Duty LXD-7111
Runs an essential service, in Georgia
Law on Information Security, Computer Incident Notification by Critical Information System Subjectssince 4 lines
Law of Georgia on Information Security (No. 6391-Is of ), art. 10 and art. 10-8 · Read the law's page
- This binds the same critical information system subjects as the Law's security-rules row, designated by Government of Georgia resolution as Category 1, 2 or 3 or in the defence sphere (reached by declaring that you operate an essential service).
- Notify the Computer Incident Assistance Group of the Operational-Technical Agency (Category 1 and 2), the Digital Governance Agency (Category 3) or the Cyber Security Bureau (defence sphere) immediately when a computer incident is identified in your network; the Law sets no numeric clock (art. 10(2)).
- Use a network sensor to identify computer incidents, and take emergency measures where needed to preserve and protect information about the incident (art. 10(1)-(2)).
- Respond within a reasonable time to the mandatory instruction the Group issues, and report the measures taken to the Group (art. 10(3)).
Law on Information Security, Critical Information System Subjects: Security Rules and Auditsince 2 lines
Law of Georgia on Information Security (No. 6391-Is of ), arts. 3, 4 and 6 · Read the law's page
- Adopt internal information-security rules that set your information-security policy and meet the minimum requirements the competent agency sets with reference to ISO, NIST and ISACA standards, and submit them to that agency for review (art. 4).
- Carry out an initial and periodic information-security audit of your management system against the minimum standards, and act on the audit conclusion (art. 6).
- This binds a critical information system subject, meaning a state or municipal body, public-law legal entity or state enterprise (Category 1), an electronic communications company (Category 2) or a private-law legal person (Category 3, which can be a commercial bank) that the Government of Georgia has designated by resolution, and an organization connected to it that provides access to its information assets (Law on Information Security, arts. 2(z1)-(z3) and 3; reached by declaring that you operate an essential service).