GeorgiaLaw on Information Security, Critical Information System Subjects: Security Rules and Audit
Law of Georgia on Information Security (No. 6391-Is of ), arts. 3, 4 and 6
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a critical information system subject, meaning a state or municipal body, public-law legal entity or state enterprise (Category 1), an electronic communications company (Category 2) or a private-law legal person (Category 3, which can be a commercial bank) that the Government of Georgia has designated by resolution, and an organization connected to it that provides access to its information assets (Law on Information Security, arts. 2(z1)-(z3) and 3; reached by declaring that you operate an essential service).
- Adopt internal information-security rules that set your information-security policy and meet the minimum requirements the competent agency sets with reference to ISO, NIST and ISACA standards, and submit them to that agency for review (art. 4).
- Carry out an initial and periodic information-security audit of your management system against the minimum standards, and act on the audit conclusion (art. 6).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 10-4 sets a warning or a fine of GEL 5,000 for a Category 1 or Category 3 subject that misses the deadline for implementing the minimum information-security requirements, and a fine of GEL 10,000 for a repeat within one year.
- Rule
- Fixed only
- As of
- Currency
- GEL
- Fixed cap
- 10,000
Who enforces it
Enforcement body
The Operational-Technical Agency, the Digital Governance Agency and the Cyber Security Bureau
Settledness
- As of
- Open questions
- Which subjects does the Government of Georgia's current resolution list, and in which category?
What this law does
Article 3 applies the Law to a critical information system subject. The Government of Georgia lists the subjects by resolution together with each one's criticality class. Article 4 requires the subject to adopt internal information-security rules that meet minimum requirements. Article 6 requires the subject to carry out an initial and periodic information-security audit.
Article 10-4 fines a Category 1 or Category 3 subject a warning or GEL 5,000 for missing the deadline set for the minimum requirements, and GEL 10,000 for a repeat within one year.
When LexLint raises it
When your app profile says your app runs an essential service.