NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
Retail Cyber Governance

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) NRFCS-1: Retail Cybersecurity Governance, Policy, and Regulatory Change Management

Establish cybersecurity governance and policy structures appropriate to retail industry characteristics per the NRF Cybersecurity and Data Privacy Framework guidance and supporting NIST CSF alignment. Governance must (a) name accountable executives (CISO + Chief Privacy Officer + Chief Risk Officer + Chief Operating Officer + Chief Marketing Officer + Chief Digital Officer where applicable) with documented decision authority, (b) maintain cyber and privacy policies covering acceptable use + access control + data classification + incident response + breach notification + third-party risk + PCI DSS scope + e-commerce + mobile + in-store technology + supply chain + retail-specific peak-season operations + fraud prevention, (c) align to NIST Cybersecurity Framework 2.0 functions (Govern + Identify + Protect + Detect + Respond + Recover) with retail-specific implementation tier targets, (d) regulatory change management covering PCI DSS + state breach notification laws (50 states + territories + jurisdictions) + state and federal privacy laws (CCPA + CPRA + VCDPA + CTDPA + UCPA + TIPA + similar) + sectoral obligations (CAN-SPAM + TCPA + COPPA + FCRA + FACTA + Sarbanes-Oxley for public retailers + SEC cyber disclosure + FTC Act 5(a) unfair/deceptive + DOJ + Treasury sanctions where applicable + international (GDPR + UK GDPR + LGPD + PIPEDA + Australian Privacy Act + Japan APPI + similar)). Review the programme annually + after material change to retail operations (new store formats + e-commerce launches + acquisitions + brand extensions + payment innovations).

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 201 controls across 81 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 6 controls

  • CH-FADP-19 Transparency and proactive information
  • CH-FADP-21 Data protection impact assessments
  • CH-FADP-25 Compliance monitoring and auditing
  • FADP-16 FDPIC Independence and Functions
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)
  • FADP-9 Data Protection Advisor (Articles 14-15)

IEC 62304:2015 Medical Device Software Lifecycle Processes · 5 controls

  • IEC62304-4.1 Quality Management System
  • IEC62304-5.1 Software Development Planning
  • IEC62304-7.4 Risk Management of Software Changes
  • IEC62304-8.2 Change Control
  • IEC62304-9.4 Use Change Control Process

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.4 Privacy risk treatment
  • 27557-6.6 Recording and reporting
  • 27557-7.3 Risk-based privacy program implementation

NIST SP 800-190 · 5 controls

ISO/IEC 23894:2023 · 4 controls

  • ISO23894-5.1 Leadership and Commitment
  • ISO23894-5.2 AI Risk Management Integration
  • ISO23894-5.5 Framework Evaluation
  • ISO23894-A.5 Privacy and Data Protection in AI

NIST Privacy Framework · 4 controls

  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-53 Rev 5 · 4 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

Bahrain PDPL · 3 controls

EASA Part-IS - Information Security in Aviation · 3 controls

  • IS.D.OR.210 Information Security Risk Treatment
  • IS.I.OR.210 Information Security Risk Treatment
  • IS.I.OR.220 Information Security Risk Management

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
  • UAE-PDPL-Status UAE PDPL status, executive regulations, UAE Data Office guidance evolution

GDPR · 3 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

  • 60601-1.4.1 General requirements
  • 60601-1.4.2 Risk management process
  • 60601-1.5.1 General requirements for testing

ISO 27799:2025 · 3 controls

  • ISO27799-03 Minimum necessary standard enforcement
  • ISO27799-04 Patient data de-identification procedures
  • ISO27799-05 Audit trail for ePHI access

ISO/IEC 27011:2024 · 3 controls

  • 27011-5.2 Information Security Roles in Telecoms
  • 27011-6.3 Awareness and Training
  • 27011-8.6 Data protection and backup

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

Privacy Act 1988 (Australia) · 3 controls

  • AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children
  • AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

  • IM8-DAT.2 Data Protection
  • IM8-DAT.4 Data Retention and Disposal
  • IM8-TPM.4 Supply Chain Risk Management

API 1164 · 2 controls

  • API1164-21 TSA Pipeline Security Directive Alignment
  • API1164-23 Change management procedures

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

Annex 11 to EU GMP - Computerised Systems · 2 controls

Azerbaijan Law on Personal Data (2010) · 2 controls

  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

  • BS65000-RM-01 Resilience Journey
  • BS65000-RM-02 Integrated Approach

Barbados Data Protection Act 2019 · 2 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-4 Section 4 - Principles Relating to Processing

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

  • CAT-D1-2 Risk management
  • CAT-ML-2 Evolving

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

ICH Q10 - Pharmaceutical Quality System · 2 controls

IEC 62443 · 2 controls

  • IEC62443-21 Supply chain risk management for critical components
  • IEC62443-23 Change management procedures

ISO/IEC 27003:2017 · 2 controls

  • ISO27003-6.1 Actions to address risks and opportunities
  • ISO27003-8.3 Information security risk treatment

ISO/IEC 27019:2024 · 2 controls

  • ISO27019-21 Supply chain risk management for critical components
  • ISO27019-23 Change management procedures

ISO/IEC 27400:2022 · 2 controls

  • 27400-7.1 Network Security for IoT
  • 27400-7.4 Data retention and deletion

NIST SP 1800-32 · 2 controls

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-4 Sensitive Data Processing Consent and Childrens Protections

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 2 controls

  • OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols
  • OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

OECD AI Principles · 2 controls

  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation
  • OECDAI-8 AI Incident Reporting, Regulatory Compliance, Public Reporting, and International Cooperation

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-6 Cross-Border Transfer and Data Localization
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO

Personal Data Act (personopplysningsloven) · 2 controls

  • NORWAY-4 DPIA, Privacy by Design, Records of Processing
  • NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training

Privacy Act 2020 · 2 controls

  • NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design
  • NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training

South Korea PIPA · 2 controls

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
  • PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP)

Vermont Data Privacy and Online Surveillance Act · 2 controls

  • VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency
  • VERMONTAICDA-4 Vermont AG Enforcement and Cure

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-82 Part A Compliance

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-8.1 Operational Planning and Control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-3.4 Encryption and Data Protection

Aged Care Quality Standards 2019 (repealed edition) · 1 control

  • ACQS-8-4 Risk Management

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-14 Direct Marketing

BSI IT-Grundschutz · 1 control

  • BSI-24 Configuration change control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

FedRAMP High · 1 control

  • AC-2 Account Management

FedRAMP Moderate · 1 control

  • AC-2 Account Management

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

  • ISO-15189-5.6 Risk management

ISO 20400:2017 - Sustainable Procurement · 1 control

  • ISO-20400-4.5 Key considerations for sustainable procurement

ISO 22320:2018 · 1 control

  • ISO-22320-4.3 Risk-based approach

ISO 26000:2010 · 1 control

  • ISO-26000-6.7 Consumer issues

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

  • ISO-26262-8-8 Change management

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-SA-04 Security Risk Treatment Planning

ISO 30401 · 1 control

  • ISO30401-18 Innovation and change management

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-06 Change management processes

ITIL 4 · 1 control

  • ITIL4-06 Change management processes

Kuwait National Cybersecurity Framework · 1 control

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-1 NZISM Governance, Documentation, and Classification System

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

  • DSOMM-6 Metrics, Maturity Measurement, and Continuous Improvement

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDSREG-5 Cross-Border Health Data Flows

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-4 Special Categories, Biometric Data

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

South Korea ISMS-P · 1 control

  • ISMSP-MS-02 Risk Management

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

Turkey KVKK · 1 control

  • TURKEYKVKK-3 Special Categories and Sensitive Data

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-CS.3 Data Protection for Safety Systems

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 1 control

  • HE-3 FSA compliance requirements

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-4 Incident Reporting and Cooperation

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 201 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NRF Cybersecurity and Data Privacy Framework (National Retail Federation) controls