AzerbaijanLaw on Information, Informatization and Information Protection, Critical Infrastructure Cyber Incident Reporting
Law of the Republic of Azerbaijan No. 460-IQ "On Information Informatization and Protection of Information", art. 20-3.4 (inserted by Law No. 539-VIQD of )
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a critical information infrastructure subject: the owner or user of a critical information infrastructure object, whether a state body, a state-owned legal person, a public legal person created on the state's behalf, or another legal person or individual entrepreneur other than a micro, small or medium-sized enterprise (reached by declaring that you operate an essential service).
- Send information on cyber threats, cyber attacks and cyber incidents against your critical information infrastructure, and on attempts to commit them, to the authorized body in the manner the critical information infrastructure security requirements set (article 20-3.4).
- Create the conditions for, and give support to, the authorized body's response to cyber attacks on your critical information infrastructure objects and its work to prevent cyber threats and incidents (article 20-4.5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The authorized body for critical information infrastructure security, designated by the relevant executive authority under article 2 of the Law, which receives the reports and organizes the response to threats against critical information infrastructure (article 20-5.3).
Settledness
- As of
- Open questions
- What deadline and format do the Cabinet's critical information infrastructure security requirements set for the reports article 20-3.4 requires?
What this law does
Article 20-3.4 requires critical information infrastructure subjects to send information on cyber threats, cyber attacks and cyber incidents against their critical information infrastructure, and on attempts to commit them, to the authorized body in the manner the security requirements set.
Article 2 defines a cyber incident as an event that stops or disrupts the operation of information systems, automated management systems or information-communication networks, or that breaches information security in them. Article 20-4.5 requires the subject to create the conditions for, and give support to, the authorized body's measures against cyber attacks on its critical information infrastructure objects.
A Presidential Decree of states that it is issued to secure the application of Law number 539-VIQD in connection with that Law's entry into force.
When LexLint raises it
When your app profile says your app runs an essential service.