Runs an essential service, in Azerbaijan

Law of the Republic of Azerbaijan No. 460-IQ "On Information, Informatization and Protection of Information", Chapter V-1, arts. 20-1 to 20-6 (inserted by Law No. 539-VIQD of 27 May 2022) · Read the law's page

• This binds a critical information infrastructure subject: the owner or user of a critical information infrastructure object, whether a state body, a state-owned legal person, a public legal person created on the state's behalf, or another legal person or individual entrepreneur other than a micro, small or medium-sized enterprise (reached by declaring that you operate an essential service). A system is a critical information infrastructure object where its failure could harm the state's independence and defense, state bodies and the population's essential supplies, economic and financial stability, or the ecological balance (article 20-2.1).
• Organize and operate an information security management system for your critical information infrastructure that detects, prevents and remedies cyber threats, cyber attacks and cyber incidents, including attempts to commit them (article 20-3.1).
• Define the composition and operating procedure of that management system on the basis of the general critical information infrastructure security requirements, and enter it in the register of critical information infrastructure objects; the authorized body may require you to show that it complies with those requirements (article 20-3.2).
• Appoint a person responsible for critical information infrastructure security, and enter that information in the register of critical information infrastructure objects (article 20-3.3).
• Meet the general security requirements the state sets and the special requirements you set for your own infrastructure, and answer the authorized body's inquiries about compliance without delay (articles 20-4.1, 20-4.2 and 20-4.4).
• Remedy, without delay and on the authorized body's demand, the breaches of the security requirements it finds, and report the result of the measures taken (article 20-6.7).
• Have a cybersecurity service provider carry out an external audit at least once a year, and see that its results are sent to the body the relevant executive authority designates (article 20-6.8).

Law of the Republic of Azerbaijan No. 460-IQ "On Information, Informatization and Protection of Information", art. 20-3.4 (inserted by Law No. 539-VIQD of 27 May 2022) · Read the law's page

• This binds a critical information infrastructure subject: the owner or user of a critical information infrastructure object, whether a state body, a state-owned legal person, a public legal person created on the state's behalf, or another legal person or individual entrepreneur other than a micro, small or medium-sized enterprise (reached by declaring that you operate an essential service).
• Send information on cyber threats, cyber attacks and cyber incidents against your critical information infrastructure, and on attempts to commit them, to the authorized body in the manner the critical information infrastructure security requirements set (article 20-3.4).
• Create the conditions for, and give support to, the authorized body's response to cyber attacks on your critical information infrastructure objects and its work to prevent cyber threats and incidents (article 20-4.5).

Law of the Republic of Azerbaijan on Amendments to the Code of Administrative Offences of 14 July 2026, new art. 371-2.1.1, 371-2.1.3 to 371-2.1.5 · Read the law's page

• This binds, from 1 July 2027, the subjects of information infrastructure, including owners of internet information resources, internet providers and hosting providers (reached by declaring that you provide telecom services or operate an essential service), and computer incident response centers and security operations centers; it does not reach critical information infrastructure, state bodies including the Central Bank, intelligence and counterintelligence subjects, or entities supervised in the financial markets (note to article 371-2).
• Carry out the authorized body's instructions on securing your information infrastructure (preventing cyber threats, cyber attacks and cyber incidents and remedying their results) and on digital investigation, including supplying the result of the investigation (article 371-2.1.1).
• Answer the authorized body's inquiries on the state of your information infrastructure's cybersecurity within 24 hours, and its digital investigation inquiries within 5 working days (article 371-2.1.3).
• Carry out continuous real-time monitoring of cyber incidents and cyber attacks and the initial technical response to them (article 371-2.1.4).
• Meet the general and special cybersecurity requirements for information infrastructure that performs socially significant functions (article 371-2.1.5).

Law of the Republic of Azerbaijan on Amendments to the Code of Administrative Offences of 14 July 2026, new art. 371-2.1.2 · Read the law's page

• This binds, from 1 July 2027, the subjects of information infrastructure, including owners of internet information resources, internet providers and hosting providers (reached by declaring that you provide telecom services or operate an essential service), and computer incident response centers and security operations centers; it does not reach critical information infrastructure, state bodies including the Central Bank, intelligence and counterintelligence subjects, or entities supervised in the financial markets (note to article 371-2).
• Submit immediately to the authorized body the information on cyber threats, cyber attacks and cyber incidents directed at your information infrastructure, together with the information obtained from your real-time monitoring and initial technical response (article 371-2.1.2).