INTRA/GV/GV002Declared perimeter
The single account of what the program does, what it does not do, and on what authority, written to be shown outside it.
| Control | Jurisdiction | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|---|
| GV002/HUMandatory | Hungary | 2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026 | That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years. | For organizations in scope, each electronic information system is classified into the “alap”, “jelentős”, or “magas” security class on the risk to its integrity and availability and to the confidentiality, integrity, and availability of its data, and the measures the decree assigns to that class are implemented; the classification is reviewed at least every two years. |
| GV002/GBMandatory | United Kingdom | Data Protection Act 2018, section 10 and Schedule 1Parliament of the United Kingdom · read 30 Aug 2026 | The condition on which an employer may process a closed category at all, and the document that condition requires to exist before the processing starts. | Where an employer processes a closed category under the employment condition, an appropriate policy document has to be in place when the processing is carried out, and it has to have been produced: a document explaining the procedures for securing compliance with the principles for that processing, and the policies on retention and erasure with an indication of how long the data are likely to be kept. It is a condition of the processing being lawful and not a record made afterwards. |