Governance: Difference between revisions
| (One intermediate revision by the same user not shown) | |||
| Line 6: | Line 6: | ||
[[General Data Protection Regulation GDPR]] - privacy | [[General Data Protection Regulation GDPR]] - privacy | ||
NIS2 | [https://digital-strategy.ec.europa.eu/en/policies/nis2-directive NIS2] - EU Cybersecurity rules. [https://www.nis-2-directive.com/NIS_2_Directive_Articles.html Articles in a more readable format] (set up by cyber risk gmbh) | ||
Cyber Resilience Act | [https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act Cyber Resilience Act (CRA)] - mandatory cybersecurity requirements for manufacturers + retailers | ||
European Data Act | European Data Act | ||
| Line 15: | Line 15: | ||
AI Act | AI Act | ||
[https://finance.ec.europa.eu/capital-markets-union-and-financial-markets/company-reporting-and-auditing/company-reporting/corporate-sustainability-reporting_en Corporate Sustainability Reporting Directive (CSRD)] - only large and listed companies | |||
== National legal requirements to think of == | == National legal requirements to think of == | ||
| Line 28: | Line 30: | ||
[[UK NCSC CRA]] - UK’s National Cyber Security Centre Cyber Resilience Audit which assures providers who can conduct independent Cyber Assessment Framework (CAF) based audits | [[UK NCSC CRA]] - UK’s National Cyber Security Centre Cyber Resilience Audit which assures providers who can conduct independent Cyber Assessment Framework (CAF) based audits | ||
NIST Cybersecurity Framework 2.0 - US version of NIS2 | [https://www.nist.gov/cyberframework NIST Cybersecurity Framework 2.0 (CSF)] - US version of NIS2 | ||
== Local Certifications == | == Local Certifications == | ||
Latest revision as of 06:12, 4 December 2024
Legal requirements in the EU
ePrivacy Directive (cookie law) - EPD - NB will be replaced by ePrivacy Regulation
General Data Protection Regulation GDPR - privacy
NIS2 - EU Cybersecurity rules. Articles in a more readable format (set up by cyber risk gmbh)
Cyber Resilience Act (CRA) - mandatory cybersecurity requirements for manufacturers + retailers
European Data Act
Liability for Defective Products
AI Act
Corporate Sustainability Reporting Directive (CSRD) - only large and listed companies
National legal requirements to think of
International Certifications
ISO 9001 - quality management systems
ISO/IEC 27001 (EU and rest of world) / SOC2 (North America) - how to protect your data
ISO/IEC 27002 - how to handle access to data and incident response
UK NCSC CRA - UK’s National Cyber Security Centre Cyber Resilience Audit which assures providers who can conduct independent Cyber Assessment Framework (CAF) based audits
NIST Cybersecurity Framework 2.0 (CSF) - US version of NIS2
Local Certifications
Thuiswinkel.org - for webshops
EU Standards
ETSI - globally applicable standards for ICT-enabled systems, applications and services deployed across all sectors of industry and society
Pentesting - oddly enough, there is no standard really
International Pacts / Agreements
G7 Hiroshima AI Process
AI Treaty / Framework Convention on artificial intelligence and human rights, democracy, and the rule of law (CETS No. 225). signed by Andorra, Georgia, Iceland, Norway, the Republic of Moldova, San Marino, the United Kingdom as well as Israel, the United States of America and the European Union.
AI Pact - a voluntary pre-signup to the AI act before all conditions come into force