Maps cybersecurity and digital operational resilience obligations to Nexus clauses and evidence: NIS2 (Directive (EU) 2022/2555), DORA (Regulation (EU) 2022/2554), the Cyber Resilience Act (Regulation (EU) 2024/2847), NIST CSF 2.0 and SP 800-207 zero trust, with ISO/IEC 27001 named only, so that incident reporting, ICT third-party risk, vulnerability handling and software bill of materials duties are expressed as checkable clauses. A section of the Digital, Cyber and AI subsite. Every artifact of the area carries a UNI (Unique Nexus Identifier), which identifies and never certifies.
Nexus Standards (2026). Cyber and digital resilience law alignment: area brief, Digital, Cyber and AI (PROPOSED). https://nexustandards.com/digital-ai/cyber-and-digital-resilience-law-alignment/. Last reviewed 2026-10-17.
Files carry the credits and the licence line; they are generated in your browser and nothing is sent. Downloads need script.
The frameworks and mandates alignment section of Digital, Cyber and AI. Scope as the area context entry states it (PROPOSED).
In scope 4
Out of scope 3
Jurisdictions No jurisdiction note is recorded for this area yet; jurisdiction narrows what applies and never implies that a Nexus profile satisfies a law.
Indicator names and codes as their stewards publish them; values appear only from a governed GRIx source, never typed into a page.
Relations are register entries (NS-14), never conformance or equivalence statements; hover or focus a relation for its meaning. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here.
The Nexus Standards the area context entry lists. Every one is proposed or specified; none is adopted by an authority.
Status proposed · 7 rules stated. Read NS-10
Status proposed · 6 rules stated. Read NS-11
Status proposed · 5 rules stated. Read NS-9
Each coupling names the mechanism that links this area to another; select a card on the canvas to trace it. Mechanisms are stated in the context bank (PROPOSED).
Fig.RUNNING marks the area you are reading; DONE an area in the same subsite, QUEUED an area elsewhere and GATE a subsite reached. Tags give reading order only, never a status. Design, not a record.
Sources the area reads or proposes. Delivery follows GRIx first; a source is shown live only after an owner decision admits it for public pages.
No legal register row admits any of these sources for live display on public pages yet, so nothing is read from them here. A register row that exists records the source for the governed GRIx path; admission for public pages is a separate owner decision.
CISA Known Exploited Vulnerabilities cataloguepending admission
Cybersecurity and Infrastructure Security Agency · on update
U.S. Government work (public domain in the United States)
GRIx governed readproposed register row
EUR-Lex Cellar (EU legal acts and delegated acts)pending admission
Publications Office of the European Union · daily
Commission Decision 2011/833/EU reuse policy (free reuse with acknowledgement)
build-time snapshotproposed register row
NIST National Vulnerability Database APIspending admission
NIST · continuous
U.S. Government work (public domain in the United States)
GRIx governed readproposed register row
GCRI Canada decides under its own evidence rules whether cyber resilience attestations are usable; a crosswalk row is not acceptance.
The Global Risks Forum (GRF) decides under its own rules whether digital resilience work features in its programmes; alignment implies no recognition.
The Global Risks Alliance (GRA) decides capital readiness under its own criteria; clause evidence only shows reviewers which resilience duties are evidenced.
Each institution decides under its own rules what it reads as evidence; no pathway is an approval, a readiness statement or investment advice.
Closed or paywalled standards appear by name and link only; any compatibility profile of one is built on simulated data and kept on protected pages until an institutional arrangement with the issuing body is recorded. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Test suites, conformance statements and attestations per standard; no attestation is recorded yet, and none would certify.
Pending admissionVersion and feed state per standard; every row reads source feed pending admission until a register row admits a feed.
A console computes from the registry and shows its reasons; it never decides, approves or certifies.
Maintain the cyber law crosswalk and clause library, tracking implementing acts, regulatory technical standards and guidance.
No working group is chartered yet; a community may charter this one under NS-13 through a docket.
Hazards and threats 3
Sectors 0
No sector is listed for this area; it serves every sector through the areas it couples with.
Peer-reviewed sources and published statistics on the publishers' own domains, as the context entry cites them. No Risk Academy faculty pathway is linked to this area yet; one is linked when a faculty publishes a pathway that fits.
Risk Academy disciplines that teach Cyber and digital resilience law alignment, with their courses; the GCRI Canada, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA) subsites that carry those disciplines; and the Nexus Foundry systems the standards name. Mappings are proposed for review (Risk Academy standards map, 2026-10-17); a link says a page on the same subject exists, never an endorsement or a conformance statement; framework names in course titles are named and linked, never reproduced.
Propose a change, join the working group or name a source. Area entries are PROPOSED content for the Nexus Standards registry; a UNI identifies and never certifies, and nothing on this site is a certification, an approval or a readiness statement.
Nexus Standards documents CC BY 4.0 · tooling Apache-2.0 · counsel review pending (DEC-2026-10-16-NEXUS-STANDARDS-OPEN-LICENCE). External standards are named and linked under their own licences; a UNI (Unique Nexus Identifier) identifies, it never certifies. · Generated from the Nexus Standards corpus at commit 437ae044c5cb (2026-10-17); proposed and open.