Duty LXD-7447
Is a bank, in Laos
Law on Cyber Security, risk assessment, access control, encryption and network securitysince 4 lines
Law on Cyber Security (2025), arts. 25 to 28, risk assessment and security measures · Read the law's page
- As a legal person or organization operating in cyber security work in Laos, carry out a cyber security risk assessment covering your systems, data and important digital assets, and use the results to improve your security plan.
- Apply effective access control to your systems, granting users the least privilege.
- Encrypt important and sensitive data, both stored and in transit, with strong encryption.
- Secure your network with a firewall and an intrusion detection and prevention system.
Law on Cyber Security, critical information infrastructuresince 4 lines
Law on Cyber Security (2025), arts. 3(2) and 15 to 21, critical information infrastructure · Read the law's page
- As an entity that owns, operates or administers a system important to the nation in a sector the Law lists, once the Government includes you on its approved list, have physical protection and access control for the system.
- Make your suppliers and external service providers pass a baseline check and be certified by the technology and communications sector.
- Report an emergency immediately to the unit responsible for cyber security.
- Keep a backup system ready for use if the main system fails.
Law on Cyber Security, incident response, incident reporting and annual reportsince 5 lines
Law on Cyber Security (2025), arts. 30, 31, 40, 43 and 44, incident response and reporting · Read the law's page
- As a legal person or organization operating in cyber security work in Laos, report a cyber security incident that causes damage to the unit responsible for cyber security immediately after discovering it.
- Develop and carry out a cyber emergency response plan.
- Use an effective system for detecting and analyzing cyber incidents.
- Submit an annual report on your cyber security situation and work, including the measures carried out and the incidents or threats that occurred and how they were resolved, to the Ministry of Technology and Communications.
- Cooperate with the investigating bodies, providing data, evidence and the system access they need, where a cyber security breach is a criminal offense.