AzerbaijanLaw on Information, Informatization and Information Protection, Critical Information Infrastructure Security Regime
Law of the Republic of Azerbaijan No. 460-IQ "On Information Informatization and Protection of Information", Chapter V-1, arts. 20-1 to 20-6 (inserted by Law No. 539-VIQD of )
In force.
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds a critical information infrastructure subject: the owner or user of a critical information infrastructure object, whether a state body, a state-owned legal person, a public legal person created on the state's behalf, or another legal person or individual entrepreneur other than a micro, small or medium-sized enterprise (reached by declaring that you operate an essential service). A system is a critical information infrastructure object where its failure could harm the state's independence and defense, state bodies and the population's essential supplies, economic and financial stability, or the ecological balance (article 20-2.1).
- Organize and operate an information security management system for your critical information infrastructure that detects, prevents and remedies cyber threats, cyber attacks and cyber incidents, including attempts to commit them (article 20-3.1).
- Define the composition and operating procedure of that management system on the basis of the general critical information infrastructure security requirements, and enter it in the register of critical information infrastructure objects; the authorized body may require you to show that it complies with those requirements (article 20-3.2).
- Appoint a person responsible for critical information infrastructure security, and enter that information in the register of critical information infrastructure objects (article 20-3.3).
- Meet the general security requirements the state sets and the special requirements you set for your own infrastructure, and answer the authorized body's inquiries about compliance without delay (articles 20-4.1, 20-4.2 and 20-4.4).
- Remedy, without delay and on the authorized body's demand, the breaches of the security requirements it finds, and report the result of the measures taken (article 20-6.7).
- Have a cybersecurity service provider carry out an external audit at least once a year, and see that its results are sent to the body the relevant executive authority designates (article 20-6.8).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The authorized body for critical information infrastructure security, which is the body the relevant executive authority designates under article 2 of the Law; it keeps the register of critical information infrastructure objects (article 20-2.3) and monitors the state of security (article 20-5.3).
Settledness
- As of
- Open questions
- Which general and special security requirements has the Cabinet of Ministers approved under article 20-1.3, and what audit and register procedures do they add?
- Which body now exercises the authorized-body powers, given the 2026 reorganization of Azerbaijan's cybersecurity functions?
What this law does
Article 2 of Law number 460-IQ, as amended by Law number 539-VIQD of , defines a critical information infrastructure subject as the owner or user of a critical information infrastructure object, namely a state body, a state-owned legal person, a public legal person created on the state's behalf, or another legal person or individual entrepreneur other than a micro, small or medium-sized enterprise.
Article 20-2.1 treats a system as a critical information infrastructure object where a failure of its functionality could threaten the state's independence, sovereignty, constitutional order, territorial integrity or defense capability, disrupt state bodies or the population's essential supplies, upset economic and financial stability, or upset the ecological balance.
Article 20-3.1 requires each critical information infrastructure subject to organize an information security management system and to keep it operating. Article 20-3.3 requires the subject to appoint a person responsible for critical information infrastructure security and to enter that information in the register of critical information infrastructure objects.
Article 20-6.8 requires the subject to have a cybersecurity service provider carry out an external audit at least once a year and to see that the results reach the body the executive authority designates. Article 20-4.6 provides that a breach of the critical information infrastructure security requirements gives rise to liability established by law.
A Presidential Decree of states that it is issued to secure the application of Law number 539-VIQD in connection with that Law's entry into force.
When LexLint raises it
When your app profile says your app runs an essential service.