Frameworks / Nebraska Data Privacy Act / NDPA-6 Nebraska Data Privacy Act
Security and Incident Response
Nebraska Data Privacy Act NDPA-6: Reasonable Security Practices and Incident Response Establish + implement + maintain reasonable administrative + technical + physical data security practices to protect the confidentiality + integrity + accessibility of personal data appropriate to the volume + nature of the personal data. Align with NIST Cybersecurity Framework or equivalent risk-based programme. Maintain an incident response plan covering detection + containment + eradication + recovery + post-incident review. Comply with Nebraska data breach notification law (Neb. Rev. Stat. 87-801 to 87-807) requiring notification to Nebraska AG and affected residents without unreasonable delay (no fixed deadline but typically within 30-60 days).
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 118 controls across 49 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-3 Sensitive Personal Data, Children, and Special Categories NG-NDPA-4 Data Subject Rights and Automated Decision-Making NG-NDPA-5 Security of Processing, Breach Notification, and DPIA NG-NDPA-7 Cross-Border Data Transfers and International Cooperation NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance FFIEC-08 Application security controls FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface APPI-A31 Provision of Personally Referable Information APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.25_26_27_28_29 UAE Data Office establishment, powers, penalties, complaints (UAE PDPL Articles 25-29) IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) 27400-6.3 Secure Update Mechanism 27400-6.5 Security monitoring and incident response 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response IM8-DSS.3 Secure Development Practices IM8-RES.3 Incident Response PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 D.1 Incident Response Planning D.2 Incident Reporting CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation CPS230-13 Board Accountability for Operational Risk Management 4.4.7 Emergency and Incident Response BB-DPA-20 Sections 50-60 - Registration and Responsibilities CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue CAT-D5-1 Incident planning and strategy ISO28001-PC-04 Supply Chain Continuity Planning ISO20000-11 Incident management 27010-16.1 Continuity of Sharing ITIL4-11 Incident management NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures PAKPDPB-5 Security of Processing and Personal Data Breach Notification PSPF24-1 Security Culture, Governance, Risk Management SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration ISMSP-SYS-05 Incident Response TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 118 it maps to, and the evidence behind each claim, over MCP and REST.