ArmeniaLaw on Cybersecurity: Service Provider Security Obligations in Vital Sectors
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a legal entity or individual entrepreneur that carries out activities in a vital sector and operates an information system or critical information infrastructure, and state and local self-government bodies (Article 1(3)); micro and small enterprises are outside it unless they operate a critical information infrastructure (Article 1(4)). The vital sectors are energy, manufacturing, transport, water supply, communications, postal services, financial services, healthcare, information technology, radioactive materials and subsoil use, space activities, database operation, emergency safety and state administration (Article 16(4)). You reach it by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services.
- Take organisational and technical measures around the clock, every day, to detect and manage cyber threats, to prevent, detect, block and resolve cyber incidents, and to manage risks so that your information systems and critical information infrastructures keep running (Article 9(1)).
- Have an internal cybersecurity regulation that sets out your cybersecurity policy and describes how you comply with the Law and the secondary acts adopted under it (Article 9(2)); this duty starts when the relevant secondary legal act takes effect (Article 25(1)).
- Assess the risks to your information system or critical information infrastructure, approve a plan of measures to prevent cyber incidents, monitor daily for cyberattacks, threats and vulnerabilities, and document the threats you assess and the security measures you apply (Article 9(3)(1) to (4)).
- Keep the reports on your response to a cyber incident, and the information you collect on cyber incidents, for at least three years, and comply with basic cyberhygiene requirements based on the Zero Trust Principle (Article 9(3)(7), (8) and (11)).
- Train your staff and take part in cyberexercises with the authorised and autonomous bodies (Article 9(3)(9)).
- Undergo a cybersecurity audit once every three years, unless an applicable standard sets another interval, and submit the audit report to the Autonomous body within one month after you receive it (Article 20(2)).
- If you operate a critical information infrastructure, undergo the audits on the basis of an applicable international or national standard, take the organisational, technical and software measures needed for its cybersecurity (Articles 17(2) and 18(2)), and submit a document certifying compliance with such a standard within twenty-four months after the Law enters into force (Article 25(2)).
- Remain responsible for the cybersecurity measures when you delegate the management, operation, hosting or interoperability of an information system or critical information infrastructure to another person (Article 17(3)).
- Adopt your internal cybersecurity regulation, carry out the risk assessments and develop the plan of measures to prevent cyber incidents within eighteen months after the Law enters into force (Article 25(5)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 24(1) provides that a violation of the Law entails the administrative or criminal liability prescribed by law, and the Law itself states no offense or penalty amount.
Who enforces it
Enforcement body
The Autonomous body, which supervises compliance with the Law and the legal acts adopted under it, under the procedure of the Law on the Information Systems Regulatory Body (Article 21(1)).
Settledness
- As of
- Open questions
- Has the Government approved the criteria and the list identifying critical information infrastructures and their operators under Article 16(1) and (2), and the minimum cybersecurity requirements that Article 9(2) and (3) depend on?
- Which administrative or criminal provisions apply to a violation of the Law under Article 24(1)?
What this law does
Article 1(3) extends the Law to legal entities and individual entrepreneurs that carry out activities in one or more vital sectors and operate an information system or critical information infrastructure, and to state and local self-government bodies. Article 1(4) excludes micro and small enterprises unless they operate a critical information infrastructure.
Article 16(4) lists fourteen vital sectors, among them energy, transport, communications, financial services, healthcare and information technology. Article 16(3) deems information systems for qualified trust services, top-level domain registry services, DNS services and, for medium-sized entities, electronic communications or Internet access services to be critical information infrastructures by operation of law.
Article 9(1) requires a service provider to take organisational and technical measures around the clock to detect and manage cyber threats and to prevent, detect, block and resolve cyber incidents. Article 9(2) requires a service provider to have an internal cybersecurity regulation. Article 9(3)(4) requires a service provider to ensure daily monitoring to detect cyberattacks, cyber threats and vulnerabilities.
Article 9(3)(7) requires a service provider to prepare reports on its response to a cyber incident and to retain them for at least three years. Article 9(3)(11) requires a service provider to comply with basic cyberhygiene requirements based on the Zero Trust Principle. Article 20(2) requires a service provider to undergo a cybersecurity audit once every three years unless a standard sets another interval.
Article 25 sets the Law in force on the tenth day after promulgation, except Article 8 and some provisions of Article 9 that start when their secondary legal acts take effect. Article 25(5) gives service providers eighteen months after the Law enters into force to adopt internal regulations, carry out risk assessments and prepare a plan of measures.
Article 25(2) gives operators of critical information infrastructure twenty-four months after the Law enters into force to submit a document certifying compliance with a cybersecurity standard.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.