Law / Cybersecurity
Cybersecurity law, instrument by instrument
Law that sets security duties for software, connected products and the companies behind them: secure design before a product goes on sale, handling reported vulnerabilities, deadlines to report an incident or an exploited flaw, and a baseline of reasonable security for the data you hold. In practice, it applies when you ship software or a connected device, or run a service in a regulated sector.
Every cybersecurity law instrument LexLint holds, grouped by the jurisdiction that made it. Choose which stages of law to show: the map, the counts and the tables all answer to that choice. To see every area of law, follow Law in the breadcrumb above.
- 1
- 5
- 10
- 20+
- instruments shown
- law on file, none at these stages
- tracked, no law on file
- not tracked
Unions44 in 1 jurisdiction
Law made above the state, binding its members.
Countries674 in 168 jurisdictions
Grouped by region, the European Union heading its member states as a block; alphabetical within each group.
| Instrument | When |
|---|---|
| Europe | |
| European Union · 27 member states | |
 Austria
at
6 instruments
| |
| Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident CriteriaNISV 2026, BGBl. II Nr. 290/2026, §§ 2 bis 5 und 7 | since |
| Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management MeasuresNISG 2026, BGBl. I Nr. 94/2025, §§ 24, 25, 28 und 32 | since |
| Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting ObligationsNISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35 | since |
| Telekommunikationsgesetz 2021 (TKG 2021), Section 44 Cybersecurity Measures of Operators and ProvidersTKG 2021, BGBl. I Nr. 190/2021, § 44 idF BGBl. I Nr. 94/2025 | since |
| DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk PenaltiesDORA-VG, BGBl. I Nr. 112/2024, Art. 1, §§ 2, 3, 7 und 8 | since |
| Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity CertificationCSZG, BGBl. I Nr. 78/2024, §§ 3, 4, 6 und 7 | since |
| Netz- und Informationssystemsicherheitsgesetz (NISG), Incident Notification ObligationsNISG, BGBl. I Nr. 111/2018, §§ 19 und 21 | |
| Netz- und Informationssystemsicherheitsgesetz (NISG), Security Measures for Operators of Essential Services and Digital Service ProvidersNISG, BGBl. I Nr. 111/2018, §§ 17 und 21 | |
 Belgium
be
4 instruments
| |
| Law of 25 March 2025 on the digital operational resilience of the financial sector (DORA implementation), Competent AuthoritiesArt. 5 et 13 de la loi du 25 mars 2025 relative à la résilience opérationnelle numérique du secteur financier | since |
| Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and GovernanceLoi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 30-33 | since |
| Loi du 26 avril 2024, Significant-Incident Notification ObligationsLoi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 34-37 | since |
| Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G InfrastructureLoi du 17 février 2022 (article 105 de la loi du 13 juin 2005 relative aux communications électroniques), mesures de sécurité supplémentaires pour la fourniture de services mobiles 5G | since |
 Bulgaria
bg
3 instruments
| |
| Cybersecurity Act (Zakon za kibersigurnost, ZKS), Certified ICT Products and Restriction of Risky TechnologiesЗакон за киберсигурност (ЗКС), чл. 24 и 27, изм. с §§ 28 и 31 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 24 and 27, as replaced by §§ 28 and 31 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of ) | since |
| Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of ) | since |
| Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)Закон за киберсигурност (ЗКС), чл. 21 и 22, изм. с §§ 25 и 26 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 21 and 22, as substituted by §§ 25 and 26 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of ) | since |
 Croatia
hr
4 instruments
| |
| Uredba o provedbi Akta o kibernetičkoj solidarnosti, Competent Authorities for the Cyber Solidarity Actčl. 3-5, Uredba o provedbi Akta o kibernetičkoj solidarnosti (NN 78/2026) | since |
| Zakon o provedbi Uredbe (EU) 2022/2554, Competent Authorities, Incident Reporting and Fines for Financial Entitiesčl. 7, 14 i 19, Zakon o provedbi Uredbe (EU) 2022/2554 (NN 136/2024) | since |
| Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting ObligationsZakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 37.-44.; Uredba o kibernetičkoj sigurnosti, Narodne novine, broj 135/2024, čl. 64.-71. i 85. | since |
| Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and GovernanceZakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 29. i 30. | since |
 Cyprus
cy
4 instruments
| |
| Notice K.D.P. 252/2025 Designating the Competent Authorities under Regulation (EU) 2022/2554 (DORA)K.D.P. 252/2025 (Notice on the application of Articles 19 and 46 of Regulation (EU) 2022/2554), Official Gazette Annex III(I) No. 5963 of | since |
| Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and GovernanceArts. 35 and 35A of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 | since |
| Security of Networks and Information Systems Law, Incident Notification ObligationsArt. 35B of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 | since |
| Security of Networks and Information Systems Law, Radio Equipment Cybersecurity RequirementsArt. 42A of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as inserted by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 | since |
 Czech Republic
cz
7 instruments
| |
| Cybersecurity Act (Zákon o kybernetické bezpečnosti), Cybersecurity Certification: Authorisation, Suspension and OffencesAct No. 264/2025 Coll., Cybersecurity Act, Sections 47, 57 and 61 | since |
| Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident NotificationAct No. 264/2025 Coll., Cybersecurity Act, Sections 15-16 | since |
| Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security MeasuresAct No. 264/2025 Coll., Cybersecurity Act, Sections 13-14 | since |
| Decree on Regulated Services (Vyhláška o regulovaných službách), Service List, Significance Conditions and RegimesDecree No. 408/2025 Coll., on Regulated Services, Sections 2 and 3 and the Annex | since |
| Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.)Decree No. 409/2025 Coll., on Security Measures of a Higher-Obligations Provider, Sections 3 to 26 | since |
| Decree on the Security Measures of a Provider of a Regulated Service in the Lower-Obligations Regime (Vyhláška č. 410/2025 Sb.)Decree No. 410/2025 Coll., on Security Measures of a Lower-Obligations Provider, Sections 3 to 14 | since |
| Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operativesAct No. 32/2025 Coll., Parts Two and Three (Banks Act Sections 8b and 25c) | since |
 Denmark
dk
4 instruments
| |
| Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management MeasuresLov nr. 435 af 6. maj 2025, §§ 3-7 og 31 | since |
| Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Significant Incident NotificationLov nr. 435 af 6. maj 2025, §§ 8, 9 og 11 | since |
| NIS 2-loven, Cybersecurity Risk-Management Measures and RegistrationNIS 2-loven, §§ 6-10 | since |
| NIS 2-loven, Significant-Incident Reporting and Recipient-Notice DutiesNIS 2-loven, §§ 12-13, 15 | since |
 Estonia
ee
3 instruments
| |
| Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber IncidentKüberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 8 and 8-1, as amended by RT I, 06.10.2026, 1 | since |
| Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body DutiesKüberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 6-1 and 7, as amended by RT I, 06.10.2026, 1 | since |
| Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident NotificationRT I, 11.10.2024, 1, §§ 1 and 7 (Credit Institutions Act §§ 82^4 and 92^4) | since |
 Finland
fi
8 instruments
| |
| Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience ActLaki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026), 1, 7-9, 15-16 ja 31-38 § | since |
| Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars172 a-172 d §, Laki sähköisen viestinnän palveluista (917/2014) | since |
| Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and GovernanceKyberturvallisuuslaki (124/2025), 3 ja 7-10 § | since |
| Kyberturvallisuuslaki, Significant-Incident Reporting ObligationsKyberturvallisuuslaki (124/2025), 11-14 ja 22 § | since |
| Laki Finanssivalvonnasta, Supervision and Sanctions for the Digital Operational Resilience Regulation38 ja 40 §, Laki Finanssivalvonnasta (878/2008), DORA provisions | since |
| Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems79-90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023) | since |
| Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023) | since |
| Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators274 ja 275 §, Laki sähköisen viestinnän palveluista (917/2014) | since |
 France
fr
4 instruments
| |
| Loi n° 2024-449 (SREN), Security Criteria for State Use of Private Cloud Services Holding Sensitive DataArticle 31, Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique | since |
| Loi n° 2022-309 du 3 mars 2022 (loi Cyberscore), Cybersecurity Audit and Disclosure DutyLoi n° 2022-309 du 3 mars 2022, art. 1 (Code de la consommation, art. L. 111-7-3) | since |
| Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident NotificationLoi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13 | since |
| Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Security RequirementsLoi n° 2018-133 du 26 février 2018, Titre Ier, Chapitres II et III, art. 5, 6, 10, 11 et 12 | since |
| Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2)Article 14, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (mesures de gestion des risques) | proposed |
| Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Incident Notification (NIS2)Article 17, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (notification des incidents) | proposed |
 Germany
de
5 instruments
| |
| BSI-Gesetz (BSIG), Incident NotificationBSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of (BGBl. 2026 I Nr. 318), § 32 | since |
| BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important EntitiesBSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of (BGBl. 2026 I Nr. 318), §§ 28, 30, 38 | since |
| Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services FirmsWpHG § 80 Abs. 1 Satz 2 Nr. 1 und 4, as amended by Art. 4 Nr. 12 FinmadiG (BGBl. 2024 I Nr. 438) | since |
| Bürgerliches Gesetzbuch (BGB), Section 327f Updates, Including Security Updates, for Digital ProductsBGB § 327f, Aktualisierungen | since |
| Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective MeasuresTKG § 165, Technische und organisatorische Schutzmaßnahmen | since |
 Greece
gr
4 instruments
| |
| Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things DevicesΝ. 4961/2022 (ΦΕΚ Α' 146/27.07.2022), Chapter Γ' of Part B, Arts. 32-42 | since |
| Law 5160/2024, Cybersecurity Risk-Management Measures and GovernanceLaw 5160/2024 (Ν. 5160/2024), Arts. 14-15 | since |
| Law 5160/2024, Significant-Incident Reporting ObligationsLaw 5160/2024 (Ν. 5160/2024), Art. 16 | since |
| Law 5086/2024 (Ν. 5086/2024), National Cybersecurity AuthorityΝ. 5086/2024 (ΦΕΚ Α' 23/14.02.2024), Arts. 3, 4 and 40 | in force |
 Hungary
hu
4 instruments
| |
| 2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems26/B. §, 2007. évi CXXXVIII. törvény (Bszt.) | since |
| 2024. évi LXIX. törvény, National Cybersecurity Certification Schemes37. és 38. §, 2024. évi LXIX. törvény (IV. fejezet) | since |
| Cybersecurity Act, Incident Notification and Cybersecurity Fine2024. évi LXIX. törvény, 66. §; 418/2024. (XII. 23.) Korm. rendelet, 42. § és 77. § | since |
| Cybersecurity Act, Risk-Management Measures2024. évi LXIX. törvény (Magyarország kiberbiztonságáról), 6. § | since |
 Ireland
ie
5 instruments
| |
| European Union (Radio Equipment) Regulations 2026, Essential Requirements for Internet-Connected Radio EquipmentS.I. No. 14 of 2026, regs. 4(5) and 58 | since |
| European Union (Digital Operational Resilience) (No. 2) Regulations 2025, Competent Authority and SanctionsS.I. No. 20 of 2025, regs. 3 to 7 | since |
| European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial FirmsS.I. No. 12 of 2025, regs. 2 to 7 | since |
| European Union (NIS) Regulations 2018, Incident NotificationS.I. No. 360/2018, Regs. 18 and 22 | since |
| European Union (NIS) Regulations 2018, Security RequirementsS.I. No. 360/2018, Regs. 17 and 21 | since |
| National Cyber Security Bill, Cybersecurity Risk-Management MeasuresHead 29, General Scheme, National Cyber Security Bill 2024 | proposed |
| National Cyber Security Bill, Incident Response Powers and Reporting ObligationsHead 15, General Scheme, National Cyber Security Bill 2024 | proposed |
 Italy
it
4 instruments
| |
| Decreto legislativo 10 marzo 2025, n. 23, DORA Competent Authorities and Regulatory PowersArtt. 3 e 9, Decreto legislativo 10 marzo 2025, n. 23 | since |
| Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident NotificationD.Lgs. 4 settembre 2024, n. 138, Art. 25 | since |
| Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management MeasuresD.Lgs. 4 settembre 2024, n. 138, Artt. 23 e 24 | since |
| Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation DutiesArtt. 1 e 2, Legge 28 giugno 2024, n. 90 | since |
| Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident NotificationArtt. 2-4, 6, 7, Determinazione ACN 14 aprile 2025, n. 164179 | |
 Latvia
lv
6 instruments
| |
| Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORALatvijas Bankas noteikumi Nr. 409, Prasības digitālās darbības nepārtrauktības un noturības jomā finanšu tirgus dalībniekiem, kuriem nepiemēro Regulu (ES) 2022/2554 (2026. gada 5. janvāris) | since |
| Financial Market Digital Operational Resilience Law, DORA Provisions4. līdz 6. un 8. līdz 11. pants (DORA daļa), Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums (2025. gada 11. septembris) | since |
| Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity RequirementsMinistru kabineta noteikumi Nr. 397, Minimālās kiberdrošības prasības (2025. gada 25. jūnijs) | since |
| Nacionālās kiberdrošības likums, Incident NotificationNacionālās kiberdrošības likums (adopted 20.06.2024, notification clock applying from 01.07.2025), 34. pants | since |
| Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and RemediationNacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024), 39.-40. panti | since |
| Nacionālās kiberdrošības likums, Cybersecurity Risk-Management MeasuresNacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024, amended by the law of 04.06.2026, in force 18.06.2026; redakcija no 01.10.2026), 25.-28. panti | since |
 Lithuania
lt
3 instruments
| |
| Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident NotificationLietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of , in force since , and amended by Nr. XV-894 of and Nr. XV-1076 of (consolidated edition of ), Art. 18 | since |
| Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management MeasuresLietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of , in force since , and amended by Nr. XV-894 of and Nr. XV-1076 of (consolidated edition of ), Art. 14 | since |
| Lietuvos Respublikos elektroninių ryšių įstatymas, National-Security Vetting of Telecommunications Equipment and Software Suppliers69 straipsnio 2-5 dalys, Lietuvos Respublikos elektroninių ryšių įstatymas Nr. IX-2135 | since |
 Luxembourg
lu
4 instruments
| |
| Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident NotificationLoi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 14 | since |
| Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important EntitiesLoi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 11, 12, 13 | since |
| Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial FirmsArt. 5 et 20-21 à 20-25, Loi du 1er juillet 2024 (Mémorial A n° 271) | since |
| Loi du 20 décembre 2024, Cybersecurity Certification Authority and Vulnerability NoticesArt. 1, 5 et 6, Loi du 20 décembre 2024 (Mémorial A n° 604) | since |
 Malta
mt
6 instruments
| |
| Cyber Resilience Regulations, MDIA Designation under the Cyber Resilience ActNew, enacted S.L. 591.6, Cyber Resilience Regulations, made under Chapter 591 (Malta Digital Innovation Authority Act) | since |
| Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important EntitiesS.L. 460.41, arts. 18, 19 and 24, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order | since |
| Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRTS.L. 460.41, art. 20, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order | since |
| Malta DORA Regulations (S.L. 330.20)S.L. 330.20, Malta Financial Services Authority Act (Digital Operational Resilience Act (DORA)) Regulations, 2024 (L.N. 166 of 2024) | since |
| Electronic Communications Networks and Services (General) Regulations, Security Incident Notification to the Malta Communications AuthorityL.N. 379 of 2021, reg. 28, Electronic Communications Networks and Services (General) Regulations | since |
| Gaming Authorisations and Compliance Directive, Notification of Information Security BreachesMalta Gaming Authority Directive 3 of 2018, Gaming Authorisations and Compliance Directive, art. 37(2)(c) and (d) | since |
 Netherlands
nl
3 instruments
| |
| Cyberbeveiligingsbesluit, Security Measures and Incident Notification DetailsCyberbeveiligingsbesluit (Besluit van 8 juli 2026), Artt. 2, 4-13 en 24-25 | since |
| Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and GovernanceCyberbeveiligingswet, Artt. 21 en 24 | since |
| Cyberbeveiligingswet, Significant-Incident Reporting ObligationsCyberbeveiligingswet, Artt. 25-29 | since |
 Poland
pl
3 instruments
| |
| Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów PoważnychArt. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) | since |
| Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting ProvisionsUstawa z dnia 25 czerwca 2025 r. (Dz.U. 2025 poz. 1069), art. 18za do 18zl ustawy o nadzorze nad rynkiem finansowym i art. 133 ust. 2b Prawa bankowego | since |
| Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), System Zarządzania Bezpieczeństwem InformacjiArt. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) | from , in 5 months |
 Portugal
pt
4 instruments
| |
| Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and GovernanceDecreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 25.º a 29.º | since |
| Regime Jurídico da Cibersegurança, Significant-Incident Reporting ObligationsDecreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º | since |
| Lei n.º 73/2025, Digital Operational Resilience of the Financial SectorLei n.º 73/2025, de 23 de dezembro (resiliência operacional digital do setor financeiro), artigos 1.º a 12.º | since |
| Decreto-Lei n.º 84/2021, Security Updates for Goods With Digital Elements and Digital ContentDecreto-Lei n.º 84/2021, de 18 de outubro (conformidade de bens, conteúdos e serviços digitais), artigos 8.º e 29.º | since |
 Romania
ro
6 instruments
| |
| DNSC Order 1/2025, Notification for Registration of Essential and Important EntitiesOrdinul directorului DNSC nr. 1/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-6 | since |
| DNSC Order 2/2025, Service-Disruption Criteria and Entity Risk-Level MethodologyOrdinul directorului DNSC nr. 2/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-5 | since |
| Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management MeasuresOrdonanța de urgență a Guvernului nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 11-14 | since |
| Ordonanța de urgență nr. 155/2024, Incident NotificationOrdonanța de urgență a Guvernului nr. 155 din 30 decembrie 2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 15-17 | since |
| Ordonanța de urgență nr. 140/2021, Updates and Security Updates for Goods With Digital ElementsOrdonanța de urgență a Guvernului nr. 140/2021 privind anumite aspecte referitoare la contractele de vânzare de bunuri, art. 6 și 18 | since |
| Ordonanța de urgență nr. 141/2021, Updates and Security Updates for Digital Content and Digital ServicesOrdonanța de urgență a Guvernului nr. 141/2021 privind anumite aspecte referitoare la contractele de furnizare de conținut digital și de servicii digitale, art. 5, 7 și 21 | in force |
 Slovakia
sk
5 instruments
| |
| Vyhláška MD SR č. 111/2026 Z. z., Transport Sector Security MeasuresVyhláška Ministerstva dopravy Slovenskej republiky č. 111/2026 Z. z. o sektorových bezpečnostných opatreniach (25. mája 2026) | since |
| Vyhláška NBÚ č. 226/2025 Z. z., Details of Cyber Security ReportsVyhláška Národného bezpečnostného úradu č. 226/2025 Z. z. o podrobnostiach o hláseniach (26. augusta 2025) | since |
| Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security DocumentationVyhláška Národného bezpečnostného úradu č. 227/2025 Z. z. o bezpečnostných opatreniach (26. augusta 2025), § 1 až 6 | since |
| Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability NotificationZákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., § 24 a § 5 ods. 5 | since |
| Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management MeasuresZákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., §§ 17 až 20 | since |
 Slovenia
si
3 instruments
| |
| Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and GovernanceZakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 20-22 | since |
| ZEKom-2, Operator Security Measures (Articles 115 and 116)Zakon o elektronskih komunikacijah (ZEKom-2), 115. in 116. člen, v besedilu iz 65. člena ZInfV-1 (Uradni list RS, št. 40/25) | since |
| Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification ObligationsZakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 29-30 | since |
 Spain
es
4 instruments
| |
| Real Decreto-ley 8/2023, Article 4, ICT Risk-Management Obligations of Payment System Operators, Payment Processors and Other Technology ProvidersArt. 4 del Real Decreto-ley 8/2023, de 27 de diciembre | since |
| Real Decreto-ley 7/2022 on the Security of 5G Networks and Services, Duties of 5G Operators, Suppliers and Corporate UsersArts. 12, 13, 15 y 17 del Real Decreto-ley 7/2022, de 29 de marzo | since |
| Real Decreto-ley 12/2018, Incident Notification ObligationReal Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero | since |
| Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service ProvidersReal Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero | since |
| Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Cybersecurity Risk-Management MeasuresAnteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on (transposing Directive (EU) 2022/2555) | proposed |
| Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Incident Reporting ObligationsAnteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on (transposing Directive (EU) 2022/2555) | proposed |
 Sweden
se
4 instruments
| |
| Cybersäkerhetsförordning (2025:1507), Notification Channels and Supervisory AuthoritiesCybersäkerhetsförordning (2025:1507), 4-8 §§ och 18 § | since |
| Cybersäkerhetslag, Cybersecurity Risk-Management MeasuresCybersäkerhetslag (2025:1506), 2 kap. 3-4 §§ | since |
| Cybersäkerhetslag, Incident NotificationCybersäkerhetslag (2025:1506), 2 kap. 5-10 §§ | since |
| Lag (2024:1278), DORA Supplementary ProvisionsLag (2024:1278) med kompletterande bestämmelser till EU:s förordning om digital operativ motståndskraft för finanssektorn, 1-5 kap. | since |
| Europe (non EU) | |
 Albania
al
5 instruments
| |
| AKEP Regulation On Organisational and Technical Security Measures, Incident ReportingAKEP Regulation on Network and Service Security, arts. 6, 11 and 12 | since |
| AKEP Regulation On Organisational and Technical Security Measures, Security Programme and ReportingAKEP Regulation on Network and Service Security, arts. 7, 10 and 12 | since |
| Law On Electronic Communications, Security of Public Networks and ServicesLaw No. 54/2024 On Electronic Communications in the Republic of Albania, arts. 54, 56 and 184 | since |
| Law No. 25/2024, On CybersecurityLaw No. 25/2024 (Ligj Nr. 25/2024), , "Për sigurinë kibernetike" ("On Cybersecurity"), Fletorja Zyrtare No. 67/2024, p. 7767 | since |
| Law On Cybersecurity, Incident Reporting by Operators of Critical and Important Information InfrastructureLaw No. 25/2024 On Cybersecurity, arts. 23, 26(3) and 44-45 | since |
 Andorra
ad
5 instruments
| |
| Llei 22/2022, Cybersecurity Risk-Management ObligationsLlei 22/2022, del 9 de juny, arts. 12, 13, 17 i 18 | since |
| Llei 22/2022, Incident Handling and Notification ObligationLlei 22/2022, del 9 de juny, arts. 14 i 15 | since |
| Decret 417/2022, National Security Scheme Regulation, Security Management System and AuditDecret 417/2022, del 12 d’octubre del 2022, pel qual s’aprova el Reglament de l’Esquema nacional de seguretat del Principat d’Andorra, arts. 3, 8, 12, 14, 15 i 16 | in force |
| Decret 418/2022, Critical Infrastructure Regulation, Cybersecurity Incidents of Critical EntitiesDecret 418/2022, del 12 d’octubre del 2022, pel qual s’aprova el Reglament d’infraestructures crítiques del Principat d’Andorra, art. 13 | in force |
| Decret 418/2022, Critical Infrastructure Regulation, Security Plan, Audit and Supplier GuaranteesDecret 418/2022, del 12 d’octubre del 2022, pel qual s’aprova el Reglament d’infraestructures crítiques del Principat d’Andorra, arts. 3, 5, 10 i 12 | in force |
 Belarus
by
3 instruments
| |
| Decree 40 On Cybersecurity: Cyber Incident Reporting to the National Cybersecurity CenterDecree 40 On Cybersecurity, paras. 3.3 and 3.8 (Указ Президента Республики Беларусь от 14 февраля 2023 г. № 40 «О кибербезопасности») | in force |
| Decree 40 On Cybersecurity: Cybersecurity Centers and Duties of Designated OrganizationsDecree 40 On Cybersecurity, paras. 3.1 to 3.15 and Annex 1 (Указ Президента Республики Беларусь от 14 февраля 2023 г. № 40 «О кибербезопасности») | in force |
| Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)Law of the Republic of Belarus No. 455-Z of On Information, Informatization and Protection of Information (as amended by Law No. 209-Z of ), art. 40 | in force |
 Bosnia and Herzegovina
ba
2 instruments
| |
| Republika Srpska Rulebook on Information Security Standards, Security Incident Management and ReportingRepublika Srpska Rulebook on Information Security Standards, arts. 2 and 107-108 | since |
| Republika Srpska Law on Information Security, Security Measures for Republic Bodies and Those Handling Their DataRepublika Srpska Law on Information Security, arts. 2, 4-9 and 12-13 | in force |
 Iceland
is
6 instruments
| |
| Digital Operational Resilience of the Financial Market: ICT Risk Management and TestingLog nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 30) | since |
| Digital Operational Resilience of the Financial Market: ICT-Related Incident Management and ReportingLog nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 17 to 19) | since |
| Notification of Security Incidents by Telecommunications Companies and Information to UsersLog nr. 70/2022 um fjarskipti, Art. 80 and 81(1) | since |
| Security Policy and Risk Management of Telecommunications CompaniesLog nr. 70/2022 um fjarskipti, Art. 78 and 103 | since |
| Minimum Risk-Management and Preparedness Requirements for Critical InfrastructureLog nr. 78/2019, Art. 7 | since |
| Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response TeamLog nr. 78/2019, Art. 8 | since |
 Liechtenstein
li
6 instruments
| |
| Cyber-Sicherheitsgesetz (CSG), Incident NotificationCyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 6 | since |
| Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important EntitiesCyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 1, 3, 4, 5 | since |
| EEA DORA Implementation Act (EWR-DORA-DG), ICT Risk Management and Resilience TestingGesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG), LGBl. 2025 Nr. 121, Art. 2, 9 | since |
| EEA DORA Implementation Act (EWR-DORA-DG), Reporting of Major ICT-Related IncidentsGesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG), LGBl. 2025 Nr. 121, Art. 9 Abs. 2 Bst. a Ziff. 3 and Art. 19 of the Regulation | since |
| Communications Act (Kommunikationsgesetz, KomG), Integrity and Availability of Networks and ServicesGesetz vom 17. März 2006 über die elektronische Kommunikation (Kommunikationsgesetz; KomG), LGBl. 2006 Nr. 91, Art. 17 Abs. 1 bis 3 | in force |
| Communications Act (Kommunikationsgesetz, KomG), Notification of Security BreachesGesetz vom 17. März 2006 über die elektronische Kommunikation (Kommunikationsgesetz; KomG), LGBl. 2006 Nr. 91, Art. 17 Abs. 4 | in force |
 Moldova
md
2 instruments
| |
| Law 48/2023 on Cybersecurity: Cyber Incident NotificationLaw 48/2023 on Cybersecurity, art. 12 (Legea nr. 48 din 16 martie 2023 privind securitatea cibernetică) | since |
| Law 48/2023 on Cybersecurity: Service Provider Security MeasuresLaw 48/2023 on Cybersecurity, arts. 3, 11, 14 and 19 (Legea nr. 48 din 16 martie 2023 privind securitatea cibernetică) | since |
 Monaco
mc
2 instruments
| |
| Technological Crime Law: Vital-Importance Operator Incident ReportingLoi n° 1.435 du 8 novembre 2016, art. 28 (incidents), et arrêté ministériel n° 2018-1053, arts. 4 à 4-2 | since |
| Technological Crime Law: Vital-Importance Operator Information-Systems Security RegimeLoi n° 1.435 du 8 novembre 2016, Titre III, arts. 26 à 29, et arrêté ministériel n° 2018-1053, arts. 1er à 3-1 | since |
 Montenegro
me
3 instruments
| |
| Law on Information Security, Cyber Threat and Incident ReportingLaw on Information Security, Arts. 28 to 37 | since |
| Law on Information Security, Essential and Important EntitiesLaw on Information Security, Arts. 4, 16, 18(4) to (6), and 19 to 27 | since |
| Law on Information Security, General Security MeasuresLaw on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3) | since |
 North Macedonia
mk
2 instruments
| |
| Law on Security of Network and Information Systems, Entities Covered and Cyber Security Risk Management MeasuresLaw on Security of Network and Information Systems, arts. 4, 8 and 31-32 | since |
| Law on Security of Network and Information Systems, Significant Incident and Threat NotificationLaw on Security of Network and Information Systems, arts. 33 and 54 | since |
 Norway
no
6 instruments
| |
| Incident Notification by Providers of Essential Societal Services and Digital ServicesLov om digital sikkerhet (digitalsikkerhetsloven), §§ 8 and 11 | since |
| Security Requirements for Providers of Essential Societal Services and Digital ServicesLov om digital sikkerhet (digitalsikkerhetsloven), §§ 7 and 10 | since |
| Digital Operational Resilience in the Financial Sector: ICT Incident Management and ReportingLov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven), §§ 1, 3 and 4 (Regulation (EU) 2022/2554, Arts. 17 to 19) | since |
| Digital Operational Resilience in the Financial Sector: ICT Risk Management and TestingLov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven), §§ 1, 3 and 4 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 42) | since |
| Notification of Security Incidents by Electronic Communications ProvidersLov om elektronisk kommunikasjon (ekomloven), §§ 3-2 and 3-3 | in force |
| Security and Preparedness Duty of Electronic Communications ProvidersLov om elektronisk kommunikasjon (ekomloven), § 3-1 | in force |
 Russia
ru
2 instruments
| |
| Federal Law 187-FZ on the Security of Critical Information Infrastructure: Computer Incident ReportingLaw 187-FZ, art. 9(2) and (3) (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации) | since |
| Federal Law 187-FZ on the Security of Critical Information Infrastructure: Obligations of SubjectsLaw 187-FZ, arts. 2, 7, 9, 10 and 14 (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации) | since |
 San Marino
sm
2 instruments
| |
| San Marino Central Bank Regulation on Crypto-Assets, Information System SecurityRegolamento BCSM n. 2024-03 in materia di cripto-attività, articolo VII.V.13, commi 4 e 5 | since |
| San Marino Central Bank Regulation on Investment Services and Activities, Information System SecurityRegolamento BCSM n. 2024-05 in materia di servizi e attività di investimento, articolo VII.VI.13, commi 4 e 5 | since |
 Serbia
rs
4 instruments
| |
| Law on Information Security, ICT Systems of Special Importance and Security MeasuresZakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 5-12 | since |
| Law on Information Security, Incident Reporting ObligationsZakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 13-14, 24-25 | since |
| Law on Electronic Communications, Notification of Security and Integrity Breaches to the RegulatorZakon o elektronskim komunikacijama ("Sl. glasnik RS", br. 35/2023), čl. 157(5)-(7) i 169 | since |
| Law on Electronic Communications, Security and Integrity of Public Networks and ServicesZakon o elektronskim komunikacijama ("Sl. glasnik RS", br. 35/2023), čl. 157(1)-(4) i 169 | since |
 Switzerland
ch
6 instruments
| |
| Mandatory Reporting of Cyberattacks on Critical InfrastructureBundesgesetz vom 18. Dezember 2020 über die Informationssicherheit (Informationssicherheitsgesetz, ISG), SR 128, Art. 74a-74h | since |
| Protection of Electricity Installations Against Cyber ThreatsBundesgesetz vom 23. März 2007 über die Stromversorgung (Stromversorgungsgesetz, StromVG), SR 734.7, Art. 8a | since |
| Duty of Telecom Providers to Report Network DisruptionsVerordnung vom 9. März 2007 über Fernmeldedienste (FDV), SR 784.101.1, Art. 96 | since |
| Security Management Duties of Mobile Network Concession HoldersVerordnung vom 9. März 2007 über Fernmeldedienste (FDV), SR 784.101.1, Art. 96d to 96g | since |
| Security Measures of Internet Access ProvidersVerordnung vom 9. März 2007 über Fernmeldedienste (FDV), SR 784.101.1, Art. 96a to 96c | since |
| Duty of Supervised Financial Institutions to Report Events of Substantial ImportanceBundesgesetz vom 22. Juni 2007 über die Eidgenössische Finanzmarktaufsicht (Finanzmarktaufsichtsgesetz, FINMAG), SR 956.1, Art. 29 Abs. 2 | in force |
 Ukraine
ua
3 instruments
| |
| Law on Critical Infrastructure, Operator Duty to Inform Authorities of Physical and Cyber Security IncidentsЗакон України "Про критичну інфраструктуру" № 1882-IX від 16.11.2021, ст. 21(1) | since |
| Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification DutyЗакон України "Про основні засади забезпечення кібербезпеки України" № 2163-VIII від 05.10.2017 (редакція від 03.04.2025, підстава - 4070-IX), ст. 6(4)-(5), ст. 9(2) | since |
| Law on the Basic Principles of Ensuring Cybersecurity, Critical Infrastructure Owner Cyber-Defense and Audit DutyЗакон України "Про основні засади забезпечення кібербезпеки України" № 2163-VIII від 05.10.2017 (редакція від 03.04.2025, підстава - 4070-IX), ст. 6(4) | since |
 United Kingdom
gb
7 instruments
| |
| Product Security Requirements for Connectable ProductsProduct Security and Telecommunications Infrastructure Act 2022, c. 46, Part 1; Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007 | since |
| Duties of Public Electronic Communications Providers to Inform OFCOM and Users of Security CompromisesCommunications Act 2003, c. 21, ss. 105J and 105K | since |
| Security Duties of Providers of Public Electronic Communications Networks and ServicesCommunications Act 2003, c. 21, ss. 105A to 105C; Electronic Communications (Security Measures) Regulations 2022, SI 2022/933 | since |
| Notification of Incidents by Operators of Essential ServicesThe Network and Information Systems Regulations 2018, SI 2018/506, reg. 11 | since |
| Notification of Incidents by Relevant Digital Service ProvidersThe Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(3) to (7) | since |
| Security Duties of Operators of Essential ServicesThe Network and Information Systems Regulations 2018, SI 2018/506, reg. 10 | since |
| Security Duties of Relevant Digital Service ProvidersThe Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(1) and (2) | since |
| Cyber Security and Resilience (Network and Information Systems) BillCyber Security and Resilience (Network and Information Systems) Bill, session 2026-27 (HL Bill 49, as amended in Grand Committee) | proposed |
 Vatican City
va
2 instruments
| |
| Payment Services Major Incident NotificationInstruction No. 4 on major incident notification, Title III (arts. 25 to 33), with Regulation No. 3, art. 62 | since |
| Payment Services Operational and Security Risk ManagementInstruction No. 4 on operational and security risk measures, Title II (arts. 4 to 24), with Regulation No. 3, art. 61 | since |
| Americas | |
 Antigua and Barbuda
ag
6 instruments
| |
| Antigua and Barbuda Eastern Caribbean Central Bank Electronic Banking Standard, Incident ReportingElectronic Banking Standard, incident reporting, Banking Prudential Standard No. 3 of 2022, paras. 5.2.7, 5.11 and 6.4 | since |
| Antigua and Barbuda Eastern Caribbean Central Bank Electronic Banking Standard, Security ControlsElectronic Banking Standard, security controls, Banking Prudential Standard No. 3 of 2022, paras. 5.2 and 6.4 | since |
| Antigua and Barbuda Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Incident ReportingTechnology Risk Standard, cyber incidents, Prudential Standard on Technology Risk Management, para. 12.8.1 and Appendix I | since |
| Antigua and Barbuda Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Risk GovernanceTechnology Risk Standard, cyber governance, Prudential Standard on Technology Risk Management, paras. 5.2.4 and Board and Senior Management roles | since |
| Antigua and Barbuda Digital Assets Business Act 2020, Compliance Officer Report of a Cyber Reporting EventDigital Assets Business Act, 2020 (No. 16 of 2020), ss. 2(1) and 23 | from a date not yet set |
| Antigua and Barbuda Digital Assets Business Act 2020, Security of an Initial Digital Asset OfferingDigital Assets Business Act, 2020 (No. 16 of 2020), Sch. I, para. 12 | from a date not yet set |
 Argentina
ar
3 instruments
| |
| BCRA Cyber-Incident Notification (Guidelines for Response and Recovery from Cyber-Incidents)Comunicación “A” 8280 del Banco Central de la República Argentina, Lineamientos para la Respuesta y Recuperación ante Ciberincidentes (RRCI), sección 3 | since |
| CNV Cybersecurity Requirements for Virtual Asset Service ProvidersResolución General 1058/2025 de la Comisión Nacional de Valores, Normas (N.T. 2013 y mod.), Título XIV, Capítulo III, arts. 13 y 14 | since |
| BCRA Minimum Requirements for Technology and Information Security Risk ManagementComunicación “A” 7724 del Banco Central de la República Argentina, Requisitos mínimos para la gestión y control de los riesgos de tecnología y seguridad de la información, secciones 1.2, 5.8.2 y 8.1 | since |
 Barbados
bb
4 instruments
| |
| Technology and Cyber Risk Management Guideline, Reporting of Cyber Incidents to the Financial Services CommissionFinancial Services Commission Technology and Cyber Risk Management Guideline (December 2024), s. 10 | since |
| Technology and Cyber Risk Management Guideline, Technology and Cyber Risk Management Framework of Financial InstitutionsFinancial Services Commission Technology and Cyber Risk Management Guideline (December 2024), ss. 1 to 9 | since |
| Technology and Cyber Risk Management Guideline, Classification and Reporting of Major Incidents to the Central BankCentral Bank of Barbados Technology and Cyber Risk Management Guideline (March 2026), ss. 6.6.8 and 6.6.9 | in force |
| Technology and Cyber Risk Management Guideline, Technology and Cyber Risk Management Framework of Regulated EntitiesCentral Bank of Barbados Technology and Cyber Risk Management Guideline (March 2026), ss. 2 to 5 | in force |
 Belize
bz
2 instruments
| |
| Belize National Payment System Regulations, 2024, Incident, Security Breach and Service Interruption Reporting to the Central BankNational Payment System Regulations, 2024: incident and security breach reporting (Statutory Instrument No. 29 of 2024, regs. 18(1)(c), 18(3) and 19(3) to (5)), with National Payment System Act, ss. 33 and 56 | in force |
| Belize National Payment System Regulations, 2024, System Security Audit Reports and Security DirectivesNational Payment System Regulations, 2024: system security audit and security directives (Statutory Instrument No. 29 of 2024, regs. 17 and 18(2)(c) and (3)), with National Payment System Act, ss. 33 and 56 | in force |
 Bolivia
bo
2 instruments
| |
| Annual Vulnerability Analysis Report to the Financial System SupervisorReglamento para la Gestión de Seguridad de la Información, Recopilación de Normas para Servicios Financieros, Libro 3, Título VII, Capítulo II, Sección 12, Artículo Único, inciso b | in force |
| Information Security Management Regulation for Supervised Financial EntitiesReglamento para la Gestión de Seguridad de la Información, Recopilación de Normas para Servicios Financieros, Libro 3, Título VII, Capítulo II, Secciones 1, 3, 9, 12 y 13 | in force |
 Brazil
br
11 instruments
| |
| Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)Ato nº 2.436, de 7 de março de 2023 (Superintendência de Outorga e Recursos à Prestação, Agência Nacional de Telecomunicações), as amended by Ato nº 7.344, de 15 de junho de 2023; issued under the Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, approved by Resolução nº 740, de 21 de dezembro de 2020, and the Regulamento de Avaliação da Conformidade e de Homologação de Produtos para Telecomunicações, approved by Resolução nº 715, de 23 de outubro de 2019 | since |
| ANEEL Resolution 964 of 2021, cybersecurity policy of electric-power agentsResolução Normativa ANEEL nº 964, de 14 de dezembro de 2021, arts. 1º, 4º, 5º e 9º | since |
| ANEEL Resolution 964 of 2021, notification of higher-impact cyber incidentsResolução Normativa ANEEL nº 964, de 14 de dezembro de 2021, arts. 2º, 6º e 7º | since |
| SUSEP Circular 638 of 2021, Cybersecurity Requirements for InsurersCircular SUSEP nº 638, de 27 de julho de 2021, arts. 3º, 4º, 5º e 9º | since |
| SUSEP Circular 638 of 2021, Notification of Relevant IncidentsCircular SUSEP nº 638, de 27 de julho de 2021, arts. 2º, 6º e 8º | since |
| BCB Resolution 85 of 2021, Communication of Relevant IncidentsResolução BCB nº 85, de 8 de abril de 2021, arts. 20 e 22 | since |
| BCB Resolution 85 of 2021, Cybersecurity Policy of Payment Institutions and Other Authorized InstitutionsResolução BCB nº 85, de 8 de abril de 2021, arts. 1º, 2º, 6º, 7º e 8º | since |
| CMN Resolution 4,893 of 2021, Communication of Relevant IncidentsResolução CMN nº 4.893, de 26 de fevereiro de 2021, arts. 20 e 22 | since |
| CMN Resolution 4,893 of 2021, Cybersecurity Policy of Financial InstitutionsResolução CMN nº 4.893, de 26 de fevereiro de 2021, arts. 2º, 3º, 6º, 7º e 8º | since |
| Anatel Cybersecurity Regulation for Telecommunications, notification of relevant incidentsResolução nº 740, de 21 de dezembro de 2020 (Anatel), Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, arts. 2º-C, 9º, 17 e 18 | since |
| Anatel Cybersecurity Regulation for Telecommunications, security policy and controlsResolução nº 740, de 21 de dezembro de 2020 (Anatel), Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, arts. 2º, 6º, 7º, 13, 19 e 20 | since |
 Canada
ca
6 instruments
| |
| Telecommunications Act, Security Orders for Telecommunications Service ProvidersTelecommunications Act (S.C. 1993, c. 38), ss. 15.1, 15.2, 72.131 and 73(3.1) | since |
| Retail Payment Activities Act, Notification of IncidentsRetail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 18, 19 and 76 | since |
| Retail Payment Activities Act, Operational Risk Management and Incident Response FrameworkRetail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 17 and 76 | since |
| Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bankOffice of the Superintendent of Financial Institutions Act, R.S.C. 1985, c. 18 (3rd Supp.), s. 4; Bank Act, S.C. 1991, c. 46, s. 645 | in force |
| Critical Cyber Systems Protection Act, Cyber Security Programs of Designated OperatorsCritical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 7-9, 12, 15 and 137 | from a date not yet set |
| Critical Cyber Systems Protection Act, Reporting of Cyber Security IncidentsCritical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 17, 18 and 136 | from a date not yet set |
 Chile
cl
4 instruments
| |
| Cybersecurity Incident Reporting Regulation under the Ley Marco de CiberseguridadDecreto N° 295, Reglamento de Reporte de Incidentes de Ciberseguridad de la Ley N° 21.663, arts. 2, 3, 5, 6 y 8 a 13 | since |
| Ley Marco de Ciberseguridad, Duties of Operators of Vital ImportanceLey N° 21.663, Ley Marco de Ciberseguridad, arts. 5 y 8 | since |
| Ley Marco de Ciberseguridad, Reporting of Cybersecurity IncidentsLey N° 21.663, Ley Marco de Ciberseguridad, arts. 9 y 27 | since |
| Ley Marco de Ciberseguridad, Essential Services and General DutiesLey N° 21.663, Ley Marco de Ciberseguridad, arts. 4 y 7 | since |
 Colombia
co
1 instrument
| |
| Superintendencia Financiera de Colombia, Circular Externa 033 de 2020 (External Circular 33 of 2020), taxonomy, protocol and mailbox for reporting cybersecurity incidents and a format for security metricsCircular Externa 033 de 2020 (Superintendencia Financiera de Colombia) | since |
 Costa Rica
cr
2 instruments
| |
| General Regulation on Information Technology Governance and Management (CONASSIF Agreement 5-24), Incident Classification and ReportingAcuerdo CONASSIF 5-24, Reglamento General de Gobierno y Gestión de la Tecnología de Información, arts. 38-41 | since |
| General Regulation on Information Technology Governance and Management (CONASSIF Agreement 5-24), Information Security and Cybersecurity ProgrammeAcuerdo CONASSIF 5-24, Reglamento General de Gobierno y Gestión de la Tecnología de Información, arts. 31-33 | since |
 Cuba
cu
4 instruments
| |
| General Telecommunications Law, Network and Service Security Duties of Operators and ProvidersDecreto-Ley No. 35 De las Telecomunicaciones, las Tecnologías de la Información y la Comunicación y el Uso del Espectro Radioeléctrico, 2021, arts. 68 y 71, y Decreto No. 42 Reglamento General de Telecomunicaciones, art. 53(a), (d) y (e) | since |
| General Telecommunications Regulation, Notice to the Ministry of Communications of Security BreachesDecreto No. 42 Reglamento General de Telecomunicaciones y las Tecnologías de la Información y la Comunicación, 2021, art. 53(c) | since |
| Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System dutyDecreto No. 360/2019 ‘Sobre la Seguridad de las Tecnologías de la Información y la Comunicación y la Defensa del Ciberespacio Nacional’ (Gaceta Oficial de la República de Cuba, Ordinaria No. 45, GOC-2019-549-O45, 4 de julio de 2019), arts. 10, 12, 17-20, 41, 56, 89, 109; and its implementing Reglamento de Seguridad de las Tecnologías de la Información y la Comunicación, approved by Resolución 128/2019 of the Ministry of Communications (GOC-2019-555-O45), arts. 2, 4-8, 50 | in force |
| Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de CiberseguridadResolución 105/2021 of the Ministry of Communications, ‘Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad’ (Gaceta Oficial de la República de Cuba, Ordinaria No. 92, GOC-2021-762-O92, 17 de agosto de 2021), arts. 1, 2, 21-23 and resolving clause SEGUNDO | in force |
 Dominican Republic
do
1 instrument
| |
| Cybersecurity and Information Security Regulation, Security Program of Financial Entities and Payment System ParticipantsReglamento de Seguridad Cibernética y de la Información, Junta Monetaria, Segunda Resolución del 1 de noviembre de 2018 (JM 181101-02), arts. 1, 3, 31, 41, 52, 59 y 60 | in force |
 Ecuador
ec
2 instruments
| |
| Organic Telecommunications Law, Network Security Measures and Security AuditLey Orgánica de Telecomunicaciones, arts. 24(15), 76 and 85 | since |
| Organic Telecommunications Law, Notice to Users of a Network Security RiskLey Orgánica de Telecomunicaciones, arts. 76 and 79 | since |
 El Salvador
sv
5 instruments
| |
| Cybersecurity and Information Security Law, Incident Reporting and Notice to Those AffectedLey de Ciberseguridad y Seguridad de la Información, Decreto Legislativo No. 143, 12 de noviembre de 2024, arts. 6(f), 6(h), 6(l), 8(h) y 21(a) | since |
| Cybersecurity and Information Security Law, Security Management Duties of Obligated EntitiesLey de Ciberseguridad y Seguridad de la Información, Decreto Legislativo No. 143, 12 de noviembre de 2024, arts. 2, 4, 6, 8 y 21-24 | since |
| Technical Standards on Cybersecurity Measures in Digital Channels (NRP-32), Cybersecurity Controls of BanksNormas Técnicas sobre Medidas de Ciberseguridad en Canales Digitales (NRP-32), CNBCR-02/2022, arts. 1, 2, 4-7, 14, 18 y 41 | since |
| Technical Standards for Information Security Management (NRP-23), Incident CommunicationNormas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, art. 13 | since |
| Technical Standards for Information Security Management (NRP-23), Security Management Program of Supervised EntitiesNormas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, arts. 1, 2, 10, 12 y 32 | since |
 Grenada
gd
5 instruments
| |
| Grenada ECCB Electronic Banking Standard, Incident Reports to the Central Bank Within Three DaysECCB Electronic Banking Standard, incident reports (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.7, 5.11.2 and 6.4, with Banking Act, No. 20 of 2015, ss. 75, 80 and 184 | since |
| Grenada ECCB Electronic Banking Standard, Security Controls for E-Banking Systems and DataECCB Electronic Banking Standard, security controls (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.1 to 5.2.8 and 6.4, with Banking Act, No. 20 of 2015, ss. 75, 80 and 184 | since |
| Grenada ECCB Technology Risk Management Standard, Cyber-Incident Alert, Report and Customer NoticeECCB Technology Risk Management Standard, paras. 12.8.1 to 12.8.5 and Senior Management items f and g (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 20 of 2015, ss. 75, 80 and 184 | since |
| Grenada ECCB Technology Risk Management Standard, Cyber-Risk Governance and Security Duties of Licensed Financial InstitutionsECCB Technology Risk Management Standard, Roles and Responsibilities and Information Security User Group (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 20 of 2015, ss. 75, 80 and 184 | since |
| Grenada Virtual Asset Business Act, 2021, Registrant's Cyber-Threat Protection PoliciesVirtual Asset Business Act, 2021 (Act No. 7 of 2021), s. 11(6)(b) | in force |
 Guyana
gy
1 instrument
| |
| Bank of Guyana Supervision Guideline No. 15, Technology Risk ManagementBank of Guyana Supervision Guideline No. 15, Technology Risk Management, paras. 6 to 8, 17, 24, 25, 76, 102, 107 to 110 and 116 | in force |
 Haiti
ht
1 instrument
| |
| BRH Circulaire 126, Information Security Rules for Financial InstitutionsBanque de la République d'Haïti, Circulaire 126, Sur les règles en matière de sécurité informatique, 13 janvier 2022, arts. 1-5 | since |
 Honduras
hn
3 instruments
| |
| CNBS Minimum Guidelines to Prevent and Mitigate Cyber Fraud and Scams Against Financial Users, Incident ReportingLineamientos mínimos para prevenir y mitigar la ocurrencia de fraudes y estafas cibernéticas en contra del usuario financiero (Circular CNBS No.008/2023, Resolución GRD No.365/26-05-2023), art. 17 | since |
| CNBS Norms on Information Technology, Information Security and Cybersecurity Management (Circular CNBS 025/2022)Normas para la Gestión de Tecnologías de Información, Continuidad del Negocio, Seguridad de la Información y Ciberseguridad (Circular CNBS No.025/2022, Resolución GRD No.793/16-12-2022), arts. 18-20 | since |
| CNBS Norms on Information Technology, Information Security and Cybersecurity Management (Circular CNBS 025/2022), Incident NotificationNormas para la Gestión de Tecnologías de Información, Continuidad del Negocio, Seguridad de la Información y Ciberseguridad (Circular CNBS No.025/2022, Resolución GRD No.793/16-12-2022), arts. 21 and 37 | since |
 Jamaica
jm
2 instruments
| |
| Standard of Sound Practice on Management of Cyber Risks, Cyber Risk Management Framework of Deposit-Taking InstitutionsBank of Jamaica Standard of Sound Practice on Management of Cyber Risks (September 2024), ss. 3 to 6 | in force |
| Standard of Sound Practice on Management of Cyber Risks, Reporting of Cyber Incidents and Data Breaches to the Bank of JamaicaBank of Jamaica Standard of Sound Practice on Management of Cyber Risks (September 2024), ss. 4.6.6 and 4.10.1 | in force |
 Mexico
mx
5 instruments
| |
| CNBV and Banco de México Provisions for Electronic Payment Funds Institutions, Information Security Incident ReportingDisposiciones aplicables a las instituciones de fondos de pago electrónico a que se refieren los artículos 48, segundo párrafo; 54, primer párrafo, y 56, primer y segundo párrafos de la Ley para Regular las Instituciones de Tecnología Financiera, art. 42 | since |
| CNBV and Banco de México Provisions for Electronic Payment Funds Institutions, Information Security ProgrammeDisposiciones aplicables a las instituciones de fondos de pago electrónico a que se refieren los artículos 48, segundo párrafo; 54, primer párrafo, y 56, primer y segundo párrafos de la Ley para Regular las Instituciones de Tecnología Financiera, arts. 31, 33, 34 and 35 | since |
| Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)Ley Federal de Proteccion al Consumidor (LFPC), Capitulo VIII Bis "De los Derechos de los Consumidores en las Transacciones Efectuadas a traves del Uso de Medios Electronicos, Opticos o de Cualquier Otra Tecnologia", Arts. 76 Bis y 76 Bis 1, capitulo adicionado por decreto publicado en el Diario Oficial de la Federacion el 29 de mayo de 2000, texto vigente con ultima reforma DOF 14-11-2025 | since |
| CNBV General Provisions for Credit Institutions, Information Security ControlsDisposiciones de carácter general aplicables a las instituciones de crédito, arts. 168 Bis 11 and 168 Bis 12 | in force |
| CNBV General Provisions for Credit Institutions, Information Security Incident ReportingDisposiciones de carácter general aplicables a las instituciones de crédito, art. 168 Bis 16 | in force |
 Nicaragua
ni
2 instruments
| |
| Technology Risk Management Norm, Information to the Superintendent on Security IncidentsNorma sobre Gestión de Riesgo Tecnológico, Resolución CD-SIBOIF-500-1-SEP19-2007, art. 42 | in force |
| Technology Risk Management Norm, Security and Controls of Supervised Financial InstitutionsNorma sobre Gestión de Riesgo Tecnológico, Resolución CD-SIBOIF-500-1-SEP19-2007, arts. 2 y 3 | in force |
 Panama
pa
4 instruments
| |
| Superintendency of Banks Agreement 003-2012, Incident Handling and Notification by the Information Security UnitAcuerdo No. 003-2012 (Superintendencia de Bancos de Panamá), Gestión del Riesgo de la Tecnología de la Información, art. 11, points 10 and 11 | since |
| Superintendency of Banks Agreement 003-2012, Management of Information Technology RiskAcuerdo No. 003-2012 (Superintendencia de Bancos de Panamá), Gestión del Riesgo de la Tecnología de la Información, arts. 3, 8, 11 and 12 | since |
| Superintendency of Banks Agreement 006-2011, Electronic Banking Security ControlsAcuerdo No. 006-2011 (Superintendencia de Bancos de Panamá), Banca Electrónica y la Gestión de Riesgos Relacionados, arts. 10, 11 and 15 | since |
| Superintendency of Banks Agreement 006-2011, Reporting of Electronic Banking Security IncidentsAcuerdo No. 006-2011 (Superintendencia de Bancos de Panamá), Banca Electrónica y la Gestión de Riesgos Relacionados, art. 17 | since |
 Paraguay
py
3 instruments
| |
| Trust Services Law, Security Breach Notification by Trust Service ProvidersLey N° 6822/2021 De los servicios de confianza para las transacciones electrónicas, del documento electrónico y los documentos transmisibles electrónicos, arts. 13, 20(2) y 21 | since |
| Trust Services Law, Security Requirements for Trust Service ProvidersLey N° 6822/2021 De los servicios de confianza para las transacciones electrónicas, arts. 13(2), 20(1) y 21 | since |
| Mandatory Cyber Incident Reporting by State Bodies to CERT-PYResolución MITIC N° 346/2020 Reporte obligatorio de incidentes cibernéticos por parte de los Organismos y Entidades del Estado (OEE) al MITIC, reglamentaria del art. 44 del Decreto N° 2274/2019 | in force |
 Peru
pe
4 instruments
| |
| Regulation of the Digital Trust Framework (Supreme Decree 126-2025-PCM), Digital-Security Risk Management and ControlsDecreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 12, 14 and 18 | since |
| Regulation of the Digital Trust Framework (Supreme Decree 126-2025-PCM), Notification of Digital-Security IncidentsDecreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 18.1(a) and 31 to 34 | since |
| SBS Regulation on Information Security and Cybersecurity Management (Resolution 504-2021), Management System DutiesResolución SBS N.° 504-2021, Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad, arts. 1, 4 to 6 and 16 | since |
| SBS Regulation on Information Security and Cybersecurity Management (Resolution 504-2021), Report of Significant Cybersecurity IncidentsResolución SBS N.° 504-2021, Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad, art. 15 | since |
| Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o CiberseguridadProyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on | proposed |
 Saint Kitts and Nevis
kn
5 instruments
| |
| Saint Kitts and Nevis Eastern Caribbean Central Bank Electronic Banking Standard, Incident ReportingElectronic Banking Standard, incident reporting, Banking Prudential Standard No. 3 of 2022, paras. 5.2.7, 5.11 and 6.4 | since |
| Saint Kitts and Nevis Eastern Caribbean Central Bank Electronic Banking Standard, Security ControlsElectronic Banking Standard, security controls, Banking Prudential Standard No. 3 of 2022, paras. 5.2 and 6.4 | since |
| Saint Kitts and Nevis Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Incident ReportingTechnology Risk Standard, cyber incidents, Prudential Standard on Technology Risk Management, para. 12.8.1 and Appendix I | since |
| Saint Kitts and Nevis Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Risk GovernanceTechnology Risk Standard, cyber governance, Prudential Standard on Technology Risk Management, paras. 5.2.4 and Board and Senior Management roles | since |
| Saint Kitts and Nevis Virtual Asset Act, Registrant's Cyber-Threat Protection MeasuresVirtual Asset Act (Cap. 21.29; Act 1 of 2020), s. 9(5)(b) | since |
 Saint Lucia
lc
5 instruments
| |
| Saint Lucia ECCB Electronic Banking Standard, Incident Reports to the Central Bank Within Three DaysECCB Electronic Banking Standard, incident reports (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.7, 5.11.2 and 6.4, with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 | since |
| Saint Lucia ECCB Electronic Banking Standard, Security Controls for E-Banking Systems and DataECCB Electronic Banking Standard, security controls (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.1 to 5.2.8 and 6.4, with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 | since |
| Saint Lucia ECCB Technology Risk Management Standard, Cyber-Incident Alert, Report and Customer NoticeECCB Technology Risk Management Standard, paras. 12.8.1 to 12.8.5 and Senior Management items f and g (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 | since |
| Saint Lucia ECCB Technology Risk Management Standard, Cyber-Risk Governance and Security Duties of Licensed Financial InstitutionsECCB Technology Risk Management Standard, Roles and Responsibilities and Information Security User Group (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 | since |
| Saint Lucia Virtual Asset Business Act, 2022, Licensee's Cyber-Threat Protection PoliciesVirtual Asset Business Act, 2022 (No. 24 of 2022), s. 12(7)(b) | in force |
 Saint Vincent and the Grenadines
vc
4 instruments
| |
| Saint Vincent and the Grenadines Eastern Caribbean Central Bank Electronic Banking Standard, Incident ReportingElectronic Banking Standard, incident reporting, Banking Prudential Standard No. 3 of 2022, paras. 5.2.7, 5.11 and 6.4 | since |
| Saint Vincent and the Grenadines Eastern Caribbean Central Bank Electronic Banking Standard, Security ControlsElectronic Banking Standard, security controls, Banking Prudential Standard No. 3 of 2022, paras. 5.2 and 6.4 | since |
| Saint Vincent and the Grenadines Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Incident ReportingTechnology Risk Standard, cyber incidents, Prudential Standard on Technology Risk Management, para. 12.8.1 and Appendix I | since |
| Saint Vincent and the Grenadines Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Risk GovernanceTechnology Risk Standard, cyber governance, Prudential Standard on Technology Risk Management, paras. 5.2.4 and Board and Senior Management roles | since |
 Trinidad and Tobago
tt
3 instruments
| |
| Virtual Assets and Virtual Asset Service Providers Act, Notice of a Cyber-Security Event by a Sandbox ParticipantVirtual Assets and Virtual Asset Service Providers Act, 2025 (Act No. 12 of 2025), s. 10(3) and (4) | since |
| Cybersecurity Best Practices Guideline, Cybersecurity Framework of Financial InstitutionsCentral Bank of Trinidad and Tobago Cybersecurity Best Practices Guideline (September 2023), Parts 1 to 3 | since |
| Cybersecurity Best Practices Guideline, Notification of Cybersecurity Incidents to the Central BankCentral Bank of Trinidad and Tobago Cybersecurity Best Practices Guideline (September 2023), Appendix II | since |
 United States
us
29 instruments
| |
| Cybersecurity Maturity Model Certification (CMMC) Program, contractor cybersecurity requirements and assessments32 CFR Part 170 (CMMC Program) | since |
| Coast Guard Cybersecurity in the Marine Transportation System: cybersecurity plan and measuresCoast Guard Cybersecurity in the Marine Transportation System, 33 CFR 101.600 to 101.650 | since |
| Coast Guard Cybersecurity in the Marine Transportation System: reportable cyber incidentsCoast Guard reportable cyber incident reporting, 33 CFR 101.620(b)(7) and 101.615 | since |
| Protecting Americans from Foreign Adversary Controlled Applications ActPub. L. 118-50, div. H, 138 Stat. 955 (15 U.S.C. 9901 note) | since |
| SEC Cybersecurity Risk Management, Governance, and Incident Disclosure (Regulation S-K Item 106; Form 8-K Item 1.05)17 CFR 229.106; 17 CFR 249.308 (Form 8-K Item 1.05) | since |
| Federal Acquisition Supply Chain Security Act Orders: contractor representation, prohibition and reporting clauses (FAR 52.204-29 and 52.204-30)48 CFR 52.204-29 and 52.204-30 | since |
| NCUA Cyber Incident Notification Requirements for Federally Insured Credit UnionsNCUA Cyber Incident Notification Requirements, 12 CFR 748.1(c) | since |
| Federal Food, Drug, and Cosmetic Act section 524B: cybersecurity requirements for cyber devicesFederal Food, Drug, and Cosmetic Act section 524B, 21 U.S.C. 360n-2 | since |
| FedRAMP Authorization Act, Federal Risk and Authorization Management Program44 U.S.C. 3607 to 3616 | since |
| Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers12 CFR Part 53 (OCC); 12 CFR Part 225, Subpart N (Federal Reserve Board); 12 CFR Part 304, Subpart C (FDIC) | since |
| CFTC system safeguards for derivatives clearing organizations, designated contract markets and swap execution facilitiesCFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401 | since |
| CFTC system safeguards: prompt notice to Commission staff of cyber security incidents and targeted threatsCFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e) | since |
| NRC cyber security event notifications by nuclear power plant licenseesNRC cyber security event notifications, 10 CFR 73.77 | since |
| SEC Regulation SCI: notification of SCI events to the Commission and to membersSEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c) | since |
| SEC Regulation SCI: systems compliance and integrity policies and proceduresSEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001 | since |
| Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 252.204-7012)48 CFR 252.204-7012 | since |
| NRC protection of digital computer and communication systems and networks at nuclear power plantsNRC cyber security requirements for nuclear power plants, 10 CFR 73.54 | since |
| HIPAA Security Rule45 CFR Part 164, Subpart C (Sections 164.302-164.318) | since |
| Sarbanes-Oxley Act title IV: management's report on internal control over financial reporting and the auditor's attestation15 U.S.C. 7262; 17 CFR 240.13a-15; 17 CFR 229.308 | since |
| FTC Standards for Safeguarding Customer Information (Safeguards Rule)FTC Safeguards Rule, 16 CFR 314.1 to 314.4(i) and 314.6 | since |
| Sarbanes-Oxley Act section 302: certification of periodic reports by the principal executive and principal financial officers15 U.S.C. 7241; 17 CFR 240.13a-14 | since |
| Sarbanes-Oxley Act section 802: destruction, alteration or falsification of records in federal investigations and bankruptcy18 U.S.C. 1519 | since |
| Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer18 U.S.C. 1520; 17 CFR 210.2-06 | since |
| Interagency Guidelines Establishing Information Security StandardsInteragency Guidelines Establishing Information Security Standards, 12 CFR Part 30 Appendix B, 12 CFR Part 225 Appendix F and 12 CFR Part 364 Appendix B | since |
| NCUA Security Program and Guidelines for Safeguarding Member InformationNCUA Security Program and Guidelines for Safeguarding Member Information, 12 CFR 748.0 and Appendix A to Part 748 | since |
| Securities Exchange Act of 1934 section 13(b)(2)(B): internal accounting controls15 U.S.C. 78m(b)(2)(B) | since |
| SEC Regulation S-P: safeguards policies and incident response programsSEC Regulation S-P safeguards policies and incident response programs, 17 CFR 248.30(a)(1) to (a)(3) | in force |
| SEC Regulation S-P: service provider oversight and 72-hour breach notice to the covered institutionSEC Regulation S-P service provider oversight and notice, 17 CFR 248.30(a)(5) | in force |
| Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)6 U.S.C. 681-681g (CIRCIA) | from a date not yet set |
 Uruguay
uy
5 instruments
| |
| Decreto 66/025, Cybersecurity Framework Duties of Public and Critical-Sector EntitiesDecreto N° 66/025, arts. 10, 11, 14 a 18 y 21 | since |
| Decreto 66/025, Cybersecurity Incident Reporting to CERTuyDecreto N° 66/025, arts. 10(g) y 12 | since |
| Ley 20.212, Cybersecurity Incident Reporting by Public and Critical-Sector EntitiesLey N° 20.212, arts. 78(D) y 80 | since |
| Ley 20.212, Cybersecurity Obligations of Public and Critical-Sector EntitiesLey N° 20.212, arts. 78 y 79 | since |
| Superintendencia de Servicios Financieros Communication on Technology, Systems and Information Security EventsResolución RR-SSF-2021-353 de la Superintendencia de Servicios Financieros, Comunicación de eventos vinculados a Tecnología, Sistemas y Seguridad de la Información | since |
| Asia | |
 Armenia
am
2 instruments
| |
| Law on Cybersecurity: Cyber Incident NotificationLaw on Cybersecurity, art. 11 (Law of the Republic of Armenia No. HO-442-N) | since |
| Law on Cybersecurity: Service Provider Security Obligations in Vital SectorsLaw on Cybersecurity, arts. 1, 9, 16, 17, 18, 20 and 25 (Law of the Republic of Armenia No. HO-442-N) | since |
 Azerbaijan
az
6 instruments
| |
| Rules on Information Security Management in Banks, High-Category Incident Report to the Central BankRules on Information Security Management in Banks, approved by Decision No. 20/1 of the Board of the Central Bank of the Republic of Azerbaijan (), cl. 14 | since |
| Rules on Information Security Management in Banks, Information Security Management SystemRules on Information Security Management in Banks, approved by Decision No. 20/1 of the Board of the Central Bank of the Republic of Azerbaijan () | since |
| Law on Information, Informatization and Information Protection, Critical Information Infrastructure Security RegimeLaw of the Republic of Azerbaijan No. 460-IQ "On Information, Informatization and Protection of Information", Chapter V-1, arts. 20-1 to 20-6 (inserted by Law No. 539-VIQD of ) | in force |
| Law on Information, Informatization and Information Protection, Critical Infrastructure Cyber Incident ReportingLaw of the Republic of Azerbaijan No. 460-IQ "On Information, Informatization and Protection of Information", art. 20-3.4 (inserted by Law No. 539-VIQD of ) | in force |
| Code of Administrative Offences, New Article 371-2, Cybersecurity Compliance Duties of Information Infrastructure SubjectsLaw of the Republic of Azerbaijan on Amendments to the Code of Administrative Offences of , new art. 371-2.1.1, 371-2.1.3 to 371-2.1.5 | from , in 8 months |
| Code of Administrative Offences, New Article 371-2, Immediate Reporting of Cyber Threats, Attacks and IncidentsLaw of the Republic of Azerbaijan on Amendments to the Code of Administrative Offences of , new art. 371-2.1.2 | from , in 8 months |
 Bahrain
bh
7 instruments
| |
| Cyber Security Incident Reporting for Conventional Bank Licensees (Rulebook Volume 1, Module OM, Section OM-5.5)Conventional Banks Cyber Security Incident Reporting Rules, Central Bank of Bahrain Rulebook Volume 1, Module OM, paragraphs OM-5.5.57 to OM-5.5.59 | in force |
| Cyber Security Incident Reporting for Crypto-Asset Licensees (Rulebook Volume 6, Module CRA, Section CRA-5.8)Crypto-Asset Cyber Security Incident Reporting Rules, Central Bank of Bahrain Rulebook Volume 6, Module CRA, paragraphs CRA-5.8.33 to CRA-5.8.35 | in force |
| Cyber Security Incident Reporting for Insurance Licensees (Rulebook Volume 3, Module RM, Section RM-9.1)Insurance Cyber Security Incident Reporting Rules, Central Bank of Bahrain Rulebook Volume 3, Module RM, paragraphs RM-9.1.58 to RM-9.1.60 | in force |
| Cyber Security Incident Reporting for Investment Business Licensees (Rulebook Volume 4, Module RM, Section RM-9.1)Investment Business Cyber Security Incident Reporting Rules, Central Bank of Bahrain Rulebook Volume 4, Module RM, paragraphs RM-9.1.58 to RM-9.1.60 | in force |
| Cyber Security Incident Reporting for Islamic Bank Licensees (Rulebook Volume 2, Module OM, Section OM-5.5)Islamic Banks Cyber Security Incident Reporting Rules, Central Bank of Bahrain Rulebook Volume 2, Module OM, paragraphs OM-5.5.57 to OM-5.5.59 | in force |
| Cyber Security Risk Management for Conventional Bank Licensees (Rulebook Volume 1, Module OM, Section OM-5.5)Conventional Banks Cyber Security Risk Management Rules, Central Bank of Bahrain Rulebook Volume 1, Module OM, paragraphs OM-5.5.22 to OM-5.5.56 | in force |
| Cyber Security Risk Management for Insurance Licensees (Rulebook Volume 3, Module RM, Section RM-9.1)Insurance Cyber Security Risk Management Rules, Central Bank of Bahrain Rulebook Volume 3, Module RM, paragraphs RM-9.1.1 to RM-9.1.57 | in force |
 Bangladesh
bd
2 instruments
| |
| Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber IncidentCyber Security Act, 2026 (Act No. 81 of 2026), s. 9 | since |
| Cyber Security Act, Critical Information Infrastructure Designation, Response Team and Audit DutiesCyber Security Act, 2026 (Act No. 81 of 2026), ss. 9(2), 15 and 16 | since |
 Bhutan
bt
2 instruments
| |
| Cybersecurity Code of Practice, Security Programme for Licensed ICT and Telecommunications ProvidersBhutan InfoComm and Media Authority Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under section 58 of the Information, Communications and Media Act of Bhutan 2018), clauses 3 and 11 to 12 | since |
| Cybersecurity Code of Practice, Threat Information Sharing and Incident Reporting StructureBhutan InfoComm and Media Authority Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under section 58 of the Information, Communications and Media Act of Bhutan 2018), clauses 11.7 and 12.1 | since |
 Brunei Darussalam
bn
4 instruments
| |
| BDCB Notice on Cyber Intrusion Detection and IT Resilience for BanksNotice on Early Detection of Cyber Intrusion and Incident Reporting (Notice TRS/N-1/2020/1, Amendment No. 1), paras. 3.1 to 3.5, 5.2, 5.3 and 6.2 | since |
| BDCB Notice on Cyber Intrusion and IT Incident Reporting by BanksNotice on Early Detection of Cyber Intrusion and Incident Reporting (Notice TRS/N-1/2020/1, Amendment No. 1), paras. 4.1 to 4.7 | since |
| Cybersecurity Act: Critical Information Infrastructure Incident ReportingCybersecurity Act (Chapter 272, Laws of Brunei, Revised Edition 2024), s. 16 | since |
| Cybersecurity Act: Critical Information Infrastructure Owner DutiesCybersecurity Act (Chapter 272, Laws of Brunei, Revised Edition 2024), ss. 9, 12, 13, 14, 15, 17 and 18 | since |
 China
cn
13 instruments
| |
| Cybersecurity Law, Network Product and Service Security DutiesCybersecurity Law of the People's Republic of China (as amended by the Decision of , effective ), Art. 24 | since |
| National Cybersecurity Incident Reporting MeasuresMeasures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued ), Arts. 2, 4, 5, 8, 9, 12, 14 | since |
| People's Bank of China Cybersecurity Incident Reporting Measures, financial institution dutiesMeasures for the Administration of Cybersecurity Incident Reporting in the Business Areas of the People's Bank of China, Arts. 2, 6, 12 and 14-17 | since |
| Network Data Security Management Regulation, product vulnerability and incident reportingRegulation on Network Data Security Management (State Council Order 790), Arts. 9-11 | since |
| Critical Information Infrastructure Security Protection Regulation, operator dutiesRegulation on the Security Protection of Critical Information Infrastructure (State Council Order 745), Arts. 6, 11-17, 19-21 and 39 | since |
| Critical Information Infrastructure Security Protection Regulation, report of a major incident or threatRegulation on the Security Protection of Critical Information Infrastructure (State Council Order 745), Arts. 18 and 40 | since |
| Data Security Law, Data Security Protection ObligationsData Security Law of the People's Republic of China, Art. 27 | since |
| Data Security Law, Risk Monitoring and Incident Reporting DutyData Security Law of the People's Republic of China, Art. 29 | since |
| Network Product Security Vulnerability Management Provisions, network operator duty to repairArts. 8 and 13, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security) | since |
| Network Product Security Vulnerability Management Provisions, product provider dutiesProvisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security), Arts. 5, 7 and 12 | since |
| Network Product Security Vulnerability Management Provisions, publishing and collecting vulnerability informationArts. 9, 10 and 14, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security) | since |
| Cybersecurity Law, classified protection duties of a network operatorCybersecurity Law of the People's Republic of China (as amended by the Decision of ), Art. 23 | since |
| Communications Network Security Protection Measures, operator dutiesMeasures for the Administration of Communications Network Security Protection (Ministry of Industry and Information Technology Order 11), Arts. 5-8, 11-15 and 22 | since |
 Georgia
ge
2 instruments
| |
| Law on Information Security, Computer Incident Notification by Critical Information System SubjectsLaw of Georgia on Information Security (No. 6391-Is of ), art. 10 and art. 10-8 | since |
| Law on Information Security, Critical Information System Subjects: Security Rules and AuditLaw of Georgia on Information Security (No. 6391-Is of ), arts. 3, 4 and 6 | since |
 India
in
6 instruments
| |
| RBI Commercial Banks Cybersecurity Directions, Cyber Incident ReportingReserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 181 to 183 | since |
| RBI Commercial Banks Cybersecurity Directions, Cybersecurity Policy, Testing and Security Operations CentreReserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 15, 149 to 153 and 212 to 216 | since |
| Telecom Cyber Security Rules, Reporting of Security IncidentsTelecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), r. 7 | since |
| Telecom Cyber Security Rules, Security Policy, Audits, Security Operations Centre and Security OfficerTelecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), rr. 4(3), 4(4) and 6 | since |
| CERT-In Cyber Security Directions, Incident Reporting, Logging and Time SynchronisationDirections under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, ) | since |
| Information Technology Act, Compensation for Failure to Protect Data, and Sensitive Personal Data or Information Rules, Reasonable Security PracticesInformation Technology Act, 2000 (No. 21 of 2000), s.43A; Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E), ), rr. 3, 4, 5, 6, 8 | since |
 Indonesia
id
6 instruments
| |
| Presidential Regulation 82 of 2022, protection of vital information infrastructurePeraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 1, 4, 6, 9, 10, 12 dan 22 | since |
| Presidential Regulation 82 of 2022, reporting of cyber incidents on vital information infrastructurePeraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 13 dan 14 | since |
| Government Regulation on the Operation of Electronic Systems and Transactions, electronic-system security dutyGovernment Regulation No. 71 of 2019 (PP PSTE), Pasal 3, 23, 24(1)-(2), 31, 32, 39, 40 | since |
| Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting dutyGovernment Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3) | since |
| OJK Regulation on Information Technology in Commercial Banks, Cyber Resilience and Cyber Security TestingPeraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum, arts. 21 to 27 | in force |
| OJK Regulation on Information Technology in Commercial Banks, Reporting of IT and Cyber IncidentsPeraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum, arts. 60 and 63 | in force |
 Iraq
iq
1 instrument
| |
| Central Bank of Iraq Standards Booklet 2025 for Private Banks, Standard B7 Infrastructure and DataCentral Bank of Iraq Standards Booklet 2025 Intended for Private Banks (Commercial and Islamic), Standard B7 | in force |
 Israel
il
3 instruments
| |
| Directive 364, management of IT, information security and cyber defense risks of banking corporationsProper Conduct of Banking Business Directive 364 (Management of IT, Information Security, and Cyber Protection Risks), sections 10, 28, 106 and 171 | since |
| Privacy Protection Regulations (Data Security), information security programmePrivacy Protection Regulations (Data Security), 5777-2017, Regs. 1-10, 11(a)-(c), 12-20, 22; Protection of Privacy Law, 5741-1981, Art. 23KF and Third Schedule (enforcement) | since |
| Directive 366, reporting of technological failures, data security incidents and cyber attacksProper Conduct of Banking Business Directive 366 (Reporting of Technological Failures, Data Security Incidents, and Cyber Attacks), sections 3, 6, 10, 12 and 16 | in force |
 Japan
jp
4 instruments
| |
| Important Computers Act, Notification of Specified Important ComputersAct on the Prevention of Damage from Wrongful Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act 42 of 2025), Arts. 4 and 6 | since |
| Important Computers Act, Report of Specified Infringement EventsAct on the Prevention of Damage from Wrongful Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act 42 of 2025), Art. 5 | since |
| Telecommunications Business Act, Equipment Standards, Management Rules and Chief Equipment ManagerTelecommunications Business Act (電気通信事業法, Act 86 of 1984), Arts. 41, 43, 44 and 44-3 | since |
| Telecommunications Business Act, Report of Service Stoppages and Significant AccidentsTelecommunications Business Act (電気通信事業法, Act 86 of 1984), Art. 28 | since |
 Jordan
jo
3 instruments
| |
| Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation dutyCyber Security Law No. (16) of 2019, Article 8(b) | since |
| Central Bank of Jordan Instructions of Cyber Risks Resilience, Cyber Security Governance, Program and Risk ManagementCentral Bank of Jordan Instructions of Cyber Risks Resilience (No. 26/1/1/1984 of ), Arts. 3 and 6 to 17 | since |
| Central Bank of Jordan Instructions of Cyber Risks Resilience, Notification of Cyber Events to the Central BankCentral Bank of Jordan Instructions of Cyber Risks Resilience (No. 26/1/1/1984 of ), Art. 49 | since |
 Kazakhstan
kz
3 instruments
| |
| Digital Code, general cybersecurity duty on digital-object owners and holdersDigital Code No. 255-VIII (), Arts. 20, 97-98 | since |
| Law on Cybersecurity, duties of owners and holders of critically important digital objectsLaw of the Republic of Kazakhstan No. 418-V () "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of ), Arts. 18, 49, 50 and 54 | in force |
| Law on Cybersecurity, notice of cybersecurity incidentsLaw of the Republic of Kazakhstan No. 418-V () "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of ), Arts. 18(1)(3) and 54(2) | in force |
 Kuwait
kw
4 instruments
| |
| Data Classification PolicyData Classification Policy, version 2.3 (Communication and Information Technology Regulatory Authority, listed ) | since |
| Circular No. (2/PS/527/2023), Minimum Cybersecurity and Business Continuity Requirements for E-Payment and E-Money Service ProvidersCircular No. (2/PS/527/2023) of the Central Bank of Kuwait, Minimum Cybersecurity and Business Continuity Requirements, under Article 28 of the Instructions Regulating the Electronic Payment of Funds | in force |
| Cyber and Operational Resilience Framework (CORF), Baselines, Statement of Applicability and Risk ProfileCyber and Operational Resilience Framework for All Local Banks and Financial Institutions (CORF), Version 1.0, Chapters 1 and 3 | in force |
| Cyber and Operational Resilience Framework (CORF), Incident Reporting to the Central Bank of KuwaitIncident Reporting to the Central Bank of Kuwait under the Cyber and Operational Resilience Framework (CORF), Version 1.0, Chapter 5, sections 8.2.2.1 to 8.2.2.5 | in force |
 Kyrgyzstan
kg
4 instruments
| |
| Digital Code, digital resilience baseline security measuresDigital Code, Law No. 178, Art. 63(1)-(4) | since |
| Digital Code, digital resilience incident notificationDigital Code, Law No. 178, Art. 63 | since |
| Law on Cybersecurity, duties of critical information infrastructure subjectsLaw of the Kyrgyz Republic No. 121 () "On Cybersecurity of the Kyrgyz Republic", Arts. 8, 10, 12 and 15 | in force |
| Law on Cybersecurity, informing of cyber incidentsLaw of the Kyrgyz Republic No. 121 () "On Cybersecurity of the Kyrgyz Republic", Arts. 8(5), 10(2) and 17 | in force |
 Laos
la
3 instruments
| |
| Law on Cyber Security, critical information infrastructureLaw on Cyber Security (2025), arts. 3(2) and 15 to 21, critical information infrastructure | since |
| Law on Cyber Security, incident response, incident reporting and annual reportLaw on Cyber Security (2025), arts. 30, 31, 40, 43 and 44, incident response and reporting | since |
| Law on Cyber Security, risk assessment, access control, encryption and network securityLaw on Cyber Security (2025), arts. 25 to 28, risk assessment and security measures | since |
 Lebanon
lb
2 instruments
| |
| Banque du Liban Basic Decision No. 13790 on Electronic Payment Services Providers, IT Infrastructure and Information SecurityBanque du Liban Basic Decision No. 13790 of (Basic Circular No. 1 to Electronic Payment Services Providers), Arts. 9, 24 and 39 | since |
| Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)Banque du Liban Basic Decision No. 12725 of (Basic Circular No. 144 to Banks, also addressed to Financial Institutions), Prevention of Electronic Criminal Acts, Arts. 1-6 | since |
 Malaysia
my
4 instruments
| |
| BNM Risk Management in Technology Policy Document, Cyber Incident Notification and Threat Intelligence SharingBank Negara Malaysia, Risk Management in Technology (RMiT) policy document (BNM/RH/PD 028-98), paras. S 11.18 and S 11.19 | since |
| BNM Risk Management in Technology Policy Document, Cyber Risk Framework, Monitoring, Red Team Testing and Incident Response PlanBank Negara Malaysia, Risk Management in Technology (RMiT) policy document (BNM/RH/PD 028-98), paras. S 11.2 to S 11.16 | since |
| Cyber Security Act, National Critical Information Infrastructure Entities, Code of Practice, Risk Assessment and AuditCyber Security Act 2024 (Act 854), ss. 17, 20 to 22 and 24 | since |
| Cyber Security Act, Notification of a Cyber Security Incident to the Chief Executive and the Sector LeadCyber Security Act 2024 (Act 854), s. 23 | since |
 Mongolia
mn
3 instruments
| |
| Law on Cyber Security, Critical Information Infrastructure Organizations' Duty to Notify Cyber-Attacks and FailuresLaw of Mongolia on Cyber Security, adopted , in force , Art. 19 (notification duties) | since |
| Law on Cyber Security, Critical Information Infrastructure Organizations' Security DutiesLaw of Mongolia on Cyber Security, adopted , in force , Art. 19 (security duties) | since |
| Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal PersonsLaw of Mongolia on Cyber Security, adopted , in force , Art. 17.3 | since |
 Nepal
np
2 instruments
| |
| Information Technology Guidelines for Commercial Banks, Information Security Programme and AuditNepal Rastra Bank Information Technology Guidelines, August 2012, Applicability, Information Security and IS Audit | in force |
| Information Technology Guidelines for Commercial Banks, Monthly Report of Electronic AttacksNepal Rastra Bank Information Technology Guidelines, August 2012, Fraud Management | in force |
 Oman
om
2 instruments
| |
| Central Bank of Oman Open Banking Regulatory Framework, Cybersecurity and Information SecurityCentral Bank of Oman Open Banking Regulatory Framework, Article 5 and Annexure 3 | in force |
| Central Bank of Oman Open Banking Regulatory Framework, Notification of Security IncidentsCentral Bank of Oman Open Banking Regulatory Framework, Article 6.6.3 and Annexure 3 section 13.3.1(f) | in force |
 Pakistan
pk
1 instrument
| |
| Prevention of Electronic Crimes Act, Directives to Owners of Designated Information Systems and Service ProvidersPrevention of Electronic Crimes Act 2016 (Act No. XL of 2016), ss. 48 and 49 | since |
 Philippines
ph
3 instruments
| |
| Anti-Financial Account Scamming Act, Protection of Access to Clients' Financial AccountsRepublic Act No. 12010 (2024), Anti-Financial Account Scamming Act, Section 6 | in force |
| Manual of Regulations for Banks, Cyber Incident and Service Disruption Notification to the Bangko SentralManual of Regulations for Banks, Section 148 (Information Technology Risk Management), reporting and notification standards | in force |
| Manual of Regulations for Banks, Information Technology Risk Management and Information SecurityManual of Regulations for Banks, Section 148 (Information Technology Risk Management), IT governance, information security and annual IT profile | in force |
 Qatar
qa
6 instruments
| |
| Qatar Central Bank Insurance Sector Cyber Security Regulation, cyber security requirementsQatar Central Bank Insurance Sector Cyber Security Regulation (2019), Sections 1 to 9 | in force |
| Qatar Central Bank Insurance Sector Cyber Security Regulation, incident management and reportingQatar Central Bank Insurance Sector Cyber Security Regulation (2019), Section 8.2 | in force |
| Qatar Central Bank Technology Risk Instructions for Financial Services Operators, incident management and notificationQatar Central Bank Technology Risk Instructions for Financial Services Operators (2022), Section 1.4 | in force |
| Qatar Central Bank Technology Risk Instructions for Financial Services Operators, security requirementsQatar Central Bank Technology Risk Instructions for Financial Services Operators (2022), Sections 1 to 3 | in force |
| Qatar Central Bank Technology Risks Regulation for Banks, cyber security requirementsQatar Central Bank Technology Risks Regulation for Banks (January 2018), Sections 1 to 9 | in force |
| Qatar Central Bank Technology Risks Regulation for Banks, incident management and reportingQatar Central Bank Technology Risks Regulation for Banks (January 2018), Section 8.2 | in force |
 Saudi Arabia
sa
2 instruments
| |
| Essential Cybersecurity Controls (ECC-2:2024), cybersecurity incident and threat managementEssential Cybersecurity Controls (ECC-2:2024), Control 2-13 | in force |
| Essential Cybersecurity Controls (ECC-2:2024), minimum cybersecurity controlsEssential Cybersecurity Controls (ECC-2:2024), Scope of Work and Applicability and Controls 2-10 and 2-11 | in force |
 Singapore
sg
6 instruments
| |
| Cybersecurity Act 2018, Compliance with Codes of Practice and Standards of PerformanceCybersecurity Act 2018 (Act 9 of 2018), s. 35A, as amended by the Cybersecurity (Amendment) Act 2024 (Act 19 of 2024) | since |
| Cybersecurity Act 2018, Report of Cybersecurity Incidents on Third-Party-Owned Critical Information InfrastructureCybersecurity Act 2018 (Act 9 of 2018), s. 16I, as inserted by the Cybersecurity (Amendment) Act 2024 (Act 19 of 2024) | since |
| MAS Notice FSM-N05, Report of Relevant Incidents by BanksMonetary Authority of Singapore Notice FSM-N05 on Technology Risk Management, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 7 and 8 | since |
| MAS Notice FSM-N05, Technology Risk Management Requirements for BanksMonetary Authority of Singapore Notice FSM-N05 on Technology Risk Management, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 5, 6 and 9 | since |
| MAS Notice FSM-N06, Cyber Hygiene Requirements for BanksMonetary Authority of Singapore Notice FSM-N06 on Cyber Hygiene, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 4.1 to 4.6 | since |
| Cybersecurity Act 2018, Report of Cybersecurity Incidents on Provider-Owned Critical Information InfrastructureCybersecurity Act 2018 (Act 9 of 2018), s. 14, with the Cybersecurity (Provider-Owned Critical Information Infrastructure) Regulations 2018 (S 519/2018), reg. 5 | since |
 South Korea
kr
3 instruments
| |
| Information and Communications Network Act, Report on Computer Security IncidentsArts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, ) | since |
| Information and Communications Infrastructure Protection Act, Notification of Cyber Security IncidentsAct on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No. 20068, ), Arts. 13 and 14 | since |
| Information and Communications Infrastructure Protection Act, Protection Measures and Vulnerability AnalysisAct on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No. 20068, ), Arts. 5, 8 to 11 and 30 | since |
 Sri Lanka
lk
2 instruments
| |
| Reporting of Information Technology and Cybersecurity Incidents of Licensed BanksCentral Bank of Sri Lanka Circular No. 02 of 2025 (Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks), paragraphs 2 to 5 and Annexes 01 to 03 | since |
| Technology Risk Management and Resilience for Licensed BanksBanking Act Directions No. 16 of 2021 (Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks), Directions 1 to 8 and Schedule I | since |
 State of Palestine
ps
1 instrument
| |
| Law by Decree No. 41 of 2022 concerning National Payments, Licensing and Security-Systems DutyLaw by Decree No. 41 of 2022 concerning National Payments, Art. 8 | since |
 Tajikistan
tj
1 instrument
| |
| Minimum Requirements for the Software and Hardware Support of Credit Financial Organizations, Information Security RequirementsMinimum Requirements for the Software and Hardware Support of Credit Financial Organizations, approved by Resolution No. 121 of the Board of the National Bank of Tajikistan of (Ministry of Justice registration No. 1203) | in force |
 Thailand
th
2 instruments
| |
| Cybersecurity Act, Critical Information Infrastructure Code of Practice, Risk Assessment and MonitoringCybersecurity Act, B.E. 2562 (2019), ss. 44 to 46, 49, 52 and 54 to 56 | since |
| Cybersecurity Act, Reporting of Cyber Threats by Critical Information Infrastructure OrganizationsCybersecurity Act, B.E. 2562 (2019), ss. 57, 58 and 73 | since |
 Turkey
tr
3 instruments
| |
| Cybersecurity Law, Reporting and Cooperation DutiesLaw No. 7545 (), Art. 7 | since |
| Electronic Communications Network and Information Security Regulation, Breach and Interruption NotificationElektronik Haberleşme Sektöründe Şebeke ve Bilgi Güvenliği Yönetmeliği (Resmî Gazete No. 29059, 13 Temmuz 2014), arts. 12 and 38 | since |
| Electronic Communications Network and Information Security Regulation, Operator Security Management DutiesElektronik Haberleşme Sektöründe Şebeke ve Bilgi Güvenliği Yönetmeliği (Resmî Gazete No. 29059, 13 Temmuz 2014), arts. 5, 6, 13 and 37 | since |
 Turkmenistan
tm
3 instruments
| |
| Law on Virtual Assets, Custody and Platform Protection Duties of Virtual Asset Service ProvidersLaw of Turkmenistan "On Virtual Assets" of , arts. 29, 31, 33 and 35 | since |
| Law on Information and Its Protection, information-security dutyLaw of Turkmenistan No. 72-V, "On Information and Its Protection" (Vedomosti Mejlisa Turkmenistana 2014, No. 2, art. 72; as amended by Laws No. 234-VI of , No. 390-VI of , and No. 445-VI of ), art. 15 | since |
| Law on Communications, network and subscriber-information protection dutiesLaw of Turkmenistan No. 93-IV, "On Communications" (Vedomosti Mejlisa Turkmenistana 2010, No. 1, art. 17; as last amended by Law No. 184-VII of ), arts. 18, 43 | since |
 United Arab Emirates
ae
6 instruments
| |
| Operational Risk Management Regulation, ICT and cybersecurity managementOperational Risk Management Regulation (C 1/2026), Articles 8 and 9 | since |
| Operational Risk Management Regulation, notification of significant events and high-risk IncidentsOperational Risk Management Regulation (C 1/2026), Articles 9.4.4 and 15 | since |
| ADGM General Rulebook, Cyber Risk Management FrameworkADGM General Rulebook (GEN), Rules 3.5.1 to 3.5.17 | since |
| ADGM General Rulebook, notification of a material Cyber IncidentADGM General Rulebook (GEN), Rule 3.5.18 | since |
| DFSA General Module, Cyber Risk Management FrameworkDFSA Rulebook, General Module (GEN), Rules 5.5.2 to 5.5.18 | in force |
| DFSA General Module, notification of a material Cyber IncidentDFSA Rulebook, General Module (GEN), Rule 5.5.19 | in force |
 Uzbekistan
uz
5 instruments
| |
| State Security Service Order 118, categorization of critical information infrastructure objectsOrder No. 118 of the Chairman of the State Security Service of the Republic of Uzbekistan (, registered by the Ministry of Justice under 3570), Temporary Regulation on categorizing critical information infrastructure objects, paras. 3-6, 14, 15 and 18 | since |
| Law on Cybersecurity, cybersecurity incident notification dutyLaw No. O'RQ-764 () "On Cybersecurity," Arts. 3, 16, 22-24 | since |
| Law on Cybersecurity, duties of critical information infrastructure subjectsLaw No. O'RQ-764 () "On Cybersecurity," Arts. 26-29 | since |
| Law on Cybersecurity, general cybersecurity duties on cybersecurity subjectsLaw No. O'RQ-764 () "On Cybersecurity," Arts. 3, 16, 37 | since |
| Law on Informatization, information security duty for information resource and system ownersLaw No. 560-II () "On Informatization," Arts. 19-20 | since |
 Vietnam
vn
5 instruments
| |
| Cybersecurity Law, Incident Response and Reporting DutiesLaw No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) | since |
| Cybersecurity Law, Information System Classification and Protection MeasuresLaw No. 116/2025/QH15 (Law on Cybersecurity), arts. 8, 10 | since |
| Cybersecurity Law, Information Systems Critical to National Security, Appraisal, Inspection and Incident DutiesLaw No. 116/2025/QH15 (Law on Cybersecurity), arts. 9 and 11 | since |
| Circular on Information System Security in Banking Operations, Classification and Security AssessmentCircular No. 09/2020/TT-NHNN (security of information systems in banking operations), arts. 3 and 42 | since |
| Circular on Information System Security in Banking Operations, Incident Reporting to the State BankCircular No. 09/2020/TT-NHNN (security of information systems in banking operations), art. 54(1) | since |
 Yemen
ye
1 instrument
| |
| Law No. 40 of 2006 on Electronic Payment Systems and Financial and Banking Operations, Secure-Services and Banking-Confidentiality DutyLaw No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations, art. 27 | since |
| Africa | |
| Economic Community of West African States · 11 member states | |
 Benin
bj
4 instruments
| |
| Digital Code: Electronic Communications Operator Security-Event Detection and Control DutiesLoi n°2017-20 du 20 avril 2018, Livre VI, Titre I, Chapitre XIII, arts. 599-601 et 603, portant Code du Numérique en République du Bénin | in force |
| Digital Code: Trust Service Provider Security Measures and Conformity AuditLoi n°2017-20 du 20 avril 2018, Livre III, Titre I, art. 308, et Titre II, arts. 317-319, portant Code du Numérique en République du Bénin | in force |
| Digital Code: Trust Service Provider Security-Breach NotificationLoi n°2017-20 du 20 avril 2018, Livre III, Titre I, arts. 309-310, portant Code du Numérique en République du Bénin | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produitsLoi n°2017-20 du 20 avril 2018, Livre VI, Titre I, Chapitre XIII, Article 598, portant Code du Numérique en République du Bénin | in force |
 Cabo Verde
cv
4 instruments
| |
| Cybersecurity Regime: Security Measures of Critical Infrastructure and Essential-Service OperatorsDecreto-lei nº 9/2021, arts. 11, 15 and 17 (regime jurídico de cibersegurança) | in force |
| Cybersecurity Regime: Security Measures of Digital Service ProvidersDecreto-lei nº 9/2021, arts. 12 and 19 (regime jurídico de cibersegurança) | in force |
| Cybersecurity Regime: Incident Notification by Critical Infrastructure and Essential-Service OperatorsDecreto-lei nº 9/2021, arts. 16 and 18 (regime jurídico de cibersegurança) | from a date not yet set |
| Cybersecurity Regime: Incident Notification by Digital Service ProvidersDecreto-lei nº 9/2021, arts. 20 and 31 (regime jurídico de cibersegurança) | from a date not yet set |
 Côte d'Ivoire
ci
5 instruments
| |
| Electronic Communications Law: Security Incident Notification by OperatorsLoi n°2024-352 du 6 juin 2024 relative aux communications électroniques, article 98 | since |
| Electronic Communications Law: Security of Networks and ServicesLoi n°2024-352 du 6 juin 2024 relative aux communications électroniques, articles 97 et 99 | since |
| Mandatory Information Systems Security Audit and CertificationDécret n°2021-917 du 22 décembre 2021, Arts. 3-4, 19-21 | since |
| Mandatory Reporting of Attacks, Intrusions and DisruptionsDécret n°2021-917 du 22 décembre 2021, Arts. 16-17 | since |
| RGSSI and PPIC Compliance DutyDécret n°2021-916 du 22 décembre 2021, Arts. 1-2 | since |
 Gambia
gm
4 instruments
| |
| Information and Communications Act, 2009, security of information and communications services (safeguards duty)Information and Communications Act, 2009 (No. 2 of 2009), sec. 140(1)-(2) | since |
| Information and Communications Act, 2009, security of information and communications services (subscriber risk notification)Information and Communications Act, 2009 (No. 2 of 2009), sec. 140(3)-(6) | since |
| Central Bank of The Gambia Cybersecurity Guidelines for Financial Institutions: Governance, Risk Management and Cyber Resilience RequirementsCybersecurity Guidelines for Financial Institutions (Central Bank of The Gambia), parts 3 and 4 | in force |
| Central Bank of The Gambia Cybersecurity Guidelines for Financial Institutions: Reporting of Cyber IncidentsCybersecurity Guidelines for Financial Institutions (Central Bank of The Gambia), parts 3 and 5 (incident reporting) | in force |
 Ghana
gh
9 instruments
| |
| Critical Information Infrastructure Directive, Baseline Cybersecurity RequirementsCII Directive (CSA, 2021) baseline requirements, paras 5.1, 5.2 and 7, Directive for the Protection of Critical Information Infrastructure | since |
| Critical Information Infrastructure Directive, Incident and Vulnerability ReportingCII Directive (CSA, 2021) incident and vulnerability reporting, para 5.3, Directive for the Protection of Critical Information Infrastructure | since |
| Cybersecurity Act, Critical Information Infrastructure Designation, Registration and AuditCybersecurity Act, 2020 (Act 1038), ss. 35-38 and 39(1)(b)-(c), and Second Schedule items 36(4), 39(2)(b) and 39(2)(c) | since |
| Cybersecurity Act, Critical Information Infrastructure Owner's Incident ReportCybersecurity Act, 2020 (Act 1038), s. 39(1)(a), and Second Schedule item 39(2)(a) | since |
| Cybersecurity Act, Cybersecurity Standards and EnforcementCybersecurity Act, 2020 (Act 1038), s. 59, and Second Schedule item 59(4) | since |
| Cybersecurity Act, Duty to Report Cybersecurity IncidentCybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) | since |
| Cybersecurity Act, Licensing of Cybersecurity Service ProvidersCybersecurity Act, 2020 (Act 1038), ss. 49-53, First Schedule, and Second Schedule items 49(2) and 51(5) | since |
| Bank of Ghana Cyber and Information Security Directive, Incident ReportingBank of Ghana CISD 2026 incident reporting (Cyber and Information Security Directive, March 2026), paras 50 and 115 | in force |
| Bank of Ghana Cyber and Information Security Directive, Security ProgrammeBank of Ghana CISD 2026 security programme (Cyber and Information Security Directive, March 2026), paras 2, 4, 10, 13, 18, 51 and 120 | in force |
 Guinea-Bissau
gw
1 instrument
| |
| BCEAO Electronic Money Instruction: Security and Continuity Requirements of IssuersInstruction n°008-05-2015 de la BCEAO sur la monnaie électronique, art. 7 | since |
 Liberia
lr
7 instruments
| |
| Central Bank of Liberia Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services: Information Technology Systems, Security and ControlsRegulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services in Liberia, regs. 9, 10.2, 17.2 and 25.1 | since |
| Central Bank of Liberia Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services: Reporting of Security ViolationsRegulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services in Liberia, reg. 9.1(d) | since |
| Central Bank of Liberia Mobile Money Regulations, 2014: Reporting of Security Breaches and Service InterruptionsMobile Money Regulations, 2014, reg. 29 (reporting) | in force |
| Central Bank of Liberia Mobile Money Regulations, 2014: Security Policies, Business Continuity and Security AuditMobile Money Regulations, 2014, regs. 12 and 29 | in force |
| LTA Cybersecurity Regulations 2026: Cybersecurity Unit, Risk Identification, Protection, Detection and Recovery Duties of Telecommunications Service ProvidersLTA Cybersecurity Regulations 2026 (LTA REG 0013 - 2026), regs. 7.1 to 7.5, 7.7, 7.8 and 10 | in force |
| LTA Cybersecurity Regulations 2026: Incident Notification and Semiannual Reporting to the Liberia Telecommunications AuthorityLTA Cybersecurity Regulations 2026 (LTA REG 0013 - 2026), regs. 7.6, 7.9 and 10.6 | in force |
| Telecommunications Act 2007, Security Safeguards for Customer Information and Communications§ 51(5), Telecommunications Act 2007 (Republic of Liberia) | in force |
 Nigeria
ng
14 instruments
| |
| NAICOM Guidelines for Insurtech Operations, August 2025, Technology Security and Access ControlsNational Insurance Commission, Guidelines for Insurtech Operations in Nigeria, August 2025, ss. 9.1 and 9.2 | since |
| CBN Risk-Based Cybersecurity Framework for Banks and Payment Service Banks, 2024, 24-Hour Cyber-Incident ReportRisk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks, 2024, s. 5 and Appendices I and VII | since |
| CBN Risk-Based Cybersecurity Framework for Banks and Payment Service Banks, 2024, Cybersecurity Programme and ControlsRisk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks, 2024, ss. 1 to 3 and Appendices III and IV | since |
| Designation and Protection of Critical National Information Infrastructure Order, 2024, Protection of Designated Critical National Information InfrastructureDesignation and Protection of Critical National Information Infrastructure Order, 2024, paras. 2 to 7 | since |
| Banks and Other Financial Institutions Act, 2020, Cybersecurity Regulation by the Central BankBanks and Other Financial Institutions Act, 2020 (Act No. 5 of 2020), s. 68 | since |
| CBN Guidelines for the Operations of Agent Banking, October 2025, Monthly Returns on Fraud, Theft and RobberyGuidelines for the Operations of Agent Banking in Nigeria, October 2025, ss. 9.1.2 and 12 and Appendix I | in force |
| CBN Guidelines for the Operations of Agent Banking, October 2025, Security, Authentication and Geo-Fencing ControlsGuidelines for the Operations of Agent Banking in Nigeria, October 2025, ss. 9.3, 9.4 and 10.5 to 11 | in force |
| CBN Guidelines on Operations of Electronic Payment Channels, Security and Fraud Controls for ATM, POS, Mobile POS and Web AcquiringGuidelines on Operations of Electronic Payment Channels in Nigeria, ss. 1.5, 2.3, 3.2 and 4.3 | in force |
| CBN Nigerian Payments System Risk and Information Security Management Framework, Information Security Duties of Operators, Participants and Payment Service ProvidersNigerian Payments System Risk and Information Security Management Framework, ss. 8.6, 9.1 and 13 | in force |
| CBN Regulatory Framework for USSD Financial Services, Security and Authentication ControlsRegulatory Framework for the Use of Unstructured Supplementary Service Data (USSD) for Financial Services in Nigeria, ss. 6 and 10 | in force |
| CBN Supervisory Framework for Payment Service Banks, July 2021, Cybersecurity and IT StandardsSupervisory Framework for Payment Service Banks, July 2021, s. 9.0 | in force |
| Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024, Reporting of Cyber Threats to the National CERTCybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 | in force |
| NCC Cyber Resilience Framework for the Nigerian Communication Sector, Cyber Incident Reporting to NCC-CSIRTCyber Resilience Framework for the Nigerian Communication Sector (CRF-NCS), Version 1.0, February 2026, ss. 4.4 and 7.2 and Annexure IV | from , in 4 months |
| NCC Cyber Resilience Framework for the Nigerian Communication Sector, Cybersecurity Programme and ControlsCyber Resilience Framework for the Nigerian Communication Sector (CRF-NCS), Version 1.0, February 2026, ss. 3.4, 4.4 and 8.4 | from , in 4 months |
 Senegal
sn
2 instruments
| |
| Electronic Communications Code, Notification of Security BreachesArt. 16 notification of breaches of security, Loi n° 2018-28 portant Code des communications électroniques | in force |
| Electronic Communications Code, Security and Integrity of NetworksArt. 16 security and integrity of networks, Loi n° 2018-28 portant Code des communications électroniques | in force |
 Sierra Leone
sl
4 instruments
| |
| Bank of Sierra Leone Cyber Security and IT Risk Management Guidelines for Commercial Banks: Cyber Security Incident and Threat ReportingCyber Security and IT Risk Management Guidelines for Commercial Banks (Government Notice 429 of 2021), secs. 2.1, 7.0 and 9.0 (incident reporting) | since |
| Bank of Sierra Leone Cyber Security and IT Risk Management Guidelines for Commercial Banks: Governance, Controls, Defense and ResponseCyber Security and IT Risk Management Guidelines for Commercial Banks (Government Notice 429 of 2021), secs. 1.6 to 8.0 | since |
| Cyber Security and Crime Act, 2021, Critical National Information InfrastructureCyber Security and Crime Act, 2021 (Act No. 7 of 2021), ss. 7-8 (Critical National Information Infrastructure) | since |
| Cyber Security and Crime Act, 2021, Reporting of Cyber Security IncidentsCyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats) | since |
 Togo
tg
2 instruments
| |
| Loi n° 2018-026, opérateurs de services essentiels and the National Cybersecurity Agency (ANCy)Titre II (Arts. 3, 5-7), Loi n° 2018-026 du 07 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité | since |
| Cybersecurity Rules for Operators of Essential ServicesArrêté N°2022-040/PMRT du 29 juin 2022 portant adoption des règles de cybersécurité en République togolaise (Règles de Cybersécurité, version 1.0) | in force |
| Africa (non ECOWAS) | |
 Algeria
dz
1 instrument
| |
| Presidential Decree 20-05, National Information Systems Security System: Duty to Designate a Security OfficerDécret présidentiel n° 20-05 du 20 janvier 2020 portant mise en place d’un dispositif national de la sécurité des systèmes d’information, art. 41 | in force |
 Angola
ao
5 instruments
| |
| BNA Aviso 08/2020, Cybersecurity Policy and Cloud Contracting Duties of Supervised Financial InstitutionsAviso n.º 8/20 (BNA), Artigos 4.º a 7.º e 9.º a 12.º | since |
| BNA Aviso 08/2020, Notification of Cyber Incidents to the Banco Nacional de AngolaAviso n.º 8/20 (BNA), Artigo 8.º | since |
| Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination DutiesLei n.º 7/17, Artigos 15.º, 16.º, 40.º e 41.º | since |
| Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and DatabasesLei n.º 7/17, Artigos 12.º, 13.º, 14.º, 17.º, 18.º e 19.º | since |
| Lei de Protecção das Redes e Sistemas Informáticos, Security Duties of Electronic-Communications Network Operators and Critical Infrastructure OperatorsLei n.º 7/17, Artigos 6.º a 11.º | since |
 Botswana
bw
2 instruments
| |
| Cybersecurity Act, Critical National Information Infrastructure RegimeCybersecurity Act, 2025 (Act No. 21 of 2025), ss. 45-52 | from a date not yet set |
| Cybersecurity Act, Reporting of Cybersecurity IncidentsCybersecurity Act, 2025 (Act No. 21 of 2025), s. 53 | from a date not yet set |
 Burundi
bi
1 instrument
| |
| Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providersLoi n° 1/10 du 16 mars 2022 portant prevention et repression de la cybercriminalite au Burundi, Arts. 3, 4(3), 14 | since |
 Cameroon
cm
1 instrument
| |
| Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)Loi n°2010/012 du 21 décembre 2010, art. 6-7, 13-14, 24, 26-30, 32, 61(3) | since |
 Central African Republic
cf
3 instruments
| |
| Cybersecurity Law: Essential-Service Operator Cybersecurity RegimeLoi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre I (art. 7 à 12) | since |
| Cybersecurity Law: Mandatory Security Audit RegimeLoi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) | since |
| Cybersecurity Law: Network and Information System Security DutyLoi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre III, Sections I et II (art. 16, 19, 20, 21, 23) | since |
 Democratic Republic of the Congo
cd
5 instruments
| |
| Digital Code, Livre II: Trust Service Provider Security Risk-Management DutyCode du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 147, et art. 164 pour les sanctions) | since |
| Digital Code, Livre II: Trust Service Provider Security-Incident NotificationCode du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 148 et 149) | since |
| Digital Code, Livre IV: Digital Services Provider Security ObligationsCode du numérique, Livre IV, Titre III, Chapitre I, Section 2, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 295 à 297) | since |
| Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting DutyCode du numérique, Livre IV, Titre II, Chapitre I, et Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 276 et 281) | since |
| Digital Code, Livre IV: ICT Product and Service Vendor Security CertificationCode du numérique, Livre IV, Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 294) | since |
 Djibouti
dj
6 instruments
| |
| Digital Code, Book II: Electronic Communications Network and Service SecurityLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Deuxième, Art. 169 | in force |
| Digital Code, Book VI: Critical Installation Protection and Operator Security ControlsLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Sixième, Titre 3 (Arts. 679 à 684) | in force |
| Digital Code, Book VII: Health-Data Hosting Security CertificationLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Septième, Arts. 760 à 763 | in force |
| Digital Code, Book VII: National Health Data System Security Incident ReportingLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Septième, Art. 747 | in force |
| National Cybersecurity Authority Law: Security Duties of Operators of Vital ImportanceLoi n° 195/AN/25/9ème L portant création de l’Autorité Nationale de Cybersécurité, Arts. 9, 12 et 13 | in force |
| National Cybersecurity Authority Law: Significant Incident Notification by Operators of Vital ImportanceLoi n° 195/AN/25/9ème L portant création de l’Autorité Nationale de Cybersécurité, Art. 13 | in force |
 Egypt
eg
3 instruments
| |
| Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes, System-Security Duty on a System ManagerLaw No. 175 of 2018 on Anti-Cyber and Information Technology Crimes, Arts. 29, 42, 44 | since |
| Law No. 175 of 2018, Duty of a Legal Entity's Manager to Report a Crime Against Its SystemLaw No. 175 of 2018, Art. 35 (duty to report a crime against an entity's system) | since |
| Law No. 175 of 2018, Service Providers' Duty to Secure Data and InformationLaw No. 175 of 2018, Art. 2 (First) (service providers' duty to secure data) | since |
 Eswatini
sz
4 instruments
| |
| CBE Cybersecurity Guidelines for Financial Institutions No. 1 of 2021: Cyber Incident NotificationCBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 7.5.1 and 7.5.2 | since |
| CBE Cybersecurity Guidelines for Financial Institutions No. 1 of 2021: Cyber Resilience FrameworkCBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 1.3, 3 to 9 and 11 | since |
| Minimum Standards for Electronic Payment Schemes: Reporting of Fraud, Major Security Breaches and Service InterruptionsMinimum Standards for Electronic Payment Schemes, September 2010, paras. 4.3 and 4.4 | in force |
| Minimum Standards for Electronic Payment Schemes: Security Controls, Business Continuity and Incident Response PlanningMinimum Standards for Electronic Payment Schemes, September 2010, paras. 1.4, 5.1, 9.1.7, 9.2 and 11.3 to 11.4 | in force |
 Ethiopia
et
7 instruments
| |
| Requirements for Information Technology (IT) Management Directive, IT Incident ReportingNational Bank of Ethiopia Directive No. 886/2022, IT incident reporting (Requirements for Information Technology (IT) Management), arts. 3, 10 | since |
| Requirements for Information Technology (IT) Management Directive, IT Risk Management and Security ProgrammeNational Bank of Ethiopia Directive No. 886/2022, IT risk management and security programme (Requirements for Information Technology (IT) Management), arts. 3, 6 to 9 | since |
| Requirements for Information Technology (IT) Management of Banks Directive, IT Incident ReportingNational Bank of Ethiopia Directive No. 889/2022, IT incident reporting (Requirements for Information Technology (IT) Management of Banks), arts. 3, 10 | since |
| Requirements for Information Technology (IT) Management of Banks Directive, IT Risk Management and Security ProgrammeNational Bank of Ethiopia Directive No. 889/2022, IT risk management and security programme (Requirements for Information Technology (IT) Management of Banks), arts. 3, 6 to 9 | since |
| Computer Crime Proclamation, Duty to Report Computer Crime and Illegal ContentComputer Crime Proclamation No. 958/2016, art. 2(13), art. 2(19), art. 17, art. 27, art. 46 | since |
| Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner ObligationsCritical Infrastructure Cybersecurity Proclamation No. 1426/2026, art. 3, art. 4, art. 5, art. 7, art. 8, art. 22(1)(a), art. 22(1)(d)-(f), art. 22(2)-(3), art. 22(5), art. 25(1)(a), art. 25(1)(c)-(d), art. 25(2)-(4), art. 28 | from , in 8 months |
| Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERTCritical Infrastructure Cybersecurity Proclamation No. 1426/2026, art. 7(14), art. 9(2), art. 22(1)(b)-(c), art. 22(2)-(3), art. 22(5), art. 25(1)(b), art. 25(2)-(4), art. 28 | from , in 8 months |
 Gabon
ga
3 instruments
| |
| Cybersecurity Law: Critical Infrastructure and Service Operator Protection RegimeLoi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre Ier, arts. 9-18 et 35 | since |
| Cybersecurity Law: Electronic Communications Network Operator Security DutiesLoi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre II, arts. 19-22 | since |
| Sécurité des systèmes d'information (dispositions communes)Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre III, Section 2, arts. 28-35 | since |
 Kenya
ke
12 instruments
| |
| Virtual Asset Service Providers Regulations, Cybersecurity Systems, Controls and Continuity PlansVirtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 18, 21, 96, 97 and 100 | since |
| Virtual Asset Service Providers Regulations, Reporting of Cybersecurity IncidentsVirtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 26 and 99 | since |
| Virtual Asset Service Providers Act, Cybersecurity Measures and Business ContinuityVirtual Asset Service Providers Act (No. 20 of 2025), ss. 24(k) and 28 | since |
| Virtual Asset Service Providers Act, Notice of a Cyber-Security IncidentVirtual Asset Service Providers Act (No. 20 of 2025), s. 25 | since |
| Critical Information Infrastructure Regulations, Incident Reporting by an OwnerComputer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024), reg. 65 | since |
| Critical Information Infrastructure Regulations, Licensed Internet Gateway OperatorsComputer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024), reg. 35 | since |
| Critical Information Infrastructure Regulations, Owner Security, Continuity and Compliance ReportComputer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024), regs. 28 to 34, 42 and 46 | since |
| Computer Misuse and Cybercrimes Act, Critical Information Infrastructure Designation, Directives and Compliance ReportComputer Misuse and Cybercrimes Act (No. 5 of 2018), ss. 9 and 13 | since |
| Computer Misuse and Cybercrimes Act, Critical Infrastructure Owner's Report of Threats to the CommitteeComputer Misuse and Cybercrimes Act (No. 5 of 2018), s. 11 | since |
| Computer Misuse and Cybercrimes Act, Reporting of Cyber ThreatComputer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 | since |
| National Payment System Regulations, Monthly Report of Service Interruptions and Security BreachesNational Payment System Regulations, 2014 (Legal Notice No. 109 of 2014), reg. 29(2)(c) | since |
| National Payment System Regulations, Security of Payment Services and Annual System Security AuditNational Payment System Regulations, 2014 (Legal Notice No. 109 of 2014), regs. 27(2)(d) and 29(3)(c) | since |
 Madagascar
mg
3 instruments
| |
| Banking Act: Cybersecurity Duties of Credit InstitutionsLoi n°2020-011 sur la loi bancaire, art. 164 | in force |
| Electronic Money Act: Data and Transaction Security of Electronic Money InstitutionsLoi n° 2016-056 sur la monnaie électronique, arts. 51 and 52 | in force |
| Electronic Money Act: Notice to Users of a Major Service IncidentLoi n° 2016-056 sur la monnaie électronique, art. 92 | in force |
 Mauritius
mu
5 instruments
| |
| Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 (Government Notice No. 113 of 2026), regs. 3 to 9 | since |
| Bank of Mauritius Guideline on Cyber and Technology Risk ManagementBank of Mauritius Guideline on Cyber and Technology Risk Management (BOM/BSD 780/May 2023), Parts I to VIII and X | since |
| Bank of Mauritius Guideline on Cyber and Technology Risk Management, Incident ReportingBank of Mauritius Guideline on Cyber and Technology Risk Management (BOM/BSD 780/May 2023), paras. 55(viii) and 95-97 | since |
| Cybersecurity and Cybercrime Act 2021, Critical Information Infrastructure ProtectionCybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), Part V (ss. 33-34 and 37) | since |
| Cybersecurity and Cybercrime Act 2021, Reports on Critical Information Infrastructure IncidentsCybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), s. 35 | since |
 Morocco
ma
5 instruments
| |
| Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification DutiesLoi n° 05-20 relative à la cybersécurité, Chapitre II, Section 3, Arts. 27, 30 et 33, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe | since |
| Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security DutiesLoi n° 05-20 relative à la cybersécurité, Chapitre II, Section 3, Arts. 26, 29, 32 et 34, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe | since |
| Bank Al-Maghrib Directive on Intrusion Tests of Credit Institutions' Information SystemsDirective n° 3/W/16 du 10 juin 2016 fixant les règles minimales à observer par les établissements de crédit pour réaliser les tests d’intrusion des systèmes d’information | since |
| Loi n° 05-20, Vital Infrastructure Incident DeclarationLoi n° 05-20, Chapitre II, Arts. 8 et 14 (déclaration d’incident, infrastructures d’importance vitale) | in force |
| Loi n° 05-20, Vital Infrastructure Security RegimeLoi n° 05-20, Chapitre II, Section 2, Arts. 14 à 25 (infrastructures d’importance vitale) | in force |
 Mozambique
mz
4 instruments
| |
| Banco de Moçambique Aviso 6/GBM/2026, Data Centers, Cloud Contracting and Data Security for Credit Institutions and Financial CompaniesAviso n.º 6/GBM/2026, Arts. 4 a 12 | since |
| Cybersecurity Law, General Security Requirements for the Public Administration and the Private SectorLei n.º 13/2026, arts. 47 a 50 | since |
| Cybersecurity Law, Incident Notification and Responsible Vulnerability DisclosureLei n.º 13/2026, arts. 57 a 66 | since |
| Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital ProvidersLei n.º 13/2026, arts. 51 a 56 | since |
 Namibia
na
6 instruments
| |
| Bank of Namibia Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12), Cyber Incident ReportingPSD-12, cyber incident reporting, paras. 11.13 to 11.15 | since |
| Bank of Namibia Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12), Cybersecurity StandardsPSD-12, cybersecurity standards, paras. 9 to 13 | since |
| Bank of Namibia Determination on Information Security (BID-30) of 2017, Information Security ProgrammeBID-30 (2017), information security programme, paras. 8 to 18 | since |
| Bank of Namibia Determination on Information Security (BID-30) of 2017, Reporting of Material IncidentsBID-30 (2017), incident reporting, para. 17.1 | since |
| Bank of Namibia Determination on Information Security (BID-30) of 2026, Incident ReportingBID-30 (2026), incident reporting, paras. 12.1 to 12.5 | from a date not yet set |
| Bank of Namibia Determination on Information Security (BID-30) of 2026, Information Security FrameworkBID-30 (2026), information security framework, paras. 7 to 11 | from a date not yet set |
 Republic of the Congo
cg
4 instruments
| |
| Cybersecurity Law: Duty to Inform the Agency of Attacks, Intrusions and DisturbancesLoi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 18 et 19 | in force |
| Cybersecurity Law: General Security Duties of Every Operator of an Information SystemLoi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 4 à 11 | in force |
| Cybersecurity Law: Mandatory Periodic Security AuditLoi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 12 à 16 | in force |
| Cybersecurity Law: Security of Electronic Communications ServicesLoi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, article 20 | in force |
 Rwanda
rw
6 instruments
| |
| Law regulating virtual asset business, Notifiable Events Including Cyber-AttacksLaw No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 21(1)(b) | since |
| Law regulating virtual asset business, Technology and Information SecurityLaw No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 28 | since |
| Regulation on Cyber Security in Regulated Institutions, Cyber Security ProgrammeNational Bank of Rwanda Regulation N° 50/2022 of 02/06/2022 on Cyber Security in Regulated Institutions, arts. 2-20 and 22 | since |
| Regulation on Cyber Security in Regulated Institutions, Notification and Reporting of Cyber IncidentsNational Bank of Rwanda Regulation N° 50/2022 of 02/06/2022 on Cyber Security in Regulated Institutions, art. 21 | since |
| Law governing Information and Communication Technologies, Network Security DutiesLaw N° 24/2016 of 18/06/2016 governing Information and Communication Technologies, arts. 125 and 208 (security measures) | since |
| Law governing Information and Communication Technologies, Notice of Network Security Risks to UsersLaw N° 24/2016 of 18/06/2016 governing Information and Communication Technologies, arts. 125 and 208 (notice to users) | since |
 Seychelles
sc
4 instruments
| |
| Seychelles National Payment System (Electronic Money) Regulations, 2022: Reporting of Security Breaches and Loss of Confidential DataNational Payment System (Electronic Money) Regulations, 2022 (S.I. 128 of 2022), regs. 18 and 19 (reporting) | in force |
| Seychelles National Payment System (Electronic Money) Regulations, 2022: Technical Requirements, Systems and Controls of Electronic Money IssuersNational Payment System (Electronic Money) Regulations, 2022 (S.I. 128 of 2022), reg. 13 | in force |
| Seychelles Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024: Cyber Security Strategy, Systems and Controls, Audit and Business ContinuityVirtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, regs. 4-6, 8-9 and 11 | in force |
| Seychelles Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024: Reporting of Cyber Security RiskVirtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, reg. 7 | in force |
 Somalia
so
0 instruments
| |
| Somalia Cybersecurity Act (2026)Somalia Cybersecurity Act (2026) (Federal Republic of Somalia), approved by the House of the People of the Federal Parliament; no law number located | proposed |
 South Africa
za
4 instruments
| |
| SARB Directive on Cyber-Incident Reporting within the National Payment SystemDirective No. 01 of 2024 (SARB), cyber-incident reporting within the national payment system, para. 5.2 | since |
| SARB Directive on Cybersecurity and Cyber-Resilience within the National Payment SystemDirective No. 01 of 2024 (SARB) in respect of cybersecurity and cyber-resilience within the national payment system, para. 5.1 | since |
| Electronic Communications and Transactions Act, Protection of Critical DatabasesElectronic Communications and Transactions Act 25 of 2002, Chapter IX (ss. 52 to 58) | since |
| Cybercrimes Act, Duty to Report Cybercrime Offences to the PoliceCybercrimes Act 19 of 2020, s. 54 | from a date not yet set |
 South Sudan
ss
1 instrument
| |
| National Communication Act, 2012, Licensee Security DutyNational Communication Act, 2012 (Act No. 24), sec. 88 | in force |
 Tanzania
tz
6 instruments
| |
| Critical Information Infrastructure Order, designation, registration and owner dutiesCybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), regs. 3, 4 and 6 to 12 | since |
| Critical Information Infrastructure Order, self-assessment by government institutions and private entitiesCybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5 | since |
| Computer Emergency Response Team Regulations, Cyber Security Duties of Service ProvidersElectronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 8 and 9 as amended by GN No. 570 of 2023 | in force |
| Computer Emergency Response Team Regulations, Security Breach Notification by Constituencies and UsersElectronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports) | in force |
| Computer Emergency Response Team Regulations, Security Breach Notification by Service ProvidersElectronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 8, 9(2) and 12(4) (notification and reports) | in force |
| Computer Emergency Response Team Regulations, Security Duties of Constituencies and UsersElectronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023 | in force |
 Tunisia
tn
5 instruments
| |
| Cybersecurity Incident Reporting and Emergency ResponseDécret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 17-20, 24-25 | since |
| Décret-loi n° 2023-17, Security Measures for Vital Digital Infrastructure OperatorsDécret-loi n° 2023-17, Arts. 21-22 | since |
| Mandatory Security Audit and Digital-Trust ClassificationDécret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 6-9, 14-16, 24-25 | since |
| Banque Centrale de Tunisie Circular on Payment Institutions, Notification of Cyber Attacks and IntrusionsCirculaire BCT n° 2018-16, Art. 10 | in force |
| Banque Centrale de Tunisie Circular on Payment Institutions, Security Device, Annual Audit and TestsCirculaire BCT n° 2018-16, Arts. 9-10 | in force |
 Uganda
ug
2 instruments
| |
| National Payment Systems Regulations, 2021, Electronic Money Issuer Incident NotificationNational Payment Systems Regulations, 2021 (S.I. No. 18 of 2021), reg. 22(4) | in force |
| National Payment Systems Regulations, 2021, Licensee Risk ManagementNational Payment Systems Regulations, 2021 (S.I. No. 18 of 2021), reg. 32(1)-(3) | in force |
 Zambia
zm
2 instruments
| |
| Cyber Security Act, Critical Information Infrastructure RegimeCyber Security Act, 2025 (Act No. 3 of 2025), ss. 8-16, 19 and 64 | since |
| Cyber Security Act, Reporting of Cyber Security IncidentsCyber Security Act, 2025 (Act No. 3 of 2025), s. 17 | since |
| Oceania | |
 Australia
au
7 instruments
| |
| Security Standards for Smart DevicesCyber Security Act 2024 (Cth), No. 98, 2024, Part 2, ss. 13-24; Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276), Schedule 1 | since |
| Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules, Critical Telecommunications AssetsSecurity of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025, ss. 5, 7, 9, 11 and 17; Security of Critical Infrastructure Act 2018 (Cth), Part 2A | since |
| Security of Critical Infrastructure Act, Critical Infrastructure Risk Management ProgramsSecurity of Critical Infrastructure Act 2018 (Cth), Part 2A, ss. 30AB-30AD; Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, ss. 4 and 8 | since |
| Security of Critical Infrastructure Act, Notification of Cyber Security IncidentsSecurity of Critical Infrastructure Act 2018 (Cth), Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5 | since |
| Security of Critical Infrastructure Act, Enhanced Cyber Security Obligations for Systems of National SignificanceSecurity of Critical Infrastructure Act 2018 (Cth), Part 2C, ss. 30CB, 30CD, 30CM and 30CU; s. 52B | since |
| Prudential Standard CPS 234 Information Security, Notification to APRAPrudential Standard CPS 234 Information Security (APRA), paras 35 and 36; Banking Act 1959 (Cth), s. 11AG | since |
| Prudential Standard CPS 234 Information Security, Security Capability and ControlsPrudential Standard CPS 234 Information Security (APRA), paras 15, 18 and 21; Banking Act 1959 (Cth), ss. 11AF and 11AG | since |
 Fiji
fj
2 instruments
| |
| Reserve Bank of Fiji Prudential Supervision Policy Statement 2, Cybersecurity Incident ReportingPrudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), para. 17 | since |
| Reserve Bank of Fiji Prudential Supervision Policy Statement 2, Cybersecurity Risk Management FrameworkPrudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), paras. 4 to 16 | since |
 Kiribati
ki
2 instruments
| |
| Cybersecurity Act 2026, Critical Infrastructure Operator ObligationsCybersecurity Act 2026 (Act No. 7 of 2026), ss. 12-20, 22-23 (Parts V-VI) | from a date not yet set |
| Cybersecurity Act 2026, Duty to Report a Cybersecurity IncidentCybersecurity Act 2026 (Act No. 7 of 2026), s. 21 (Part VI) | from a date not yet set |
 Marshall Islands
mh
2 instruments
| |
| Cybersecurity Act 2025, Cybersecurity Incident Reporting ObligationsCybersecurity Act 2025, 40 MIRC Ch. 4 § 407 (P.L. 2025-0027) | since |
| Cybersecurity Act 2025, Cybersecurity of Critical Information InfrastructureCybersecurity Act 2025, 40 MIRC Ch. 4 §§ 405-406 (P.L. 2025-0027) | since |
 Micronesia
fm
1 instrument
| |
| FSM Telecommunications Act of 2014, Security Safeguards for Customer Information§ 349(1)(b), Title 21 (Telecommunications), Chapter 3, FSM Code, as inserted by Public Law No. 18-52 (2014) | since |
| FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock§ 412, Subchapter III, C.B. No. 24-14 (Cybersecurity Act 2025), proposed new Chapter 4, Title 21, FSM Code | proposed |
| FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Risk-Management Duties§§ 407-411, Subchapter III, C.B. No. 24-14 (Cybersecurity Act 2025), proposed new Chapter 4, Title 21, FSM Code | proposed |
 New Zealand
nz
1 instrument
| |
| Telecommunications (Interception Capability and Security) Act 2013, Network SecurityTelecommunications (Interception Capability and Security) Act 2013 (NZ), No 91, Part 3, ss. 45-48 and 53 | since |
 Papua New Guinea
pg
1 instrument
| |
| Bank of Papua New Guinea Directive on Electronic Fund Transfers 02/2019, Technology and Information Security StandardsDirective on Electronic Fund Transfers 02/2019 (Bank of Papua New Guinea), s. 4 | in force |
| Cybersecurity Bill 2026, Critical Information Infrastructure ProtectionCybersecurity Bill 2026 (Papua New Guinea consultation draft), Part IV, ss. 31 to 34, 36, 37 and 39 | proposed |
| Cybersecurity Bill 2026, Incident Reporting by CII Operators and Financial InstitutionsCybersecurity Bill 2026 (Papua New Guinea consultation draft), ss. 35 and 41(b) | proposed |
| Cybersecurity Bill 2026, Mandatory Incident Reporting by Any EntityCybersecurity Bill 2026 (Papua New Guinea consultation draft), s. 111 | proposed |
| Cybersecurity Bill 2026, Protection of Financial SystemsCybersecurity Bill 2026 (Papua New Guinea consultation draft), Part V, ss. 40 and 41 | proposed |
 Samoa
ws
2 instruments
| |
| Commercial Banks Prudential Statements, Prudential Statement 11 on cybersecurity incident reportingCommercial Banks Prudential Statements, January 2021, Prudential Statement 11 (Cybersecurity), paras. 105-106 | in force |
| Commercial Banks Prudential Statements, Prudential Statement 11 on cybersecurity risk managementCommercial Banks Prudential Statements, January 2021, Prudential Statement 11 (Cybersecurity), paras. 1-3, 99-103 and 107 | in force |
 Solomon Islands
sb
4 instruments
| |
| Central Bank of Solomon Islands Prudential Guideline No. 20 on Cybersecurity, Cybersecurity Risk Management FrameworkPrudential Guideline No. 20, paras. 7 to 110 (Central Bank of Solomon Islands) | since |
| Central Bank of Solomon Islands Prudential Guideline No. 20 on Cybersecurity, Incident Notification to the Central BankPrudential Guideline No. 20, paras. 111 and 112 (Central Bank of Solomon Islands) | since |
| Central Bank of Solomon Islands Prudential Guideline No. 13 on Information Technology Security Risk ManagementPrudential Guideline No. 13, paras. 9 to 19 (Central Bank of Solomon Islands) | since |
| Telecommunications Act 2009, Security Safeguards for Consumer Informations. 72(1)(b), Telecommunications Act 2009 (Solomon Islands) | since |
 Tonga
to
4 instruments
| |
| Prudential Banking Standard No. 15, Cybersecurity incident reporting by banksPrudential Banking Standard No. 15 - 2021, Cybersecurity, paras. 105-106 | since |
| Prudential Banking Standard No. 15, Cybersecurity risk management for banksPrudential Banking Standard No. 15 - 2021, Cybersecurity, paras. 1-3, 99-103 and 107 | since |
| Cybersecurity Act 2025, Critical Infrastructure Operator ObligationsAct 14 of 2025, ss. 11-14, 16-17 | from a date not yet set |
| Cybersecurity Act 2025, Duty to Report a Cybersecurity IncidentAct 14 of 2025, s. 15 | from a date not yet set |
 Tuvalu
tv
1 instrument
| |
| Banking Commission Act, security of banks' computer access and Internet banking platformsBanking Commission Act (Act 3 of 2011, Cap. 38.02), ss. 38(4) and 39(2)-(3) | in force |
| Other | |
 Bermuda
bm
7 instruments
| |
| Bermuda Monetary Authority Operational Cyber Risk Management Code of Conduct, Governance and ProgrammeOperational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 2, 14-17, 56-57 and 67-68 | since |
| Bermuda Monetary Authority Operational Cyber Risk Management Code of Conduct, Notification of Cyber Reporting EventsOperational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 41-44 | since |
| Bermuda Monetary Authority Insurance Sector Operational Cyber Risk Management Code of Conduct, Governance and ProgrammeInsurance Sector Operational Cyber Risk Management Code of Conduct (October 2020), paras. 1, 5.1-5.3 and 8 | since |
| Bermuda Monetary Authority Insurance Sector Operational Cyber Risk Management Code of Conduct, Notification of Cyber Reporting EventsInsurance Sector Operational Cyber Risk Management Code of Conduct (October 2020), para. 6.5 | since |
| Bermuda Digital Asset Business (Cybersecurity) Rules 2018: Annual Cyber Security Report and Cyber Security ProgramDigital Asset Business (Cybersecurity) Rules 2018, BR 99 / 2018 | since |
| Bermuda Digital Asset Business Act 2018: Senior Representative's Notice and Report of a Cyber Reporting EventDigital Asset Business Act 2018, s. 20 | since |
| Cybersecurity Act 2024, Critical National Information Infrastructure RegimeCybersecurity Act 2024 (2024:13), ss. 9, 10, 12 and 16 | from a date not yet set |
 Cayman Islands
ky
2 instruments
| |
| CIMA Rule on Cybersecurity for Regulated Entities, Cybersecurity Framework and GovernanceCayman Islands Monetary Authority Rule on Cybersecurity for Regulated Entities (April 2023), paras. 3, 5, 6 and 9 | in force |
| CIMA Rule on Cybersecurity for Regulated Entities, Notification RequirementsRule on Cybersecurity for Regulated Entities (April 2023), para. 8 | in force |
 Hong Kong
hk
2 instruments
| |
| Protection of Critical Infrastructures (Computer Systems) Ordinance, Incident NotificationCap. 653, s. 28 and Schedule 6 (Protection of Critical Infrastructures (Computer Systems) Ordinance) | since |
| Protection of Critical Infrastructures (Computer Systems) Ordinance, Operator Security ObligationsProtection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), ss. 12, 19 to 27, 55 and 65 | since |
 Kosovo
xk
4 instruments
| |
| Central Bank Regulation on Information Systems and Cyber Risk Management, Incident ReportingRregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik, Neni 31 | since |
| Central Bank Regulation on Information Systems and Cyber Risk Management, Security ProgrammeRregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik | since |
| Law No. 08/L-173 on Cyber Security, Incident Reporting and EnforcementLaw No. 08/L-173 on Cyber Security, Arts. 6, 8 and 24 | since |
| Law No. 08/L-173 on Cyber Security, Security MeasuresLaw No. 08/L-173 on Cyber Security, Arts. 2, 3, 5 and 7 | since |
 Taiwan
tw
6 instruments
| |
| Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security UnitArts. 24-25 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries (金融控股公司及銀行業內部控制及稽核制度實施辦法), full-text revision promulgated (Financial Supervisory Commission Order Jin-Guan-Yin-Guo-Zi No. 11502710961), effective on promulgation for the articles cited here | since |
| Cyber Security Incident Reporting, Response and Drills Regulations, Specific Non-Government Agency ClocksRegulations Governing the Reporting, Response and Drills for Cyber Security Incidents (資通安全事件通報應變及演練辦法), full-text amendment issued (Ministry of Digital Affairs Order Shu-Shou-Zi-Fa-Zi No. 1145000415), Arts. 11 and 13 | since |
| Cyber Security Management Act, Cyber Security Incident ReportingArts. 24 and 29 of the Cyber Security Management Act (資通安全管理法), full-text amendment promulgated (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective | since |
| Cyber Security Management Act, Specific Non-Government Agency Cyber Security ManagementArts. 3(6)-(8), 7-8, 20-23 and 30 of the Cyber Security Management Act (資通安全管理法), full-text amendment promulgated (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective | since |
| Telecommunications Management Act, Announcement and Report of Service SuspensionTelecommunications Management Act (電信管理法), enacted , Arts. 11 and 79 | since |
| Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection PlansArts. 15, 42, 76 and 79 of the Telecommunications Management Act (電信管理法), enacted , effective for the provisions cited here | since |
United States: states and territories214 in 53 jurisdictions
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
Canada: provinces10 in 4 jurisdictions
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
Listed here from other areas1 law
Each law below is filed under another area of law, where it is counted. It is listed here because it speaks to cybersecurity law in its own terms, and the line under its name says how.
| Instrument | When |
|---|---|
| Product security requirements | |
Product Liability Directive, liability for defective products including softwareDirective (EU) 2024/2853
 European UnionPrimary area: Product and AI liability law
Safety-relevant cybersecurity requirements count in deciding whether a product is defective (Art. 7(2)(f)), and a defect caused by missing software updates needed to keep the product safe is not excused (Art. 11(2)(c)). |
from , in 5 weeks |
What this page claims, and what it does not
The stages are the in-force tag's. Each filter is one of the
states the tag names across lexlint.io, in its words (in force, not yet in
force, blocked by a court, proposed, no longer in force, and never in force),
and each filter's label wears that tag's mark. In the tables a law in force
is unmarked, its date in plain text, and every other law wears the same tag
the rest of lexlint.io draws: highlighted, boxed, dotted, or struck with its
reason underlined. A withdrawn bill has a filter of its own, never in force:
the /law/<jurisdiction> docket leaves it out, and "no
longer in force" would be false of a law that never was.
Blocked by a court has its own filter. A law a court has blocked is neither in force nor gone: an injunction can be lifted on appeal, and the duty with it. Pooled with a repeal it would hide a count that reads as a signal, how contested a jurisdictional hook is. It is off by default, with the proposals and the laws that have ended.
One date column, and it says what kind of date it is. The date is the day the law started or starts to bind: the earlier of a published start date and the instrument's own date. Neither source is reliably the start, and the earlier one cannot make a law look newer than it is. The column draws the in-force tag, so a bare date never stands beside a law that has stopped: a law in force reads "since" its date, a law not yet in force is highlighted with its date and how far off it is, a law a court has blocked is boxed in red, and an ended law has its dates struck and its reason underlined. Nothing is inferred from our own review date.
The map is the table. Its fill is the count of instruments at the
stages you chose, binned on the same RAMP_BINS edges
/law/map uses, and it redraws on
every change. Point at, click, or tab to a jurisdiction for what applies there,
every stage it holds shown even when your filter is excluding it.
Three ways of showing nothing, and they are different claims. A jurisdiction washed pale holds cybersecurity law your filter is excluding, so widening the filter brings it back. A hatched jurisdiction is one we track and hold no cybersecurity law for at all: that is a statement about our research, not about the law. A white shape has no jurisdiction record for this topic at all. Only the first of the three moves when you change the filter; the other two are facts about us and hold still.
Nothing here needs the script. The default resultset is in the
HTML: counts, tally, map fills and the hidden rows are all rendered at
build. The script recomputes them when a box changes and does nothing else,
which is what lets this page ship under script-src 'self' and
be read whole by a crawler.
Every instrument here links its own note page, which carries the primary source and the date it was read. This is a research index, not legal advice.