Clause lookup

3,045 articles, sections and controls across 12 laws and frameworks · index updated 2026-10-10

Type a clause number or a topic. You get the clause’s heading and a link to the official text. Free, no sign-in.

11 matches.

NIST SP 800-53 · IR-6
Incident Reporting
Incident Response
Official text (NIST) →
EU AI Act · Article 73
Reporting of serious incidents
Chapter IX — Post-market monitoring, information sharing and market surveillance
Official text (EUR-Lex) →
DORA · Article 17
ICT-related incident management process
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
DORA · Article 18
Classification of ICT-related incidents and cyber threats
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
DORA · Article 19
Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
DORA · Article 20
Harmonisation of reporting content and templates
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
DORA · Article 21
Centralisation of reporting of major ICT-related incidents
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
DORA · Article 22
Supervisory feedback
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
DORA · Article 23
Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
Chapter III — ICT-related incident management, classification and reporting
Official text (EUR-Lex) →
NIST SP 800-53 · IR-6(1)
Automated Reporting
Incident Response
Official text (NIST) →
NIST CSF · RS.CO
Incident Response Reporting and Communication
Respond
Official text (NIST) →

Found the clause? Compliance Colleague checks your information security policy, a procedure or a network diagram against it, and cites the clause behind every finding. PCI DSS, the EU AI Act, ISO 42001 and 30+ more. Try it free, no card required →

What’s covered

EU AI Act, Regulation (EU) 2024/1689: 126 entries, linked to EUR-Lex
GDPR, Regulation (EU) 2016/679: 99 entries, linked to EUR-Lex
NIS2, Directive (EU) 2022/2555: 49 entries, linked to EUR-Lex
DORA, Regulation (EU) 2022/2554: 64 entries, linked to EUR-Lex
EU Cyber Resilience Act, Regulation (EU) 2024/2847: 79 entries, linked to EUR-Lex
HIPAA, 45 CFR Parts 160 and 164: 102 entries, linked to eCFR
CCPA, Cal. Civil Code § 1798.100 ff. and 11 CCR § 7000 ff.: 81 entries, linked to California Privacy Protection Agency
CMMC, 32 CFR Part 170: 24 entries, linked to eCFR
NIST SP 800-53, Rev. 5 (release 5.2.0): 1,196 entries, linked to NIST
NIST CSF, Cybersecurity Framework 2.0: 40 entries, linked to NIST
EAR, 15 CFR Parts 730–774: 968 entries, linked to eCFR
ITAR, 22 CFR Parts 120–130: 217 entries, linked to eCFR

PCI DSS, ISO/IEC 27001, ISO/IEC 42001 and SOC 2 are not here: their publishers hold the copyright in the text and the headings. We link to the publisher instead.

How Compliance Colleague made this

Compliance Colleague ships with the official text of each law and framework above, taken from the publisher (EUR-Lex, the eCFR, NIST and the California Privacy Protection Agency). That text is what its answers cite.
For this page, a script reads those bundled texts and keeps only three things per entry: the number, the heading and a link to the official source. The clause text itself is left out.
Recitals and any heading that is really a cut-off sentence are dropped, and copyrighted standards are excluded. The index is rebuilt whenever a bundled text is updated; the date is at the top of the page.

A research aid, not legal advice. Headings are reproduced from the official texts; the official publication is authoritative. EU links open the act on EUR-Lex; find the article there by its number.