Is a securities firm, in Montenegro

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).

Law on Information Security, Arts. 4, 16, 18(4) to (6), and 19 to 27 · Read the law's page

• If designated, adopt a cyber-security risk and security analysis, an incident-handling policy, a business-continuity and cyber-crisis plan, a supply-chain security act and system-governance acts, apply cryptographic protection where your work requires it, and assess the effectiveness of these measures (Article 16).
• If designated an essential entity, obtain a certificate of compliance with the Montenegrin standard MEST ISO/IEC 27001 from an accredited body within 30 months of 5 December 2024, and request a periodic re-verification from that body afterward (Article 18(4) to (6) and Article 73).
• Report any change to your registration details to the competent ministry within 14 days of the change (Article 26).
• This reaches you only where the Government of Montenegro has designated your organisation an essential or important entity on a sector list adopted under Articles 19 to 22. The digital-infrastructure essential-entity sector (an internet exchange point, a DNS or top-level-domain registry, a cloud computing, data centre, content delivery network or qualified trust service provider) and the online-marketplace important-entity sector are the digital categories closest to a software or platform business; the ICT-service-management essential-entity sector and the wider non-digital sectors (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, public administration and space among essential entities; postal and courier services, waste management, chemicals, food, manufacturing and research among important entities) are reached by declaring that you are an essential or important entity.