Per Iowa Code 715D.5-1 and Iowa Personal Information Security Breach Notification Law (Iowa Code 715C separate statute) controllers and processors must implement security + breach response + records discipline. (1) Reasonable Security (Iowa Code 715D.5-1): establish + implement + and maintain reasonable administrative + technical + and physical data security practices to protect the confidentiality + integrity + and accessibility of personal data + appropriate to the volume and nature of the personal data at issue (FTC reasonable security baseline + NIST CSF + ISO 27001 alignment). (2) Iowa Breach Notification (Iowa Code 715C): separately requires controllers (database owners) holding personal information of Iowa residents (including SSN + driver license + financial account + credit card with security code + medical info + ID number + biometric) to notify (a) affected Iowa residents in the most expeditious manner possible without unreasonable delay following discovery of a breach; (b) Iowa Attorney General within 5 days of discovery if breach affects more than 500 Iowa residents; (c) any consumer reporting agencies if the breach affects more than 1000 Iowa residents. Notification content: (a) description of breach; (b) approximate date of breach; (c) type of personal information disclosed; (d) toll-free numbers for credit reporting agencies; (e) advice to remain vigilant by reviewing account statements + credit reports. Substitute notice rules apply for very large affected populations. (3) Records of Processing: while ICDPA does not explicitly require ROPA like GDPR + controllers are expected to maintain records of consumer rights requests + contracts + breach notifications + security policies + audit. (4) Encryption: while ICDPA does not mandate encryption + reasonable security practices typically include encryption at rest + in transit + key management + secure software development lifecycle. (5) Pseudonymisation: ICDPA does not explicitly address pseudonymous data + controllers should treat as personal data unless qualifying as de-identified. (6) De-Identification: per Iowa Code 715D.1-13 de-identified data exempt from ICDPA upon attestation + public commitment + contractual prohibition on re-identification. Coordinates with Iowa Breach Notification Iowa Code 715C + FTC Reasonable Security + NIST CSF + GLBA Safeguards Rule (where overlapping) + HIPAA Security Rule (where overlapping) + state attorney general guidance + similar state privacy laws + India CERT-In Directions. ICDPA Security + Breach applies.
This control maps to 27 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 27 it maps to, and the evidence behind each claim, over MCP and REST.