KyrgyzstanDigital Code, digital resilience baseline security measures
Digital Code, Law No. 178, Art. 63(1)-(4)
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds any subject of a digital-environment legal relationship whose record, resource, service, or technological system reaches a user in Kyrgyzstan, with no exemption for size or sector.
- Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.NIST CSF 2.0PR.IR-03NIST CSF 2.0GV.RR-03
- If you operate critical information infrastructure, Kyrgyzstan's separate cybersecurity legislation, not analyzed in this instrument, sets the specific procedure you must follow for these measures and for incident monitoring and data exchange.
- Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-03Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
- PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Sectoral regulators, each within its own jurisdiction over the participant's sector (Art. 63(4)); the Digital Code names no single authority for the general Art. 63(1)-(2) duty, and no penalty specific to it is stated in the primary text.
Settledness
- As of
- Open questions
- What is the citation of the separate cybersecurity legislation Art. 63(3) defers to for the detailed procedure governing critical information infrastructure, and has it been enacted?
- Does the National Bank of the Kyrgyz Republic administer its own binding cybersecurity or IT-risk directive for a licensed financial institution under Art. 63(4)'s sectoral-regulator mechanism?
What this law does
Article 63(1) states that state regulation of digital resilience exists to ensure the continuity of operation of the subjects and objects of the digital environment and their recovery after an incident there, expressly recognizing the practical impossibility of fully protecting against one.
Article 63(2) requires every subject of a digital-environment legal relationship to achieve digital resilience by ensuring the integrity and availability of the objects of that relationship and the confidentiality of the digital data it processes. The same provision also requires monitoring for and helping prevent incidents in the digital environment and exchanging data about them, managing risk under a risk-management system, and managing the resources continuity of operation requires.
Article 63(3) reserves the specific procedure for integrity, availability, and confidentiality measures over critical information infrastructure, and for monitoring and exchanging data about incidents affecting it, to Kyrgyzstan's cybersecurity legislation, a body of law not described here. Article 63(4) lets a sectoral regulator direct measures a digital-environment participant must implement to prevent an incident or reduce its negative consequences, and binds the participant to follow them.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .