Runs an essential service, in the Marshall Islands

Cybersecurity Act 2025, 40 MIRC Ch. 4 § 407 (P.L. 2025-0027) · Read the law's page

• Binds the same designated owner of critical information infrastructure as the risk-management duty above (sections 405 and 406).
• Immediately notify the Director and the CSIRT-MH (the Cyber Security Incident Response Team of the Marshall Islands) of a significant cybersecurity incident affecting your critical information infrastructure, of a significant incident on any interconnected computer system under your control, or of any other incident type the Director specifies by written order.
• Submit an early warning within twenty-four hours of becoming aware of the incident, a fuller notification with an initial severity and impact assessment within seventy-two hours, and a final report within thirty days of that notification, or, for an ongoing incident, a progress report within thirty days of that notification followed by a final report within thirty days of the handling of the incident.
• Establish mechanisms and processes to promptly detect a cybersecurity threat, vulnerability, or incident affecting your critical information infrastructure.

Cybersecurity Act 2025, 40 MIRC Ch. 4 §§ 405-406 (P.L. 2025-0027) · Read the law's page

• Implement technical, operational, and organizational measures to manage the cybersecurity risks that may affect your designated critical information infrastructure, and measures to prevent and mitigate the impact of a cybersecurity incident or threat.
• At minimum: conduct rolling cybersecurity risk assessments at a frequency the Chief Information Security Officer prescribes; develop and implement internal cybersecurity policies and procedures, an internal incident-reporting policy, and an internal cybersecurity awareness program; and transmit the resulting mitigation actions to the Director within thirty days of completing each risk assessment.
• Submit to a Director-ordered audit of your critical information infrastructure, at your own cost and no more than once every two years, where the Director has reason to believe you have not complied with the Act or with a technical standard applicable to you, or that information you supplied is false, misleading, or incomplete.
• This binds the 'owner' of a computer or computer system the Director of the Office of National Security has designated critical information infrastructure under section 405: a natural person, public body, or commercial or non-commercial organization the Director determines operates a service essential for the Republic's national security, economy, foreign relations, public health, public safety, public order, or the continuous provision of basic public services, or, where the critical information infrastructure is government owned, the Secretary of the Ministry that operates it. Designation is case by case, made after consultation, and appealable to the Cabinet; a de minimis owner (one supplying less than ten percent of the market for the essential service) or a low-revenue owner may instead be given a phased compliance plan.