Runs an essential service, in Belarus

Decree 40 On Cybersecurity, paras. 3.1 to 3.15 and Annex 1 (Указ Президента Республики Беларусь от 14 февраля 2023 г. № 40 «О кибербезопасности») · Read the law's page

• This binds the state bodies and other organizations that the Council of Ministers lists under subparagraph 3.4, the owners of the 27 critically important informatization objects named in Annex 1 (among them banks, insurers, electricity utilities, a nuclear power plant, telecommunications operators and a payment processing center), and the authorized internet service providers that host official websites and e-mail (subparagraph 3.5). You reach it by declaring that you operate an essential service.
• Create a cybersecurity center, or buy cybersecurity services from an organization that has created one, within the period the Council of Ministers' list sets, if you are a state body or other organization on that list (subparagraph 3.4).
• If you own a critically important informatization object named in Annex 1, or you are an authorized internet service provider hosting official websites and e-mail, make sure a cybersecurity center is created within one year of paragraph 3.5 taking effect (subparagraph 3.5).
• Have your cybersecurity center attested by the Operational and Analytical Center before it starts work and at least once every three years afterwards (subparagraph 3.7).
• Send the Operational and Analytical Center a copy of each cybersecurity services contract within five working days of concluding it (subparagraph 3.10).
• Keep information on cyber incidents at your information infrastructure objects for at least one year (subparagraph 3.12).
• Name one of your deputy heads as responsible for organizing your cybersecurity work; the head of the state body or organization is personally responsible for its cybersecurity (subparagraphs 3.14 and 3.15).
• Give the National Cybersecurity Center unhindered access to the premises and sites where your information infrastructure objects operate, and to the hardware and software that run them, including remotely (subparagraph 3.3).
• Carry out the Operational and Analytical Center's orders to remedy violations of the Decree and of the cybersecurity requirements for your information infrastructure objects (subparagraph 3.1).

Decree 40 On Cybersecurity, paras. 3.3 and 3.8 (Указ Президента Республики Беларусь от 14 февраля 2023 г. № 40 «О кибербезопасности») · Read the law's page

• This binds the state bodies and other organizations that the Council of Ministers lists under subparagraph 3.4, the owners of the 27 critically important informatization objects named in Annex 1 (among them banks, insurers, electricity utilities, a nuclear power plant, telecommunications operators and a payment processing center), and the authorized internet service providers that host official websites and e-mail (subparagraph 3.5). You reach it by declaring that you operate an essential service.
• Have your cybersecurity center inform the National Cybersecurity Center of each cyber incident it identifies no later than one hour after identifying it (subparagraph 3.8).
• Have your cybersecurity center provide the National Cybersecurity Center with other information, including the results of response and clean-up after a cyber incident, in the order, scope and time limits the Operational and Analytical Center sets (subparagraph 3.8).
• Provide the National Cybersecurity Center with the documents and other information, including technical information, that it demands about your information infrastructure objects, no later than the day after the demand (subparagraph 3.3).

Law of the Republic of Belarus No. 455-Z of 10 November 2008 On Information, Informatization and Protection of Information (as amended by Law No. 209-Z of 10 October 2022), art. 40 · Read the law's page

• This binds you if you operate an information system or provide information services through one, reaching Belarus or established there, whatever your sector or size: Law No. 455-Z defines an information system operator broadly and lists a private legal entity or an individual entrepreneur among the subjects of information relations it reaches.
• Ensure the integrity and safety of the information your system holds.
• Take measures to prevent disclosure, loss, distortion, destruction, or unauthorized modification of that information, and to prevent blocking of legitimate access to it.
• Where necessary, take measures to restore information that has been lost.
• This duty runs independently of Belarus's comprehensive personal-data statute, Law No. 99-Z, which carries its own security and breach-notice duties recorded separately under the privacy topic; article 40 reaches whatever information your system holds, not only personal data.