BhutanCybersecurity Code of Practice, Security Programme for Licensed ICT and Telecommunications Providers
Bhutan InfoComm and Media Authority Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under section 58 of… the Information, Communications and Media Act of Bhutan 2018), clauses 3 and 11 to 12
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.bicma.gov.bt/wp-content/uploads/2024/10/Code-of-Practice-for-Information-Security-Cybersecurity-and-privacy-Protection-for-ICT-S…In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a licensed telecom service provider and any other licensed ICT service provider that has critical information infrastructure in Bhutan (reached by declaring that you provide telecom services or operate an essential service).
- Conduct internal audits of your information and network security management system at planned intervals, and where an audit finds non-compliance with the Act or a code of practice issued under it, submit an audit finding remediation plan to the Authority within 30 working days of receiving the audit report unless the Authority indicates otherwise in writing (clauses 11.3 and 11.4).
- Conduct a vulnerability assessment at least once every 12 months, and again after any major system change (clause 11.5).
- Conduct a penetration test on your ICT facilities at least once every 12 months, and again after any major system change (clause 11.6).
- Establish a Cybersecurity Incident Response Plan and an organizational incident response team, Computer Incident Response Team or Security Operation Center to continuously monitor and mitigate security risk, threats and vulnerabilities (clause 12.1).
- Conduct scenario-based cybersecurity exercises at least once every 12 months (clause 12.2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bhutan InfoComm and Media Authority, which may by order secure compliance by a licensee in contravention of the terms and conditions of its license, including by payment of a fine.
Settledness
- As of
- Open questions
- Does a breach of the Code, issued under section 58 of the Act, fall within section 127 of the Act, which reaches a licensee in contravention of the terms and conditions of its license?
What this law does
The Code applies to the Telecom Service Providers and other ICT Service providers having critical information infrastructure. The Bhutan InfoComm and Media Authority issued the Code under section 58 of the Information, Communications and Media Act of Bhutan 2018. The Code came into force on the 10th day of October, 2024.
Where an audit identifies non-compliance with the Act or a code of practice issued under it, the Code requires a licensee to submit an audit finding remediation plan to the Authority within 30 working days from the date that the licensee receives the audit report, unless the Authority indicates otherwise in writing. The Code requires a licensee to conduct a vulnerability assessment at least once every 12 months.
The Code requires a licensee to conduct a penetration test on its ICT facilities at least once every 12 months. The Code requires a licensee to establish a Cybersecurity Incident Response Plan that sets out how it should respond to a cybersecurity incident. The Code requires a licensee to conduct scenario-based cybersecurity exercises at least once every 12 months.
Section 127 of the Act provides that where a licensee is in contravention of the terms and conditions of its license, the Authority shall by an order make such provision, including payment of fine, as it appears necessary for the purpose of securing compliance.
When LexLint raises it
When your app profile says your app runs an essential service or provides telecom services.