BelarusDecree 40 On Cybersecurity: Cybersecurity Centers and Duties of Designated Organizations
Decree 40 On Cybersecurity paras. 3.1 to 3.15 and Annex 1 (Указ Президента Республики Беларусь от 14 февраля 2023 г. № 40 «О кибербезопасности»)
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the state bodies and other organizations that the Council of Ministers lists under subparagraph 3.4, the owners of the 27 critically important informatization objects named in Annex 1 (among them banks, insurers, electricity utilities, a nuclear power plant, telecommunications operators and a payment processing center), and the authorized internet service providers that host official websites and e-mail (subparagraph 3.5). You reach it by declaring that you operate an essential service.
- Create a cybersecurity center, or buy cybersecurity services from an organization that has created one, within the period the Council of Ministers' list sets, if you are a state body or other organization on that list (subparagraph 3.4).
- If you own a critically important informatization object named in Annex 1, or you are an authorized internet service provider hosting official websites and e-mail, make sure a cybersecurity center is created within one year of paragraph 3.5 taking effect (subparagraph 3.5).
- Have your cybersecurity center attested by the Operational and Analytical Center before it starts work and at least once every three years afterwards (subparagraph 3.7).
- Send the Operational and Analytical Center a copy of each cybersecurity services contract within five working days of concluding it (subparagraph 3.10).
- Keep information on cyber incidents at your information infrastructure objects for at least one year (subparagraph 3.12).
- Name one of your deputy heads as responsible for organizing your cybersecurity work; the head of the state body or organization is personally responsible for its cybersecurity (subparagraphs 3.14 and 3.15).
- Give the National Cybersecurity Center unhindered access to the premises and sites where your information infrastructure objects operate, and to the hardware and software that run them, including remotely (subparagraph 3.3).
- Carry out the Operational and Analytical Center's orders to remedy violations of the Decree and of the cybersecurity requirements for your information infrastructure objects (subparagraph 3.1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Subparagraph 3.14 makes the head of a state body or other organization personally responsible for its cybersecurity, and the Decree states no offense or penalty amount of its own.
Who enforces it
Enforcement body
The Operational and Analytical Center under the President of the Republic of Belarus (OAC), which coordinates the national cybersecurity system, sets the cybersecurity requirements for information infrastructure objects, and may issue orders that bind state bodies and other organizations to remedy violations of the Decree (subparagraph 3.1).
Settledness
- As of
- Open questions
- What are the day on which the Decree was officially published and the day on which paragraphs 1 to 5 took effect, from which the one-year period in subparagraph 3.5 runs?
- Which state bodies and organizations has the Council of Ministers listed under subparagraph 3.4, and what cybersecurity requirements has the Operational and Analytical Center set for information infrastructure objects?
What this law does
Paragraph 1 of Decree 40 creates the national cybersecurity system, whose elements are the Operational and Analytical Center under the President, the National Cybersecurity Center, the cybersecurity centers of state bodies and other organizations, an authorized telecommunications operator, the information infrastructure objects of those bodies and organizations, and the data networks linking the elements.
Subparagraph 3.4 has the Council of Ministers list, and update every year, the state bodies and other organizations that must create a cybersecurity center or buy cybersecurity services from an organization that has created one.
Subparagraph 3.5 requires the owners of the critically important informatization objects named in Annex 1, and the authorized internet service providers that host official websites and e-mail, to have cybersecurity centers created within one year of that paragraph taking effect. Annex 1 names 27 owners of critically important informatization objects, among them banks, insurers, electricity utilities, a nuclear power plant, telecommunications operators and a payment processing center.
Subparagraph 3.7 requires each cybersecurity center to be attested by the Operational and Analytical Center before it starts work and at least once every three years. Subparagraph 3.12 requires state bodies and other organizations to keep information on cyber incidents at their information infrastructure objects for at least one year.
Subparagraph 3.14 makes the head of a state body or other organization personally responsible for its cybersecurity, and subparagraph 3.15 has the head name a deputy responsible for organizing that work. Subparagraph 3.1 lets the Operational and Analytical Center issue orders, binding on state bodies and other organizations, to remedy violations of the Decree and of the cybersecurity requirements for their information infrastructure objects. Paragraph 8 brings paragraphs 1 to 5 into force six months after the Decree's official publication.
When LexLint raises it
When your app profile says your app runs an essential service.