12.4Asset inventory	2	2	1 in force, 1 not yet in force
	The 2 laws behind PR.PO-P10 and 12.4 Cyber Resilience Act, Obligations of Open-Source Software Stewards, European Union from 11 Dec 2027, in 14 months Lag (2024:1278), DORA Supplementary Provisions, Sweden
PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for...	2.1Risk management framework	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 2.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	3.1Incident handling policy	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 3.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	4.1Business continuity and disaster recovery plan	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 4.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	6.2Secure development life cycle	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 6.2 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	6.5Security testing	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 6.5 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	6.10Vulnerability handling and disclosure	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 6.10 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	9.1Cryptography	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 9.1 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
	11.2Management of access rights	5	5	5 in force
	The 5 laws behind PR.AC-P1 and 11.2 Security Standards for Smart Devices, Australia Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Security of Connected Devices, California New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York Product Security Requirements for Connectable Products, United Kingdom
PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of...	2.1Risk management framework	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 2.1 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	3.1Incident handling policy	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 3.1 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	4.1Business continuity and disaster recovery plan	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 4.1 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	6.2Secure development life cycle	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 6.2 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	6.5Security testing	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 6.5 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	6.10Vulnerability handling and disclosure	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 6.10 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	9.1Cryptography	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 9.1 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
	11.2Management of access rights	6	3	6 in force
	The 6 laws behind PR.AC-P4 and 11.2 Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements, European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework, European Union DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York
PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated...	2.1Risk management framework	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 2.1 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	3.1Incident handling policy	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 3.1 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	4.1Business continuity and disaster recovery plan	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 4.1 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	6.2Secure development life cycle	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 6.2 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	6.5Security testing	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 6.5 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	6.10Vulnerability handling and disclosure	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 6.10 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	9.1Cryptography	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 9.1 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
	11.2Management of access rights	2	1	2 in force
	The 2 laws behind PR.AC-P6 and 11.2 DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
PR.DS-P2Data-in-transit are protected.	2.1Risk management framework	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 2.1 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	3.1Incident handling policy	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 3.1 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	4.1Business continuity and disaster recovery plan	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 4.1 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	6.2Secure development life cycle	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 6.2 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	6.5Security testing	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 6.5 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	6.10Vulnerability handling and disclosure	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 6.10 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	9.1Cryptography	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 9.1 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
	11.2Management of access rights	5	5	5 in force
	The 5 laws behind PR.DS-P2 and 11.2 Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms, Germany Data Classification Policy, Kuwait Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
PR.DS-P5Protections against data leaks are implemented.	2.1Risk management framework	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 2.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	3.1Incident handling policy	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 3.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	4.1Business continuity and disaster recovery plan	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 4.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	6.2Secure development life cycle	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 6.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	6.5Security testing	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 6.5 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	6.10Vulnerability handling and disclosure	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 6.10 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	9.1Cryptography	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 9.1 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.
	11.2Management of access rights	39	35	38 in force, 1 not yet in force
	The 39 laws behind PR.DS-P5 and 11.2 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi Customer Records Act, Reasonable Security Procedures, California Security of Connected Devices, California Data Security Law, Data Security Protection Obligations, China Protection of personal identifying information, reasonable security procedures duty, Colorado Connected device provider's duty to protect recorded personal information with reasonable security measures, Connecticut and 29 more, every one in the free file.

Not connected to the ENISA NIS2 guidance: 88 of NIST Privacy Framework's controls

Short of 2 laws

The same duties reach these and a ENISA NIS2 guidance requirement, in fewer than 2 of the laws we track.

ID.IM-P6 Data elements within the data actions are inventoried.: with 1.1, 1.2, 2.2, 3.2, 4.2, 12.2 and 12.4 through Data Classification Policy, Kuwait
ID.RA-P4 Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.: with 1.1, 1.2, 2.2, 3.2 and 12.4 through Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece
ID.DE-P3 Contracts with data processing ecosystem parties are used to implement appropriate...: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Data Breach Notification Act, reasonable security measures and disposal of records, Alabama
GV.PO-P2 Processes to instill organizational privacy values within system/product/service...: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Radio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment, European Union
CT.PO-P1 Policies, processes, and procedures for authorizing data processing (e.g.,...: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico
CM.AW-P1 Mechanisms (e.g., notices, internal or public reports) for communicating data...: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1), Mexico
PR.PO-P2 Configuration change control processes are established and in place.: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
PR.PO-P3 Backups of information are conducted, maintained, and tested.: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through BRH Circulaire 126, Information Security Rules for Financial Institutions, Haiti
PR.DS-P1 Data-at-rest are protected.: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
PR.DS-P3 Systems/products/services and associated data are formally managed throughout removal,...: with 1.1, 3.2, 4.2 and 12.2 through Data Classification Policy, Kuwait
PR.PT-P1 Removable media is protected and its use restricted according to policy.: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada
PR.PT-P2 The principle of least functionality is incorporated by configuring systems to provide...: with 2.1, 3.1, 4.1, 6.2, 6.5, 6.10, 9.1 and 11.2 through Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil

No ENISA NIS2 guidance requirement on the same duties

Laws reach these, but no duty that reaches one of them also reaches a ENISA NIS2 guidance requirement.

ID.IM-P2 Owners or operators (e.g., the organization or third parties such as service..., 2 laws
ID.IM-P4 Data actions of the systems/products/services are inventoried., 37 laws
ID.IM-P5 The purposes for the data actions are inventoried., 1 law
ID.IM-P7 The data processing environment is identified (e.g., geographic location, internal,..., 17 laws
ID.BE-P1 The organization’s role(s) in the data processing ecosystem are identified and communicated., 3 laws
ID.BE-P3 Systems/products/services that support organizational priorities are identified and..., 1 law
ID.RA-P2 Data analytic inputs and outputs are identified and evaluated for bias., 8 laws
ID.RA-P3 Potential problematic data actions and associated problems are identified., 5 laws
ID.RA-P5 Risk responses are identified, prioritized, and implemented., 15 laws
ID.DE-P1 Data processing ecosystem risk management policies, processes, and procedures are..., 1 law
ID.DE-P2 Data processing ecosystem parties (e.g., service providers, customers, partners,..., 29 laws
ID.DE-P5 Data processing ecosystem parties are routinely assessed using audits, test results,..., 7 laws
GV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such..., 98 laws
GV.PO-P3 Roles and responsibilities for the workforce are established with respect to privacy., 54 laws
GV.PO-P4 Privacy roles and responsibilities are coordinated and aligned with third-party..., 10 laws
GV.PO-P5 Legal, regulatory, and contractual requirements regarding privacy are understood and managed., 225 laws
GV.RM-P1 Risk management processes are established, managed, and agreed to by organizational..., 1 law
GV.AT-P1 The workforce is informed and trained on its roles and responsibilities., 9 laws
GV.AT-P3 Privacy personnel understand their roles and responsibilities., 1 law
GV.MT-P1 Privacy risk is re-evaluated on an ongoing basis and as key factors, including the..., 2 laws
GV.MT-P3 Policies, processes, and procedures for assessing compliance with legal requirements..., 16 laws
GV.MT-P4 Policies, processes, and procedures for communicating progress on managing privacy..., 7 laws
GV.MT-P5 Policies, processes, and procedures are established and in place to receive, analyze,..., 3 laws
GV.MT-P6 Policies, processes, and procedures incorporate lessons learned from problematic data actions., 1 law
GV.MT-P7 Policies, processes, and procedures for receiving, tracking, and responding to..., 32 laws
CT.PO-P2 Policies, processes, and procedures for enabling data review, transfer, sharing or..., 233 laws
CT.PO-P3 Policies, processes, and procedures for enabling individuals’ data processing..., 371 laws
CT.DM-P1 Data elements can be accessed for review., 69 laws
CT.DM-P2 Data elements can be accessed for transmission or disclosure., 22 laws
CT.DM-P3 Data elements can be accessed for alteration., 23 laws
CT.DM-P4 Data elements can be accessed for deletion., 22 laws
CT.DM-P6 Data are transmitted using standardized formats., 8 laws
CT.DM-P7 Mechanisms for transmitting processing permissions and related data values with data..., 1 law
CT.DM-P9 Technical measures implemented to manage data processing are tested and assessed., 2 laws
CT.DM-P10 Stakeholder privacy preferences are included in algorithmic design objectives and..., 78 laws
CT.DP-P1 Data are processed to limit observability and linkability (e.g., data actions take..., 8 laws
CT.DP-P2 Data are processed to limit the identification of individuals (e.g., de-identification..., 10 laws
CT.DP-P4 System or device configurations permit selective collection or disclosure of data elements., 10 laws
CT.DP-P5 Attribute references are substituted for attribute values., 1 law
CM.PO-P1 Transparency policies, processes, and procedures for communicating data processing..., 2 laws
CM.AW-P2 Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups)..., 1 law
CM.AW-P3 System/product/service design enables data processing visibility., 13 laws
CM.AW-P4 Records of data disclosures and sharing are maintained and can be accessed for review..., 12 laws
CM.AW-P5 Data corrections or deletions can be communicated to individuals or organizations..., 54 laws
CM.AW-P6 Data provenance and lineage are maintained and can be accessed for review or..., 2 laws
CM.AW-P8 Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent..., 5 laws
PR.PO-P1 A baseline configuration of information technology is created and maintained..., 1 law
PR.PO-P5 Protection processes are improved., 7 laws
PR.PO-P9 Privacy procedures are included in human resources practices (e.g., deprovisioning,..., 14 laws
PR.AC-P2 Physical access to data and devices is managed., 6 laws
PR.AC-P5 Network integrity is protected (e.g., network segregation, network segmentation)., 2 laws
PR.DS-P4 Adequate capacity to ensure availability is maintained., 1 law
PR.MA-P1 Maintenance and repair of organizational assets are performed and logged, with..., 1 law
PR.PT-P3 Communications and control networks are protected., 1 law
PR.PT-P4 Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve..., 6 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

ID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
ID.IM-P8 Data processing is mapped, illustrating the data actions and associated data elements...
ID.BE-P2 Priorities for organizational mission, objectives, and activities are established and...
ID.RA-P1 Contextual factors related to the systems/products/services and the data actions are...
ID.DE-P4 Interoperability frameworks or similar multi-party approaches are used to manage data...
GV.PO-P6 Governance and risk management policies, processes, and procedures address privacy risks.
GV.RM-P2 Organizational risk tolerance is determined and clearly expressed.
GV.RM-P3 The organization’s determination of risk tolerance is informed by its role(s) in the...
GV.AT-P2 Senior executives understand their roles and responsibilities.
GV.AT-P4 Third parties (e.g., service providers, customers, partners) understand their roles...
GV.MT-P2 Privacy values, policies, and training are reviewed and any updates are communicated.
CT.PO-P4 A data life cycle to manage data is aligned and implemented with the system...
CT.DP-P3 Data are processed to limit the formulation of inferences about individuals’ behavior...
CM.PO-P2 Roles and responsibilities (e.g., public relations) for communicating data processing...
PR.PO-P4 Policy and regulations regarding the physical operating environment for organizational...
PR.PO-P6 Effectiveness of protection technologies is shared.
PR.AC-P3 Remote access is managed.
PR.DS-P6 Integrity checking mechanisms are used to verify software, firmware, and information integrity.
PR.DS-P7 The development and testing environment(s) are separate from the production environment.
PR.DS-P8 Integrity checking mechanisms are used to verify hardware integrity.
PR.MA-P2 Remote maintenance of organizational assets is approved, logged, and performed in a...

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the ENISA NIS2 guidance through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws on	Read against the NIST Privacy Framework
cybersecurity	every such line

Every duty line in the cybersecurity laws we track has been read against the framework for its subject.

Sources and licenses

ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.