CroatiaZakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance
Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 29. i 30.
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds you where you are an essential or important entity designated under the Cybersecurity Act, whose Annex III lists providers of digital services as a sector and whose definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform expressly; you become an important entity at the general medium-enterprise-or-larger size threshold Article 10 applies to Annex II entities. The wider sector classes the Act also reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing, research, education and others) are reached too, by declaring that you are an essential or important entity.
- Take risk-management measures sized to your exposure, covering at minimum: risk-analysis and information-system-security policies, incident-handling procedures (monitoring, logging and reporting), business continuity including backup management and disaster recovery, supply-chain security accounting for your direct suppliers' and service providers' vulnerabilities, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own measures, basic cyber-hygiene practices and training, cryptography and encryption policies, human-resources security and access control including asset inventories, and, where appropriate, multi-factor or continuous authentication and secured communications.NIST CSF 2.0GV.PO-01
- Have the members of your management body, or, if you are a public entity, the heads of your state administration or local self-government body, approve these measures and control their implementation, and have them attend, and make available to your staff, appropriate cybersecurity training covering risk-management issues and their effect on your services.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Chapter Nine of the Act (Dio deveti, Prekršajne odredbe) makes an Article 26 or 29 failure (Article 30 itemizes the Article 26 measures) a prekrsaj (misdemeanor) rather than a kazneno djelo (criminal offense) under the Kazneni zakon, so this is not criminal exposure in the Croatian sense. It is nonetheless a state-prosecuted proceeding rather than a direct administrative sanction: Article 104 requires the competent authority to file a report with the competent state attorney (nadležni državni odvjetnik), who submits a prosecution proposal (optuzni prijedlog) to the misdemeanor court.
Penalty structure
Article 101(1) sets an essential entity's fine at EUR 10,000 to EUR 10,000,000, or 0.5 percent to 2 percent of the entity's worldwide annual turnover for the preceding financial year, whichever amount is higher; this field states only the essential-entity fixed-cap and turnover-cap ends of that range. Article 102(1) sets an important entity's fine at EUR 5,000 to EUR 7,000,000, or 0.2 percent to 1.4 percent, whichever is higher, not separately structured here since this field holds one tier. Article 101(2) and Article 102(2) each add a personal fine on the individual responsible under Article 29: EUR 1,000 to 6,000 for an essential entity's responsible person, EUR 500 to 3,000 for an important entity's. Article 103 separately fines a failure to submit categorization or registry data, EUR 2,000 to 20,000 for the entity and EUR 200 to 1,000 for its responsible person, not represented in this field. None of these fines is imposed by the competent authority directly: Article 104 routes a suspected violation to the competent state attorney, who prosecutes it as a misdemeanor before the misdemeanor court.
- Rule
- Higher of
- As of
- Minimum
- 10,000
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The central state body for cybersecurity (Središnje državno tijelo za kibernetičku sigurnost) designated per sector in Prilog III (Annex III) of the Cybersecurity Act as the competent authority for cybersecurity requirements; for the digital-service-provider sector Annex III names the National Cybersecurity Centre (Nacionalni centar za kibernetičku sigurnost) as the competent CSIRT. A suspected failure is referred to the competent state attorney (Article 104), who prosecutes it as a misdemeanor before the misdemeanor court. For a public electronic-communications provider the authorized prosecutor is instead the regulatory body for network activities, and for a trust service provider the state administration body responsible for digital society development (Article 104(3)-(4)).
Settledness
- As of
- Open questions
- Article 15 sets out how the medium-enterprise threshold is applied by reference to the small-business incentive law's own headcount and turnover figures. What are the exact headcount and turnover figures that cross-referenced law sets for a digital service provider to clear the medium-enterprise threshold?
What this law does
Article 30 of the Cybersecurity Act requires every essential and important entity to take risk-management measures covering, at minimum, risk-analysis and information-system-security policies, incident-handling procedures including monitoring, logging and reporting, business continuity such as backup management and disaster recovery and cybersecurity-crisis management, supply-chain security including the vulnerabilities and security practices of direct suppliers and service providers, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of the entity's own risk-management measures, basic cyber-hygiene practices and cybersecurity training, cryptography and, where appropriate, encryption policies, human-resources security and access-control policies and asset management including regular inventory updates, and, where appropriate, multi-factor or continuous authentication, secured voice, video and text communications, and secure emergency communication systems.
Article 29 makes the members of an essential or important entity's management body, or the heads of the relevant state administration body, other state body, or local and regional self-government executive body for a public entity, responsible for implementing these measures: they must approve the risk-management measures the entity applies and control their implementation, and they must themselves attend appropriate training on risk-management issues and its effect on the entity's services, and make the same training available to the entity's staff.
Both articles transpose NIS2 Articles 21 and 20 respectively. Annex III (Prilog III, the list of competences) lists 'providers of digital services' at row 21 for all entity types, with the National Cybersecurity Centre as competent computer security incident response team (CSIRT). The Act's own definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches.
Article 8(1) applies the corresponding provisions of a special law, including those on supervision, to an essential or important entity of a sector in Annex I or II for which that special law sets requirements that match this Act's cybersecurity requirements in content and purpose or are stricter. Article 4(1) names the Croatian National Bank and the Croatian Financial Services Supervisory Agency, with the Croatian Civil Aviation Agency, as the authorities competent to apply those special laws.
Annex III names no authority implementing this Act's cybersecurity requirements for the banking and financial-market-infrastructure sectors, and names the Croatian National Bank and the Croatian Financial Services Supervisory Agency as the authorities implementing their special laws.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .