Frameworks / Nebraska Data Privacy Act / NDPA-2 Nebraska Data Privacy Act
Consumer Rights
Nebraska Data Privacy Act NDPA-2: Consumer Rights - Access, Correct, Delete, Portability, Appeal Implement consumer rights per the NDPA covering: (a) right to confirm whether the controller is processing personal data + access to that data, (b) right to correct inaccuracies, (c) right to delete personal data provided by or obtained about the consumer, (d) right to obtain a portable copy of personal data, (e) right to opt out of targeted advertising + sale of personal data + profiling. Respond to requests within 45 days (extendable by 45 days with notice). Provide a clear and conspicuous appeal mechanism with response within 60 days. Recognise authorised agents acting on behalf of consumers with reasonable verification.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 487 controls across 168 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-3 Sensitive Personal Data, Children, and Special Categories NG-NDPA-4 Data Subject Rights and Automated Decision-Making NG-NDPA-5 Security of Processing, Breach Notification, and DPIA NG-NDPA-6 Data Protection Officer, DPCO, and Processor Agreements NG-NDPA-7 Cross-Border Data Transfers and International Cooperation NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance ISMSP-AC-01 Access Control Policy ISMSP-AC-04 Network Access Control ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation ISMSP-SYS-04 Vulnerability Management ISMSP-SYS-05 Incident Response API1164-06 Access Control API1164-07 Remote Access API1164-09 Patch and Vulnerability Management API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A26 Report of Leakage to the Commission and Notification to the Person APPI-A33 Request for Disclosure of Retained Personal Data APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information BSI-03 Multi-factor authentication requirements BSI-04 Remote access controls BSI-05 Wireless access restrictions BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities IEC62443-07 Personnel risk assessment IEC62443-08 Electronic access perimeter management IEC62443-10 Revocation of access procedures IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO-22320-5.1 General process requirements ISO-22320-5.2 Incident management process ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples ISO27019-07 Personnel risk assessment ISO27019-08 Electronic access perimeter management ISO27019-10 Revocation of access procedures ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-2 Section 2 - Interpretation BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-21 Sections 61-69 - Data Privacy Officer DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management DSO-2 Data Security DSO-3 Data Access Management RMD-1 Reference Data Management GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.9 Processing of special categories of personal data NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C RG5.71-C.3 Cyber Security Training RG5.71-C.5 Recovery and Restoration RG5.71-C.6 Configuration Management AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-2 Article 2 - Basic Concepts FFIEC-05 Roles and responsibilities definition FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) UAE-PDPL-Art.6_7 Sensitive personal data and children's data (UAE PDPL Articles 6-7) ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-A.5 Privacy and Data Protection in AI 27011-1 Scope 27011-3 Terms and definitions 27011-5.3 Segregation of duties 27011-8.1 User Endpoint Devices ISO27043-04 Roles and responsibilities definition ISO27043-11 Access control policy and enforcement ISO27043-14 Privileged access management ISO27043-15 Access review and recertification 27400-3 Terms and definitions 27400-5.4 Data and privacy risks 27400-6.5 Security monitoring and incident response 27400-7.3 Data minimization and purpose limitation 27557-1 Scope 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.2 Scope, context, and criteria for privacy ISO21434-04 Roles and responsibilities definition ISO21434-12 User access management and provisioning ISO21434-14 Privileged access management ISO21434-15 Access review and recertification PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 AWWA-1.1 Security Policy and Governance AWWA-2.1 User Access Management AWWA-2.4 Physical Access Controls AL-DPA-1 Scope and Definitions AL-DPA-12 International Data Transfers AL-DPA-3 Lawful Basis for Processing APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting CAT-D3-1 Preventative controls CAT-D4-3 Third-party access controls CAT-D5-1 Incident planning and strategy FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-702 Definitions (§501.702) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO27799-01 ePHI access controls and authorization ISO27799-08 Information access management ISO27799-17 Facility access controls ISO28001-PC-04 Supply Chain Continuity Planning ISO28001-PI-01 Personnel Security Screening ISO28001-PS-01 Facility Security 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27010-16.1 Continuity of Sharing 27010-9.1 Access Control to Shared Information 27010-9.2 Authentication of Sources 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure 30111-3 Terms and definitions 30111-5.1 Organizational policy 30111-5.2 Vulnerability handling team ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management ORANWG11-6 Security Test Specifications, Certification, and Conformance PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training PICSGMP-5 Chapter 5: Production Operations and Material Management PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight PSPF24-4 Physical Security IM8-RES.2 Disaster Recovery IM8-RES.3 Incident Response IM8-SEC.2 Access Control TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-2 Lawful Processing and Consent TRINIDAD-3 Data Subject Rights Section 6(5) Definition of Foreign Public Official Section 8 Definition of Associated Person UKBRIBE-3 Due Diligence on Third Parties 58.1 Scope 58.3 Definitions CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) 4.4.1 Resources, Roles, Responsibility, and Authority 4.4.7 Emergency and Incident Response MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training CA-10 Selects and Develops Control Activities CA-12 Deploys Through Policies and Procedures FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 62351-2 Glossary of terms 62351-8 Role-based access control (RBAC) ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO20000-11 Incident management ISO20000-15 Access management for services ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope ITIL4-11 Incident management ITIL4-15 Access management for services STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NGNDPR-2 Governing Principles, Lawful Basis, and Consent under NDPR Section 2.1-2.3 NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security DSOMM-1 Culture, Organization, Education, and Governance DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management PAKPDPB-5 Security of Processing and Personal Data Breach Notification PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response RIDTPPA-1 Scope, Applicability, Definitions RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data PICERL-P2 Risk Assessment PICERL-P3 CSIRT Formation SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) SOC2-CC7.4 CC7.4 Responding to security incidents SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-PI1.1 PI1.1 - Processing Integrity Definition C1 Organizational Boundary C3 Scope 1 and 2 Coverage SCA-S2 Interpretation and Definitions SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration TANZANIA-1 Scope, Registration, Lawful Basis TANZANIA-4 Security and Cross-Border D.1 Incident Response Planning D.2 Incident Reporting UKGAMBLE-1 Scope and Applicability to Licensees UKGAMBLE-4 Resilience and Incident Response CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation US-SEC-DA-SC-01 Howey Test Application US-SEC-DA-SC-02 Registration Requirements USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation CFR211-A-3 Section 211.3 - Definitions CPS230-13 Board Accountability for Operational Risk Management DS-2 Ensure software supply chain security COBIT-BAI02 Managed requirements definition CA-ITSG33-SC-01 Security Control Catalogue CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ISO-14064-1-5.1 Organizational boundaries ISO-26262-3-5 Item definition ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives 27050-1.4 Terms and definitions 29115-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX OSSFSC-1 Branch Protection, Code Review, and Repository Governance 2.2.2 2.2.2 Vendor default accounts managed PCI-P2PE-05 Roles and responsibilities definition PCI-PIN-05 Roles and responsibilities definition PCI-SSF-05 Roles and responsibilities definition PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PTESPHASE-1 Pre-Engagement Interactions and Scoping PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices) RCEPEC-1 Online Personal Information Protection (12.13) SHAREASSESS-1 Information Governance and Risk SUPCHAIN-1 Build Integrity - Source, Build, Provenance SWE-2 Relationship to GDPR TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights UKGDPRREG-1 Subject Matter, Scope, Principles (Articles 1-11) OB-OPS.2 Performance Standards UK-TSA-NET-01 Security Architecture CPSC-CS.2 Authentication and Access Controls USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VPSHR-3 Implementation Guidance and Reporting WCAGREC-3 Principle 3: Understandable SO2.2 Digital health architecture blueprint Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 487 it maps to, and the evidence behind each claim, over MCP and REST.