Is a bank, in Liechtenstein

Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 1, 3, 4, 5 · Read the law's page

• Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a security incident on the recipients of your services and on other services.
• Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and disaster recovery, and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluating your measures' effectiveness; basic cyber-hygiene procedures and training; cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, plus secured voice, video and text communication.
• Have your leadership body (Leitungsorgan) approve and oversee these measures and attend, and offer your staff, regular training on recognising and assessing cybersecurity risk and risk-management practice.
• This binds an essential or important entity under Article 1 and Annexes 1 and 2, which name an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider (Annex 2 Item 6) among the digital-service providers it reaches expressly, generally at the medium-or-large-company threshold of Article 1064(2) or (3) of the Personen- und Gesellschaftsrecht (Persons and Companies Act); the wider sector classes Annexes 1 and 2 also reach (critical-infrastructure operators across energy, transport, banking, health and public administration, and the digital infrastructure sector's own DNS, top-level-domain, cloud-computing, data-centre and content-delivery-network providers, which Article 3 binds regardless of size) are reached too, by declaring that you are an essential or important entity.

Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 6 · Read the law's page

• Notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating, where relevant, whether the incident is suspected to result from unlawful or malicious acts or to have cross-border effect.
• Follow with a full notification within 72 hours of becoming aware, updating the early warning where relevant and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on the Stabsstelle Cyber-Sicherheit's request, and a final report within one month of the 72-hour notification, describing the incident's severity and impact in detail, the likely threat or root cause, and the mitigation measures taken.
• If the incident is still ongoing when the final report falls due, submit a progress report at that point and a final report within one month of the incident being dealt with (Article 6(2)(e)).
• This binds an essential or important entity under Article 1 and Annexes 1 and 2, which name an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider (Annex 2 Item 6) among the digital-service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Gesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG), LGBl. 2025 Nr. 121, Art. 2, 9 · Read the law's page

• This binds a financial entity and an ICT third-party service provider within Article 2 of the EEA DORA Implementation Act, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554 (reached by declaring that you hold a financial-services license). Regulation (EU) 2022/2554 applies as national law under Article 11 until its incorporation into the EEA Agreement.
• Meet the ICT risk management requirements of Articles 5 to 14 of Regulation (EU) 2022/2554, or the simplified requirements of Article 16(1) and (2) where they apply (Article 9(2)(a)).
• Carry out the digital operational resilience tests required by Articles 24 and 25 of Regulation (EU) 2022/2554 (Article 9(2)(a)).
• Manage ICT third-party risk under Articles 28 and 29 of Regulation (EU) 2022/2554 and include in contracts for ICT services the terms Article 30 requires (Article 9(2)(a)).
• Provide the FMA with complete and correct information and comply with its orders (Article 9(2)(b) and (c)).

Gesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG), LGBl. 2025 Nr. 121, Art. 9 Abs. 2 Bst. a Ziff. 3 and Art. 19 of the Regulation · Read the law's page

• This binds a financial entity within Article 2 of the EEA DORA Implementation Act, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554 (reached by declaring that you hold a financial-services license). The reporting duty rests on the financial entity, which stays fully responsible if it outsources the reporting to a third-party service provider (Article 19(5) of the Regulation). Regulation (EU) 2022/2554 applies as national law under Article 11 until its incorporation into the EEA Agreement.
• Report major ICT-related incidents to the FMA, as the relevant competent authority, with an initial notification, an intermediate report and a final report within the time limits laid down under Article 20 of Regulation (EU) 2022/2554 (Article 19(1) and (4) of the Regulation).
• Inform your clients without undue delay as soon as you become aware of a major ICT-related incident that has an impact on their financial interests, and of the measures taken to mitigate its adverse effects (Article 19(3) of the Regulation).
• File the reports Article 19 requires completely, correctly and on time (Article 9(2)(a) of the Act).