Runs an essential service, in Hungary

2024. évi LXIX. törvény (Magyarország kiberbiztonságáról), 6. § · Read the law's page

• This duty reaches your service where you are an essential or important organization under Section 1: an organization under the sector annexes that qualifies as a medium-sized enterprise or larger under Hungary's SME Act, or exceeds the thresholds the Act sets for one, or a provider of an online marketplace, online search engine or social-media service platform whose main place of business activity is in Hungary, whether or not you are established there.
• Establish and operate a risk-management framework for the electronic information systems in your organization's possession, following a directly applicable EU legal act or, absent one, the decree of the minister responsible for informatics.
• Survey and register every electronic information system, central service and supporting system you use, appoint or designate the person responsible for the security of those systems, classify them into a security category, and apply protective measures proportionate to their risk.
• Issue an information-security policy for your users and the requirements it sets, and review it at least every two years.
• Report a cyber threat, near-incident or cybersecurity incident affecting your electronic information system to the competent cybersecurity incident-handling centre without delay, on the notification clock this jurisdiction's companion incident-notification row sets out.

2024. évi LXIX. törvény, 66. §; 418/2024. (XII. 23.) Korm. rendelet, 42. § és 77. § · Read the law's page

• This duty reaches your service on the same basis as this jurisdiction's companion risk-management row: an essential or important organization under Section 1, including a provider of an online marketplace, online search engine or social-media service platform whose main place of business activity is in Hungary, whether or not you are established there.
• Notify the national cybersecurity incident-handling center (Nemzeti Kiberbiztonsági Intézet, the NKI) of a cyber threat, near-incident or cybersecurity incident affecting your electronic information system: an initial notification without undue delay and in any case within 24 hours of becoming aware, an event notification without undue delay and in any case within 72 hours of becoming aware that updates that report and assesses the incident's severity and impact, and a final report no later than one month after the event notification.
• If you are a trust service provider, notify the center of a cybersecurity incident affecting your trust services without undue delay and in any case within 24 hours of becoming aware of it, in place of the event notification (Decree 418/2024, Section 77(4)).
• Submit an interim status report if the center asks for one, and, if the incident is still ongoing when the final report is due, a report on the results achieved so far followed by a final report within one month after you have finished handling the incident (Decree 418/2024, Section 77(1)).