MicronesiaFSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security
What it requires
- It reaches you only where the Secretary of Justice has designated a computer, computer system, or computer data you own or operate as critical information infrastructure; see this jurisdiction's companion risk-management row for the designation criteria.
- Notify the Secretary of Justice and the CERT-FSM of a significant cybersecurity incident affecting your critical information infrastructure or an interconnected system: an early warning within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report within 30 days of that notification.NIST CSF 2.0RS.CO-02
- For an ongoing significant cybersecurity incident, submit a progress report to the Secretary of Justice and the CERT-FSM within 30 days of the notification, and a final report within 30 days of the handling of the incident (Section 412(2)(d)).NIST CSF 2.0RS.CO-03
- Establish mechanisms and processes to promptly detect a cybersecurity threat or incident affecting your critical information infrastructure.NIST CSF 2.0DE.CM-09
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 412(4) makes a failure, without reasonable excuse, to comply with the incident-notification duty under section 412(1) an offense, liable on conviction to a fine not exceeding $10,000 or imprisonment for a term not exceeding one year or both.
Who enforces it
Enforcement body
Secretary of Justice, Department of Justice of the Federated States of Micronesia, and the CERT-FSM operated by the Department of Transportation, Communications and Infrastructure (DTCI)
Settledness
C.B. No. 24-14 was introduced on .
- As of
- Open questions
- Will C.B. No. 24-14 be enacted, and if so, will its section 412 reporting clock be amended before passage?
- How will the Secretary define what makes a cybersecurity incident significant enough to trigger the section 412(1) notification duty for a given owner?
What this law does
Section 412(1) of the same bill, C.B. No. 24-14 (Cybersecurity Act 2025), would require the owner of critical information infrastructure to notify the Secretary of Justice and the CERT-FSM (the national Computer Emergency Response Team the bill would create) of a significant cybersecurity incident affecting its critical information infrastructure or an interconnected system. The owner must submit an early warning within twenty-four hours of becoming aware of the incident.
The owner must then submit a fuller incident notification within seventy-two hours. The owner must submit a final report not later than thirty days after that notification, and, for an ongoing incident, a progress report on the same thirty-day clock. Section 412(3) would separately require the owner to establish mechanisms and processes for promptly detecting a cybersecurity threat or incident affecting its critical information infrastructure.
A failure to comply with the reporting duty is a criminal offense carrying a fine of up to $10,000 or imprisonment of up to one year or both. The bill was introduced in the Congress of the Federated States of Micronesia on .
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .