AzerbaijanCode of Administrative Offences, New Article 371-2, Cybersecurity Compliance Duties of Information Infrastructure Subjects
Law of the Republic of Azerbaijan on Amendments to the Code of Administrative Offences of new art. 371-2.1.1, 371-2.1.3 to 371-2.1.5
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds, from , the subjects of information infrastructure, including owners of internet information resources, internet providers and hosting providers (reached by declaring that you provide telecom services or operate an essential service), and computer incident response centers and security operations centers; it does not reach critical information infrastructure, state bodies including the Central Bank, intelligence and counterintelligence subjects, or entities supervised in the financial markets (note to article 371-2).
- Carry out the authorized body's instructions on securing your information infrastructure (preventing cyber threats, cyber attacks and cyber incidents and remedying their results) and on digital investigation, including supplying the result of the investigation (article 371-2.1.1).
- Answer the authorized body's inquiries on the state of your information infrastructure's cybersecurity within 24 hours, and its digital investigation inquiries within 5 working days (article 371-2.1.3).
- Carry out continuous real-time monitoring of cyber incidents and cyber attacks and the initial technical response to them (article 371-2.1.4).
- Meet the general and special cybersecurity requirements for information infrastructure that performs socially significant functions (article 371-2.1.5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 371-2.1 fines a legal person 1,000 to 2,000 manat and an official 500 to 1,000 manat for each offence listed in articles 371-2.1.1 to 371-2.1.6; the figures recorded are the legal-person range.
- Rule
- Fixed only
- As of
- Minimum
- 1,000
- Currency
- AZN
- Fixed cap
- 2,000
Who enforces it
Enforcement body
The body the relevant executive authority designates for cybersecurity (articles 371-2.1.1 and 371-2.1.3); administrative fines are imposed under the Code of Administrative Offences.
Settledness
- As of
- Open questions
- How does Azerbaijani law define a subject of information infrastructure, and does article 371-2 reach every owner of an internet information resource or only those whose infrastructure performs socially significant functions?
- What is the number of the amending Law and its publication date in the Legislation Collection?
What this law does
New article 371-2.1 of the Code of Administrative Offences punishes computer incident response centers, security operations centers and information infrastructure subjects, including owners of internet information resources, internet providers and hosting providers, for failing to take the cybersecurity measures that article 371-2.1 lists.
Article 371-2.1.3 covers failure to answer the authorized body's cybersecurity inquiries within 24 hours, and its digital investigation inquiries within 5 working days. Article 371-2.1.4 covers failure to carry out continuous real-time monitoring of cyber incidents and cyber attacks and the initial technical response to them. Article 371-2.1.5 covers a breach of the general and special cybersecurity requirements for information infrastructure that performs socially significant functions.
The fine for these offences is 500 to 1,000 manat for an official and 1,000 to 2,000 manat for a legal person. The note to article 371-2 excludes critical information infrastructure, state bodies including the Central Bank, intelligence and counterintelligence subjects, and entities supervised in the financial markets. Articles 1.2, 1.3 and 1.5 of the amending Law, which carry article 371-2, apply from .
When LexLint raises it
When your app profile says your app provides telecom services or runs an essential service.