Governance
Legal requirements in the EU
ePrivacy Directive (cookie law) - EPD - NB will be replaced by ePrivacy Regulation
General Data Protection Regulation GDPR - privacy
NIS2 - EU Cybersecurity rules. Articles in a more readable format (set up by cyber risk gmbh)
Cyber Resilience Act (CRA) - mandatory cybersecurity requirements for manufacturers + retailers
European Data Act
Liability for Defective Products
AI Act
Corporate Sustainability Reporting Directive (CSRD) - only large and listed companies
National legal requirements to think of
International Certifications
ISO 9001 - quality management systems
ISO/IEC 27001 (EU and rest of world) / SOC2 (North America) - how to protect your data
ISO/IEC 27002 - how to handle access to data and incident response
UK NCSC CRA - UK’s National Cyber Security Centre Cyber Resilience Audit which assures providers who can conduct independent Cyber Assessment Framework (CAF) based audits
NIST Cybersecurity Framework 2.0 (CSF) - US version of NIS2
Local Certifications
Thuiswinkel.org - for webshops
EU Standards
ETSI - globally applicable standards for ICT-enabled systems, applications and services deployed across all sectors of industry and society
Pentesting - oddly enough, there is no standard really
International Pacts / Agreements
G7 Hiroshima AI Process
AI Treaty / Framework Convention on artificial intelligence and human rights, democracy, and the rule of law (CETS No. 225). signed by Andorra, Georgia, Iceland, Norway, the Republic of Moldova, San Marino, the United Kingdom as well as Israel, the United States of America and the European Union.
AI Pact - a voluntary pre-signup to the AI act before all conditions come into force