Runs an essential service, in Mongolia

Law of Mongolia on Cyber Security, adopted 17 December 2021, in force 1 May 2022, Art. 17.3 · Read the law's page

• Abide by the Government's common procedure for ensuring, preventing, detecting and countering cyber-attacks once the Government adopts it under Article 7.1.
• On a cyber-attack or violation against your systems, notify the relevant center against cyber-attacks and violations, the Public center for a legal person outside the state information network and outside critical information infrastructure, and obtain assistance where necessary; the text states no numeric clock for this notice.
• Comply with the recommendations and requirements the relevant authorities issue to you in relation to ensuring cyber security.
• This binds every legal person other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this profile records in the jurisdiction summary rather than flags on a declared activity; Article 3.2 extends this duty to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks.

Law of Mongolia on Cyber Security, adopted 17 December 2021, in force 1 May 2022, Art. 19 (notification duties) · Read the law's page

• This binds an organization with critical information infrastructure, meaning an organization of a kind article 19.1 lists, such as electricity, water and heating, tier two and three health organizations, banks and financial institutions with consolidated payment, settlement and transaction systems, dominant communications and information technology operators, transport control, fuel and food, data centers and border control, whose information systems' failure could harm Mongolia's security, society and economy (reached by declaring that you operate an essential service).
• Notify the relevant center against cyber-attacks and violations immediately when the normal, uninterrupted operation of your information systems and infrastructure fails because of cyber-attacks and violations (article 19.2.14).
• Notify the relevant center and your users immediately when the normal, uninterrupted operation of your infrastructure fails because of planned inspections and audits, damage, or force majeure events and circumstances affecting networks and systems outside your own infrastructure (article 19.2.15).
• Submit each cyber security risk assessment report and information security audit report to the relevant center against cyber-attacks and violations within one month of receiving it (article 19.2.10).

Law of Mongolia on Cyber Security, adopted 17 December 2021, in force 1 May 2022, Art. 19 (security duties) · Read the law's page

• This binds an organization with critical information infrastructure, meaning an organization of a kind article 19.1 lists, such as electricity, water and heating, tier two and three health organizations, banks and financial institutions with consolidated payment, settlement and transaction systems, dominant communications and information technology operators, transport control, fuel and food, data centers and border control, whose information systems' failure could harm Mongolia's security, society and economy (reached by declaring that you operate an essential service).
• Adopt internal procedures for ensuring cyber security, introduce standards to ensure information security, and plan and implement the management, organizational and technical measures needed to secure your information systems and networks (articles 19.2.1, 19.2.3 and 19.2.7).
• Have an officer or unit on staff in charge of ensuring cyber security (article 19.2.4).
• Have a cyber security risk assessment conducted every year, and a full or partial one when your information systems or networks are modified, and take measures on its conclusions, recommendations and requirements (article 19.2.5).
• Have an information security audit conducted every two years, and submit each risk assessment and audit report to the relevant center against cyber-attacks and violations within one month of receipt (articles 19.2.6 and 19.2.10).
• Have an information system for the detection, registration and termination of cyber-attacks and violations, and store the information system action log for the period the common procedure for ensuring cyber security sets (articles 19.2.8 and 19.2.9).
• Adopt and implement an action plan for cyber-attacks and violations, and a plan that keeps your information system and infrastructure running without interruption and restores them after damage (articles 19.2.2 and 19.2.13).
• Comply with the requirements the relevant authorities issue, and take measures to eliminate the violations and errors they detect (article 19.2.11).