LexLint.ioBeta

Know the law your code answers to.

Law / Hungary

Cybersecurity Act, Risk-Management Measures

2024. évi LXIX. törvény (Magyarország kiberbiztonságáról), 6. §

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • This duty reaches your service where you are an essential or important organization under Section 1: an organization under the sector annexes that qualifies as a medium-sized enterprise or larger under Hungary's SME Act, or exceeds the thresholds the Act sets for one, or a provider of an online marketplace, online search engine or social-media service platform whose main place of business activity is in Hungary, whether or not you are established there.
  • Establish and operate a risk-management framework for the electronic information systems in your organization's possession, following a directly applicable EU legal act or, absent one, the decree of the minister responsible for informatics.NIST CSF 2.0GV.RM-06
  • Survey and register every electronic information system, central service and supporting system you use, appoint or designate the person responsible for the security of those systems, classify them into a security category, and apply protective measures proportionate to their risk.NIST CSF 2.0ID.AM-02NIST CSF 2.0ID.AM-05NIST CSF 2.0GV.RR-02
  • Issue an information-security policy for your users and the requirements it sets, and review it at least every two years.NIST CSF 2.0GV.PO-01
  • Report a cyber threat, near-incident or cybersecurity incident affecting your electronic information system to the competent cybersecurity incident-handling centre without delay, on the notification clock this jurisdiction's companion incident-notification row sets out.NIST CSF 2.0RS.CO-02

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.IM-P1Systems/products/services that process data are inventoried.
NIST CSF 2.0
  • GV.RM-06A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • ID.AM-02Inventories of software, services, and systems managed by the organization are maintained
  • ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on the mission
  • RS.CO-02Internal and external stakeholders are notified of incidents
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Section 42 of Government Decree 418/2024 (XII. 23.) makes the sanction for an infringement of Section 6 an administrative cybersecurity fine; neither the Act nor the Decree creates a criminal offence for the infringement, though Section 44(4) of the Decree states that paying the fine does not exempt the organization from any separate criminal or civil liability that applies.

Penalty structure

Government Decree 418/2024 (XII. 23.) Section 42(2), not the Act itself, sets the ceiling: the forint equivalent of EUR 10,000,000 or, if higher, 2 percent of the organization's total global annual turnover in the preceding financial year for an essential organization, mirroring NIS2 Article 34(4); a lower tier for an important organization is EUR 7,000,000 or 1.4 percent, mirroring Article 34(5). Section 42(4) separately lets the national cybersecurity authority fine the head of an organization personally up to HUF 15,000,000 for failing to meet a statutory duty.

Rule
Higher of
As of
Currency
EUR
Fixed cap
10,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

The Szabályozott Tevékenységek Felügyeleti Hatósága (SZTFH, the Supervisory Authority of Regulated Activities) for an organization under Section 1(1)(d) or (e) of the Act, the sector-annex and digital-provider organizations this row is flagged for; a separate national cybersecurity authority the Government designates by decree enforces instead against a public-administration, state-influenced or critical-infrastructure organization under Section 1(1)(a), (b), (c) or (f).

Settledness

As of
Open questions
Does the medium-enterprise threshold in Section 1(4)(f) test an organization on a standalone basis, or does it import the partner-enterprise and linked-enterprise aggregation the referenced SME Act builds on Commission Recommendation 2003/361/EC, the same open question the EU-level NIS2 row records for Article 21?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 6(2) requires the head of an organization within the Act's scope to establish and operate a risk-management framework for the electronic information systems in the organization's possession, following a directly applicable EU legal act or, in its absence, the decree of the minister responsible for informatics.

Section 6(3) to (5) list the concrete tasks the framework must cover: surveying and registering every electronic information system and central service used, appointing the person responsible for system security, classifying systems into a security category, applying protection proportionate to risk, issuing and periodically reviewing an information-security policy, and, for a public-administration, state-influenced or critical-infrastructure organization, spending at least 5 percent of annual IT development costs on cybersecurity.

Section 1 scopes the duty to an essential or important organization. The sector annexes (2. and 3. melléklet) reach an organization that qualifies as a medium-sized enterprise or larger under Hungary's SME Act, or that exceeds the thresholds the Act sets for one. Section 2(1)(c) separately reaches a provider of an online marketplace, online search engine or social-media service platform whose main place of business activity is in Hungary, even where the provider is established elsewhere.

When LexLint raises it

When your app profile says your app runs an essential service or operates a social platform.

Back to the example  ·  Lint your app

Page updated .