Bosnia and HerzegovinaRepublika Srpska Rulebook on Information Security Standards, Security Incident Management and Reporting
Republika Srpska Rulebook on Information Security Standards, arts. 2 and 107-108
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the republic bodies of Republika Srpska (the entity of Bosnia and Herzegovina, not the state), its local self-government bodies and legal entities exercising public authority, and any other legal or natural person that accesses or handles their data in electronic form (article 2).
- Set up a process for managing security incidents that defines responsibilities and procedures and allows a quick and effective response when the security of your information system is breached, and prescribe at least procedures for reporting, classifying, monitoring and reporting on security incidents (article 107).
- In the case of a serious security incident, notify the Department for Information Security of the Agency for the Information Society immediately of the incident, its consequences and the actions you took (article 108(1)).
- In the incident report, if data was compromised, describe the compromised data, including its classification, creation date and author, and give a short description of the circumstances, including the start date and duration of the incident and, where it can be established, the number and location of the attackers (article 108(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Department for Information Security (OIB) of the Agency for the Information Society of Republika Srpska, which carries out direct oversight and control over the implementation of information security (article 3).
Settledness
- As of
- Open questions
- Does Republika Srpska law attach a misdemeanour fine to a breach of the Rulebook, which neither the Rulebook nor the Law on Information Security states?
What this law does
Article 2 applies the Rulebook to the republic bodies, local self-government bodies, legal entities exercising public authority and other persons that handle their electronic data. Article 107(1) requires the entities it covers to set up a process for managing security incidents with defined responsibilities and procedures. Article 107(2) requires them to prescribe, as a minimum, procedures for reporting, classifying, monitoring and reporting on security incidents.
Article 108(1) requires them, in the case of serious security incidents, to notify the Department for Information Security immediately of the incident, its consequences and the actions taken. Article 108(2) requires the incident report to describe any compromised data and the circumstances of the incident, including its start date and duration. Article 123 provides that the Rulebook enters into force on the day of its adoption. The Rulebook is dated .