It does not. Other than mandating some details about cryptography and MFA, it's mostly about company processes, incident reporting, security training, risk asse

It does not. Other than mandating some details about cryptography and MFA, it's mostly about company processes, incident reporting, security training, risk assessments and such. And it only affects corporations and other entities in a few select sectors of critical importance to society.