GeorgiaLaw on Information Security, Computer Incident Notification by Critical Information System Subjects
Law of Georgia on Information Security (No. 6391-Is of ), art. 10 and art. 10-8
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the same critical information system subjects as the Law's security-rules row, designated by Government of Georgia resolution as Category 1, 2 or 3 or in the defence sphere (reached by declaring that you operate an essential service).
- Notify the Computer Incident Assistance Group of the Operational-Technical Agency (Category 1 and 2), the Digital Governance Agency (Category 3) or the Cyber Security Bureau (defence sphere) immediately when a computer incident is identified in your network; the Law sets no numeric clock (art. 10(2)).
- Use a network sensor to identify computer incidents, and take emergency measures where needed to preserve and protect information about the incident (art. 10(1)-(2)).
- Respond within a reasonable time to the mandatory instruction the Group issues, and report the measures taken to the Group (art. 10(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 10-8 sets a warning or a fine of GEL 5,000 for a Category 1 or Category 3 subject that fails to notify a computer incident, follow the mandatory instruction or report the measures taken, and a fine of GEL 10,000 for a repeat within one year.
- Rule
- Fixed only
- As of
- Currency
- GEL
- Fixed cap
- 10,000
Who enforces it
Enforcement body
The Operational-Technical Agency, the Digital Governance Agency and the Cyber Security Bureau, through their Computer Incident Assistance Groups
Settledness
- As of
- Open questions
- Which subjects does the Government of Georgia's current resolution list, and in which category?
What this law does
Article 10(2) requires a critical information system subject to notify the competent Computer Incident Assistance Group immediately when a computer incident is identified in its network. Article 10(1) requires the subject to use a network sensor to identify computer incidents. Article 10(3) requires the subject to respond to the Group's mandatory instruction within a reasonable time.
Article 10-8 fines a Category 1 or Category 3 subject a warning or GEL 5,000 for failing to notify, and GEL 10,000 for a repeat within one year.
When LexLint raises it
When your app profile says your app runs an essential service.