BelarusDecree 40 On Cybersecurity: Cyber Incident Reporting to the National Cybersecurity Center
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the state bodies and other organizations that the Council of Ministers lists under subparagraph 3.4, the owners of the 27 critically important informatization objects named in Annex 1 (among them banks, insurers, electricity utilities, a nuclear power plant, telecommunications operators and a payment processing center), and the authorized internet service providers that host official websites and e-mail (subparagraph 3.5). You reach it by declaring that you operate an essential service.
- Have your cybersecurity center inform the National Cybersecurity Center of each cyber incident it identifies no later than one hour after identifying it (subparagraph 3.8).
- Have your cybersecurity center provide the National Cybersecurity Center with other information, including the results of response and clean-up after a cyber incident, in the order, scope and time limits the Operational and Analytical Center sets (subparagraph 3.8).
- Provide the National Cybersecurity Center with the documents and other information, including technical information, that it demands about your information infrastructure objects, no later than the day after the demand (subparagraph 3.3).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Subparagraph 3.14 makes the head of a state body or other organization personally responsible for its cybersecurity, and the Decree states no offense or penalty amount of its own.
Who enforces it
Enforcement body
The Operational and Analytical Center under the President of the Republic of Belarus (OAC), which coordinates the national cybersecurity system, sets the cybersecurity requirements for information infrastructure objects, and may issue orders that bind state bodies and other organizations to remedy violations of the Decree (subparagraph 3.1).
Settledness
- As of
- Open questions
- What order, scope and time limits has the Operational and Analytical Center set for the further information that subparagraph 3.8 requires after the first report?
What this law does
Subparagraph 3.8 requires cybersecurity centers to inform the National Cybersecurity Center of identified cyber incidents no later than one hour after identifying them, and to provide other information, including the results of response and clean-up, in the order, scope and time limits the Operational and Analytical Center sets.
Subparagraph 3.3 entitles the authorized persons of the National Cybersecurity Center to demand from state bodies and other organizations documents and other information, including technical information, about their information infrastructure objects, to be provided no later than the day after the demand. Subparagraph 3.2 creates the national cyber incident response team CERT.BY inside the National Cybersecurity Center.
Annex 2 defines a cyber incident as an event that actually or potentially threatens the confidentiality, integrity, authenticity, availability and safety of information and that breaches or threatens to breach the security policy.
When LexLint raises it
When your app profile says your app runs an essential service.