Is a crypto-asset provider, in Armenia

Law on Cybersecurity, art. 11 (Law of the Republic of Armenia No. HO-442-N) · Read the law's page

• Notify the Autonomous body immediately upon becoming aware of a cyber incident, and no later than within 24 hours, if it has a significant impact on the continuous and secure operation of the information system or critical information infrastructure, or if that impact cannot yet be assessed but may reasonably be presumed; this applies whether you or another person operates or hosts the system (Article 11(1)).
• With the notification, give the Autonomous body the probable causes and potential consequences of the incident where possible (Article 11(3)).
• Submit updated information on the incident, including its severity and consequences, to the Autonomous body within 72 hours after becoming aware of it (Article 11(4)).
• Notify the persons potentially affected by the incident immediately after becoming aware of it or, if that is not possible, within two days (Article 11(7)).
• Submit a final report to the Autonomous body within one month after the updated information, covering the probable causes, the measures applied, the severity, consequences and scope of impact, the time and money spent, and the steps taken to prevent similar incidents (Article 11(9)).
• This binds a legal entity or individual entrepreneur that carries out activities in a vital sector and operates an information system or critical information infrastructure, and state and local self-government bodies (Article 1(3)); micro and small enterprises are outside it unless they operate a critical information infrastructure (Article 1(4)). The vital sectors are energy, manufacturing, transport, water supply, communications, postal services, financial services, healthcare, information technology, radioactive materials and subsoil use, space activities, database operation, emergency safety and state administration (Article 16(4)). You reach it by declaring that you operate an essential service, provide financial services, handle health records, provide telecom services or provide cloud services. The information technology sector includes digital infrastructures such as cloud computing services, electronic trading platforms and online search engines (Article 3(1)(8)), so declare that you operate an essential service if you run one of those.

Law on Cybersecurity, arts. 1, 9, 16, 17, 18, 20 and 25 (Law of the Republic of Armenia No. HO-442-N) · Read the law's page

• Take organisational and technical measures around the clock, every day, to detect and manage cyber threats, to prevent, detect, block and resolve cyber incidents, and to manage risks so that your information systems and critical information infrastructures keep running (Article 9(1)).
• Have an internal cybersecurity regulation that sets out your cybersecurity policy and describes how you comply with the Law and the secondary acts adopted under it (Article 9(2)); this duty starts when the relevant secondary legal act takes effect (Article 25(1)).
• Take organisational and technical measures for risk management, including physical security of your information systems, and document the threats you assess and the security measures you apply (Article 9(3)(2) and (3)). The duties to assess the risks to your information system or critical information infrastructure, approve a plan of measures to prevent cyber incidents, and monitor daily for cyberattacks, threats and vulnerabilities (Article 9(3)(1) and (4)) start when the relevant secondary legal acts take effect (Article 25(1)).
• Keep the reports on your response to a cyber incident, and the information you collect on cyber incidents, for at least three years, and comply with basic cyberhygiene requirements based on the Zero Trust Principle (Article 9(3)(7), (8) and (11)).
• Train your staff and take part in cyberexercises with the authorised and autonomous bodies (Article 9(3)(9)).
• Undergo a cybersecurity audit once every three years, unless an applicable standard sets another interval, and submit the audit report to the Autonomous body within one month after you receive it (Article 20(2)).
• If you operate a critical information infrastructure, undergo the audits on the basis of an applicable international or national standard, take the organisational, technical and software measures needed for its cybersecurity (Articles 17(2) and 18(2)), and submit a document certifying compliance with such a standard within twenty-four months after the Law enters into force (Article 25(2)).
• Remain responsible for the cybersecurity measures when you delegate the management, operation, hosting or interoperability of an information system or critical information infrastructure to another person (Article 17(3)).
• Adopt your internal cybersecurity regulation, carry out the risk assessments and develop the plan of measures to prevent cyber incidents within eighteen months after the Law enters into force (Article 25(5)).
• This binds a legal entity or individual entrepreneur that carries out activities in a vital sector and operates an information system or critical information infrastructure, and state and local self-government bodies (Article 1(3)); micro and small enterprises are outside it unless they operate a critical information infrastructure (Article 1(4)). The vital sectors are energy, manufacturing, transport, water supply, communications, postal services, financial services, healthcare, information technology, radioactive materials and subsoil use, space activities, database operation, emergency safety and state administration (Article 16(4)). You reach it by declaring that you operate an essential service, provide financial services, handle health records, provide telecom services or provide cloud services. The information technology sector includes digital infrastructures such as cloud computing services, electronic trading platforms and online search engines (Article 3(1)(8)), so declare that you operate an essential service if you run one of those.