Frameworks / Nebraska Data Privacy Act / NDPA-1 Nebraska Data Privacy Act
Scope and Applicability
Nebraska Data Privacy Act NDPA-1: Applicability, Scope, and Carve-Outs Determine applicability of the Nebraska Data Privacy Act (NDPA) per Neb. Rev. Stat. 87-1101 to 87-1124. The NDPA applies to any entity that: (a) conducts business in Nebraska or produces products or services targeted to Nebraska residents, (b) is not a small business as defined by the federal Small Business Administration (SBA), (c) processes or sells personal data UNLESS specifically exempt. Unique among US state laws - NO consumer threshold (broadest US state privacy law in this respect). Maintain documentation of exempt status (financial institutions subject to GLBA + HIPAA covered entities + FERPA institutions + nonprofits + government entities + air carriers + small businesses per SBA size standards + B2B data subject to limited exemption).
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 755 controls across 181 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-03 Multi-factor authentication requirements BSI-04 Remote access controls BSI-05 Wireless access restrictions BSI-08 Cryptographic protection of data BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.20 Right to data portability GDPR-Art.25 Data protection by design and by default GDPR-Art.35 Data protection impact assessment GDPR-Art.38 Position of the data protection officer GDPR-Art.45 Transfers on the basis of an adequacy decision GDPR-Art.9 Processing of special categories of personal data IM8-CLD.2 Cloud Security Controls IM8-CLD.4 Cloud Data Sovereignty IM8-DAT.2 Data Protection IM8-DAT.3 Data Sharing and Transfer IM8-DAT.4 Data Retention and Disposal IM8-DSS.3 Secure Development Practices IM8-RES.2 Disaster Recovery IM8-RES.3 Incident Response IM8-SEC.2 Access Control IM8-SEC.4 Vulnerability Management APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A26 Report of Leakage to the Commission and Notification to the Person APPI-A27 Restriction on Provision to Third Parties APPI-A31 Provision of Personally Referable Information APPI-A33 Request for Disclosure of Retained Personal Data APPI-A34 Request for Correction, Addition or Deletion APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.22_23_24 Cross-border data transfers (UAE PDPL Articles 22-24) UAE-PDPL-Art.25_26_27_28_29 UAE Data Office establishment, powers, penalties, complaints (UAE PDPL Articles 25-29) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) UAE-PDPL-Art.6_7 Sensitive personal data and children's data (UAE PDPL Articles 6-7) UAE-PDPL-Art.8 Records of processing activities (UAE PDPL Article 8) UAE-PDPL-FreeZones Coordination with DIFC, ADGM and sectoral data protection regimes UAE-PDPL-Status UAE PDPL status, executive regulations, UAE Data Office guidance evolution ISO27799-01 ePHI access controls and authorization ISO27799-02 ePHI encryption at rest and in transit ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access ISO27799-06 Security management process and risk analysis ISO27799-08 Information access management ISO27799-16 Transmission security and encryption ISO27799-17 Facility access controls AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-12 Section 62 - Administrative penalties AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AT-DSG-2 Section 2 - Scope and application AT-DSG-7 Section 18 - Establishment of the Data Protection Authority AT-DSG-8 Section 22 - Functions and powers of the DPA BB-DPA-1 Section 1 - Short Title BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-17 Section 24 - Appropriate Safeguards BB-DPA-2 Section 2 - Interpretation BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-21 Sections 61-69 - Data Privacy Officer BB-DPA-4 Section 4 - Principles Relating to Processing ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation ISO23894-A.1 Data Quality and Representativeness ISO23894-A.5 Privacy and Data Protection in AI 27011-1 Scope 27011-3 Terms and definitions 27011-5.2 Information Security Roles in Telecoms 27011-5.3 Segregation of duties 27011-6.3 Awareness and Training 27011-8.1 User Endpoint Devices 27011-8.3 Cryptography and key management 27011-8.6 Data protection and backup ISO27043-04 Roles and responsibilities definition ISO27043-11 Access control policy and enforcement ISO27043-14 Privileged access management ISO27043-15 Access review and recertification ISO27043-17 Encryption of data at rest ISO27043-18 Encryption of data in transit ISO27043-19 Certificate management ISO27043-20 Key lifecycle management 27400-3 Terms and definitions 27400-5.4 Data and privacy risks 27400-6.2 Device Identity and Authentication 27400-6.3 Secure Update Mechanism 27400-6.5 Security monitoring and incident response 27400-7.1 Network Security for IoT 27400-7.3 Data minimization and purpose limitation 27400-7.4 Data retention and deletion ISO21434-04 Roles and responsibilities definition ISO21434-12 User access management and provisioning ISO21434-14 Privileged access management ISO21434-15 Access review and recertification ISO21434-16 Cryptographic policy and key management ISO21434-17 Encryption of data at rest ISO21434-18 Encryption of data in transit ISO21434-19 Certificate management ISMSP-AC-01 Access Control Policy ISMSP-AC-04 Network Access Control ISMSP-MS-02 Risk Management ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation ISMSP-SYS-04 Vulnerability Management ISMSP-SYS-05 Incident Response API1164-06 Access Control API1164-07 Remote Access API1164-09 Patch and Vulnerability Management API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface API1164-24 Vulnerability assessment for critical systems IEC62443-07 Personnel risk assessment IEC62443-08 Electronic access perimeter management IEC62443-10 Revocation of access procedures IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents IEC62443-24 Vulnerability assessment for critical systems ISO27019-07 Personnel risk assessment ISO27019-08 Electronic access perimeter management ISO27019-10 Revocation of access procedures ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents ISO27019-24 Vulnerability assessment for critical systems NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-3 Sensitive Personal Data, Children, and Special Categories NG-NDPA-4 Data Subject Rights and Automated Decision-Making NG-NDPA-5 Security of Processing, Breach Notification, and DPIA NG-NDPA-6 Data Protection Officer, DPCO, and Processor Agreements NG-NDPA-7 Cross-Border Data Transfers and International Cooperation NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework AUPRV-3 APP 6-9 Use/Disclosure, Direct Marketing, Cross-Border, Government Identifiers AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-5 APP 12-13 Access and Correction of Personal Information AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement AWWA-1.1 Security Policy and Governance AWWA-1.2 Risk Assessment AWWA-2.1 User Access Management AWWA-2.4 Physical Access Controls AWWA-3.2 Remote Access Security AWWA-3.4 Encryption and Data Protection DA-1 Enterprise Data Architecture DIQ-1 Data Integration and Interoperability DIQ-2 Data Quality Management DIQ-3 Metadata Management DSO-2 Data Security DSO-3 Data Access Management FFIEC-05 Roles and responsibilities definition FFIEC-08 Application security controls FFIEC-09 Encryption and key management FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement ISO-22320-5.1 General process requirements ISO-22320-5.2 Incident management process ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability NGNDPR-2 Governing Principles, Lawful Basis, and Consent under NDPR Section 2.1-2.3 NGNDPR-4 Data Subject Rights and Automated Decision-Making NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security NGNDPR-6 Data Protection Officer, DPCOs, and Processor Obligations NGNDPR-7 Cross-Border Transfer of Personal Data under NDPR Section 2.7-CBT NGNDPR-8 Annual Data Protection Audit, Penalties, and NDPA Transition AL-DPA-1 Scope and Definitions AL-DPA-12 International Data Transfers AL-DPA-14 Direct Marketing AL-DPA-3 Lawful Basis for Processing AL-DPA-7 Right of Access AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-2 Article 2 - Basic Concepts AZ-DPA-6 Article 6 - State regulation in personal data protection IS.AR.215 Information Security Incident Response IS.D.OR.205 Information Security Risk Assessment IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.205 Information Security Risk Assessment IS.I.OR.225 External Reporting FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FEDRAMP-SC-13 Cryptographic Protection FEDRAMP-SC-28 Protection of Information at Rest FEDRAMP-SC-8 Transmission Confidentiality and Integrity 27557-1 Scope 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.2 Scope, context, and criteria for privacy 27557-6.3 Privacy risk assessment PQC-2 FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature PQC-5 Cryptographic Inventory and PQC Migration Roadmap PQC-7 FIPS Validated Modules, HSM Readiness, and Algorithm Validation PQC-8 Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing DSOMM-6 Metrics, Maturity Measurement, and Continuous Improvement PAKPDPB-3 Data Subject Rights PAKPDPB-5 Security of Processing and Personal Data Breach Notification PAKPDPB-6 Cross-Border Transfer and Data Localization PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 ASD37-17 TLS encryption between email servers (Limited) ASD37-27 Outbound data loss prevention (Very Good) ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information APP-8 APP 8 - Cross-border disclosure of personal information 23837-1.1 Scope 23837-1.2 Normative references 23837-1.5.2 Cryptographic module requirements 23837-1.5.3 Network device testing requirements 27010-10.1 Cryptographic Protection 27010-16.1 Continuity of Sharing 27010-9.1 Access Control to Shared Information 27010-9.2 Authentication of Sources NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) OWASPTOP10-1 A01:2025 Broken Access Control OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse) OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports EHDS-HOLD-3 Dataset Descriptions and Catalogues EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) EHDSREG-4 Digital Health Authorities, Governance, MyHealth@EU EHDSREG-5 Cross-Border Health Data Flows CPSC-CS.2 Authentication and Access Controls CPSC-CS.3 Data Protection for Safety Systems CPSC-RA.3 Lifecycle Risk Assessment CPSC-STD.4 Interoperability Safety 4.3.1 Risk Assessment and Impact Analysis 4.4.1 Resources, Roles, Responsibility, and Authority 4.4.7 Emergency and Incident Response CJIS-17 Risk Assessment CJIS-8 Media Protection CJIS-9 System and Communications Protection CAT-D3-1 Preventative controls CAT-D4-3 Third-party access controls CAT-D5-1 Incident planning and strategy FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-702 Definitions (§501.702) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures 62351-2 Glossary of terms 62351-8 Role-based access control (RBAC) 62351-9 Cyber security key management ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO28001-PC-04 Supply Chain Continuity Planning ISO28001-PI-01 Personnel Security Screening ISO28001-PS-01 Facility Security ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-01 Master Data Quality ISO8000-MDG-03 Continuous Improvement ISO-25012-5.1 Establishing data quality requirements ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations ISO27003-4.3 Determining the scope of the information security management system ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure 29147-3 Terms and definitions 29147-5.11 Researcher Safe Harbour and Legal Posture 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy 30111-5.2 Vulnerability handling team NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight PSPF24-4 Physical Security TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-4 Security, Accuracy TRINIDAD-5 Enforcement and Sanctions TURKEYKVKK-1 VERBIS Registration and Lawful Basis TURKEYKVKK-2 Information Notice and Data Subject Rights TURKEYKVKK-3 Special Categories and Sensitive Data D.1 Incident Response Planning D.2 Incident Reporting UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP) UGA-3 Accountability Principle UGA-6 Personal Data Protection Office UGA-7 Data Protection Officer VERMONTAICDA-1 AI System Inventory and Risk Assessment VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-3 Data Localization and Cross-Border VIETNAMCYBER-4 Incident Reporting and Cooperation 58.1 Scope 58.3 Definitions CPS230-11 Identification, Assessment and Management of Operational Risk CPS230-13 Board Accountability for Operational Risk Management CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training CA-10 Selects and Develops Control Activities CA-12 Deploys Through Policies and Procedures AC-2 Account Management CA-9 Internal System Connections AC-2 Account Management CA-9 Internal System Connections ICP-1 Objectives, Powers and Responsibilities of the Supervisor ICP-25 Supervisory Cooperation and Coordination IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-26262-3-5 Item definition ISO-26262-3-7 Hazard analysis and risk assessment (HARA) ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO20000-11 Incident management ISO20000-15 Access management for services 27014-1 Scope 27014-3 Terms and definitions 27031-5.1 IRBC Policy 27031-7.2 Resource Requirements 29115-3 Terms and definitions 29115-7.4 Level of Assurance 4 (LoA4) ITIL4-11 Incident management ITIL4-15 Access management for services STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTSP144-3 Data Classification, Handling, and Sovereignty NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability NHPA-7 Data Protection Assessments and Processor Contracts NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPAPI-6 Security Misconfiguration and Secure API Design OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring PDPASG-1 Accountability, Records, DPO Appointment, and Training PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPATH-4 DPIA, Privacy by Design, Children's Data PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training POPIASA-4 Special Personal Information, Children, Information Quality, Documentation POPIASA-7 Information Officer, Records of Processing, Notification, Training NORWAY-4 DPIA, Privacy by Design, Records of Processing NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan SA-PDPL-19 Data protection officer designation SA-PDPL-21 Data protection impact assessments C1 Organizational Boundary C3 Scope 1 and 2 Coverage 502 Interoperability with Assistive Technology 707 Real-Time Text Functionality KISO-1.3 Definitions KISO-4.1 User data protection SWE-1 Scope and Purpose SWE-2 Relationship to GDPR TEF-2 Openness and Transparency TEFCAREC-1 Common Agreement Conformance and Onboarding CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment Standard 15 Online Tools Standard 2 Data Protection Impact Assessments UKGDPRREG-2 Data Subject Rights (Articles 12-22) UKGDPRREG-3 Controller and Processor (Articles 24-43) CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection URUGUAY-4 Security and Cross-Border URUGUAY-5 Database Registration with AGESIC URCDP CFR211-A-3 Section 211.3 - Definitions AMLCTF-PartA-RiskAssess ML/TF Risk Assessment DS-2 Ensure software supply chain security COBIT-BAI02 Managed requirements definition CA-ITSG33-SC-01 Security Control Catalogue ISO-14064-1-5.1 Organizational boundaries ISO-22313-8.2 Business impact analysis and risk assessment ISO-26000-6.7 Consumer issues 27007-5.2 Audit Programme Objectives 27050-1.4 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition LV-PDPL-Data-Subject-Rights-Access-Correction-Erasure-Restriction-Portability-Objection-Sec18-Sec38 Latvia PDPL Data Subject Rights + Access + Correction + Erasure + Portability + Section 18 + 38 NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) OMANCS-4 Data Protection, Cryptography, and Privacy Alignment 2.2.2 2.2.2 Vendor default accounts managed PARAGUAY-5 Security of Processing, Data Integrity, Information Security PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions QATAR-7 DPO, Records, Retention, Marketing, Training RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) SOC-CY-C2 Encryption and Data Protection SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration STUDPRV-2 Data Subject Rights for Students and Parents TISAXASS-3 Prototype Protection and Confidentiality TAIWAN-3 Data Subject Rights TANZANIA-1 Scope, Registration, Lawful Basis TSSR-INFO-1 Network Data Protection TEXASTDPSA-3 Sensitive Data, Children, Sale Notice UKAI-2 Sector-Specific Regulator Engagement UNESCOAI-2 Principles 4-7: Sustainability, Privacy, Human Oversight, Transparency UNICEFAI-4 Transparency, Explanation, Adult Capacity USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern US-ITAR-EAR-DS-01 Technical Data Protection VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children VPSHR-3 Implementation Guidance and Reporting W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 755 it maps to, and the evidence behind each claim, over MCP and REST.