Runs an essential service, in Bhutan

Bhutan InfoComm and Media Authority Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under section 58 of the Information, Communications and Media Act of Bhutan 2018), clauses 11.7 and 12.1 · Read the law's page

• This binds a licensed telecom service provider and any other licensed ICT service provider that has critical information infrastructure in Bhutan (reached by declaring that you provide telecom services or operate an essential service).
• Establish and implement mechanisms and processes to share information on cybersecurity threats and vulnerabilities, and on measures that can be taken in response to them, with the relevant Authorities for threat monitoring and analysis (clause 11.7(b)).
• Make sure your Cybersecurity Incident Response Plan includes an incident reporting structure that guides you on compliance with your reporting obligations under the Information, Communications and Media Act of Bhutan 2018 and any other laws and regulations (clause 12.1(c)(i)).

Bhutan InfoComm and Media Authority Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under section 58 of the Information, Communications and Media Act of Bhutan 2018), clauses 3 and 11 to 12 · Read the law's page

• This binds a licensed telecom service provider and any other licensed ICT service provider that has critical information infrastructure in Bhutan (reached by declaring that you provide telecom services or operate an essential service).
• Conduct internal audits of your information and network security management system at planned intervals, and where an audit finds non-compliance with the Act or a code of practice issued under it, submit an audit finding remediation plan to the Authority within 30 working days of receiving the audit report unless the Authority indicates otherwise in writing (clauses 11.3 and 11.4).
• Conduct a vulnerability assessment at least once every 12 months, and again after any major system change (clause 11.5).
• Conduct a penetration test on your ICT facilities at least once every 12 months, and again after any major system change (clause 11.6).
• Establish a Cybersecurity Incident Response Plan and an organizational incident response team, Computer Incident Response Team or Security Operation Center to continuously monitor and mitigate security risk, threats and vulnerabilities (clause 12.1).
• Conduct scenario-based cybersecurity exercises at least once every 12 months (clause 12.2).