Operates a social platform, in Liechtenstein

Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 1, 3, 4, 5 · Read the law's page

• Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a security incident on the recipients of your services and on other services.
• Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and disaster recovery, and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluating your measures' effectiveness; basic cyber-hygiene procedures and training; cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, plus secured voice, video and text communication.
• Have your leadership body (Leitungsorgan) approve and oversee these measures and attend, and offer your staff, regular training on recognising and assessing cybersecurity risk and risk-management practice.
• This binds an essential or important entity under Article 1 and Annexes 1 and 2, which name an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider (Annex 2 Item 6) among the digital-service providers it reaches expressly, generally at the medium-or-large-company threshold of Article 1064(2) or (3) of the Personen- und Gesellschaftsrecht (Persons and Companies Act); the wider sector classes Annexes 1 and 2 also reach (critical-infrastructure operators across energy, transport, banking, health and public administration, and the digital infrastructure sector's own DNS, top-level-domain, cloud-computing, data-centre and content-delivery-network providers, which Article 3 binds regardless of size) are reached too, by declaring that you are an essential or important entity.

Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 6 · Read the law's page

• Notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating, where relevant, whether the incident is suspected to result from unlawful or malicious acts or to have cross-border effect.
• Follow with a full notification within 72 hours of becoming aware, updating the early warning where relevant and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on the Stabsstelle Cyber-Sicherheit's request, and a final report within one month of the 72-hour notification, describing the incident's severity and impact in detail, the likely threat or root cause, and the mitigation measures taken.
• If the incident is still ongoing when the final report falls due, submit a progress report at that point and a final report within one month of the incident being dealt with (Article 6(2)(e)).
• This binds an essential or important entity under Article 1 and Annexes 1 and 2, which name an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider (Annex 2 Item 6) among the digital-service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

MedienG, LGBl. 2005 Nr. 250, Art. 82c, inserted by LGBl. 2023 Nr. 448 · Read the law's page

• Applies to video-sharing-platform providers, meaning a person who operates a video-sharing platform service.
• Take appropriate measures to protect minors from broadcasts, user-generated videos and audiovisual commercial communication that could impair their physical, mental or moral development.
• Take appropriate measures to protect the general public from content whose dissemination is itself a criminal offence, including incitement to a terrorist act and child-pornography offences under the criminal code (Strafgesetzbuch).