ArmeniaLaw on Cybersecurity: Cyber Incident Notification
Law on Cybersecurity, art. 11 (Law of the Republic of Armenia No. HO-442-N)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a legal entity or individual entrepreneur that carries out activities in a vital sector and operates an information system or critical information infrastructure, and state and local self-government bodies (Article 1(3)); micro and small enterprises are outside it unless they operate a critical information infrastructure (Article 1(4)). The vital sectors are energy, manufacturing, transport, water supply, communications, postal services, financial services, healthcare, information technology, radioactive materials and subsoil use, space activities, database operation, emergency safety and state administration (Article 16(4)). You reach it by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services.
- Notify the Autonomous body immediately upon becoming aware of a cyber incident, and no later than within 24 hours, if it has a significant impact on the continuous and secure operation of the information system or critical information infrastructure, or if that impact cannot yet be assessed but may reasonably be presumed; this applies whether you or another person operates or hosts the system (Article 11(1)).
- With the notification, give the Autonomous body the probable causes and potential consequences of the incident where possible (Article 11(3)).
- Submit updated information on the incident, including its severity and consequences, to the Autonomous body within 72 hours after becoming aware of it (Article 11(4)).
- Notify the persons potentially affected by the incident immediately after becoming aware of it or, if that is not possible, within two days (Article 11(7)).
- Submit a final report to the Autonomous body within one month after the updated information, covering the probable causes, the measures applied, the severity, consequences and scope of impact, the time and money spent, and the steps taken to prevent similar incidents (Article 11(9)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 24(1) provides that a violation of the Law entails the administrative or criminal liability prescribed by law, and the Law itself states no offense or penalty amount.
Who enforces it
Enforcement body
The Autonomous body, which supervises compliance with the Law and the legal acts adopted under it, under the procedure of the Law on the Information Systems Regulatory Body (Article 21(1)).
Settledness
- As of
- Open questions
- Has the Autonomous body approved the notification procedure and forms that Article 11 relies on, and do they change the 24-hour, 72-hour and one-month steps?
What this law does
Article 11(1) requires a service provider to notify the Autonomous body of a cyber incident immediately upon becoming aware of it, and no later than within 24 hours, where the incident has a significant impact on the continuous and secure operation of the information system or critical information infrastructure, or where such an impact cannot yet be assessed but may reasonably be presumed. Article 11(2) sets the conditions under which an incident has a significant impact.
Article 11(4) requires updated information, including the incident's severity and consequences, within 72 hours after becoming aware. Article 11(7) requires the service provider to notify the persons potentially affected by the incident immediately, or within two days where that is not possible. Article 11(9) requires a final report to the Autonomous body within one month after the updated information.
Article 12(1) lets a person that is not a service provider, including a natural person, notify the Autonomous body voluntarily of a cyber incident, cyberattack, cyber threat or vulnerability.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.