Provides telecom services, in Moldova

Law 48/2023 on Cybersecurity, art. 12 (Legea nr. 48 din 16 martie 2023 privind securitatea cibernetică) · Read the law's page

• This binds a private-law legal person that is a medium-sized enterprise or larger, provides services in a critical sector or subsector the Government sets, and is identified as a service provider by the competent authority; it also binds, whatever its size, a legal person of a type the Government sets that is a public electronic-communications network or service provider, a trust-service provider, the registrar of the .md top-level domain, a domain-name registration service, the sole national provider of an essential service, a provider of a service that depends on a network or information system and whose disruption could significantly affect public order, public safety or public health or create a significant systemic risk, a legal person that is critical at national or regional level for its sector or for interdependent sectors, an identified operator of critical infrastructure whose service depends on a network or information system, and a public-law legal person (Article 3(1) and (2)). The duties fall on a service provider, which Article 2 defines as a public-law or private-law legal person registered in the Republic of Moldova that provides services in a critical sector or subsector the Government sets and is identified by the competent authority. You reach it by declaring that you operate an essential service or provide telecom services.
• Notify the competent authority without undue delay, and no later than 24 hours after you become aware, of any cyber incident with a significant impact on the security of your network or system or on the continuity of your service, and of one whose significant impact is not evident but can reasonably be presumed (Article 12(1)(a) and (b)).
• An incident has a significant impact if at least one of these holds: its consequences are rated at least high in your security-risk assessment report; the service cannot continue after the maximum period your service-level agreement or your continuity requirements allow; it disrupts the service of another provider; or it has caused, or could cause, considerable material or non-material harm to you, another provider or users of the services (Article 12(5)).
• Notify the competent authority within the same 24 hours of the significant impact on your own service of a cyber incident that affected a third party your service depends on (Article 12(1)(c)).
• Submit to the competent authority, no later than 72 hours after you become aware of the incident, an update of the information already sent and an initial assessment of the incident, including its severity, its impact and indicators of compromise where available (Article 12(3)).
• Inform the users of your services who may be affected by a significant cyber threat, without undue delay and no later than 24 hours after you become aware of it, of the measures, including corrective ones, they can take, and inform the general public if you cannot identify and notify them individually; where the threat is imminent, tell them about the threat itself. If you miss that deadline, the competent authority asks you expressly to give the notice, and if you have not done so within 3 hours of that request it notifies the users who may be affected, or the general public, itself and informs you (Article 12(6) and (7)).
• Send the competent authority a final report within one month after the updated information, covering at least the causes of the incident, how long it took to resolve, the measures applied and its impact (Article 12(8)).
• If a third party administers or hosts your network or system, make sure that it informs you within these time limits or informs the competent authority at the same time (Article 12(4)).
• A public-law legal person notifies the government cyber incident response center of the incident, which informs the competent authority (Article 12(11)).
• If you sign, or withdraw from, a cybersecurity information-sharing agreement of the kind the competent authority facilitates between providers, tell the competent authority within 3 days of the signing or withdrawal (Article 17(4)).

Law 48/2023 on Cybersecurity, arts. 3, 11, 14 and 19 (Legea nr. 48 din 16 martie 2023 privind securitatea cibernetică) · Read the law's page

• This binds a private-law legal person that is a medium-sized enterprise or larger, provides services in a critical sector or subsector the Government sets, and is identified as a service provider by the competent authority; it also binds, whatever its size, a legal person of a type the Government sets that is a public electronic-communications network or service provider, a trust-service provider, the registrar of the .md top-level domain, a domain-name registration service, the sole national provider of an essential service, a provider of a service that depends on a network or information system and whose disruption could significantly affect public order, public safety or public health or create a significant systemic risk, a legal person that is critical at national or regional level for its sector or for interdependent sectors, an identified operator of critical infrastructure whose service depends on a network or information system, and a public-law legal person (Article 3(1) and (2)). The duties fall on a service provider, which Article 2 defines as a public-law or private-law legal person registered in the Republic of Moldova that provides services in a critical sector or subsector the Government sets and is identified by the competent authority. The Law does not apply to public authorities' activities in state secrets, national security, national defence, special investigations and criminal prosecution, in maintaining the networks and systems meant for processing information in those fields (Article 3(3)). Where a sector law carries security or incident-notification duties whose effects are at least equivalent, that law is special law in relation to this one, and this Law applies to the legal persons that sector law does not reach, a call the competent authority makes case by case when it identifies providers (Article 3(5) to (7)). You reach it by declaring that you operate an essential service or provide telecom services.
• Apply security measures continuously to prevent and resolve cyber incidents, and to prevent and limit their effect on service continuity and on the security of your networks and information systems, including the potential effect on the services, networks and information systems that depend on yours (Article 11(1)).
• Assess the vulnerabilities and security risks of your networks and information systems, determine the severity of a possible incident's impact, describe the measures to resolve an incident, and write an assessment report (Article 11(2)(1)).
• Implement technical and organizational measures proportionate to the risks and in line with the standards the Government approves, including at least policies on risk analysis and network security, incident handling, cryptography and encryption (especially end-to-end encryption), policies and procedures for assessing how effective your security measures are, measures of business continuity and crisis management, security in acquiring, developing and maintaining systems including vulnerability disclosure and handling, human-resources and access control, supply-chain security, basic cyber hygiene and training, and secure authentication and communications (Article 11(2)(2)).
• Keep your security documentation current, monitor the security of your networks and information systems, take steps to reduce the impact and spread of incidents, and verify that your security measures are complete and compliant, including through security audits whose results you document (Article 11(2)(3) to (6)).
• Stay responsible for applying these security measures when you authorize a third party to administer your network or system or use a third party to host it (Article 11(3)).
• Give the competent authority the access to information, property and premises it needs for a state control, which it carries out under Law 131/2012 on a reasoned act and with prior notice to you (Article 19(1) to (3)).