KyrgyzstanLaw on Cybersecurity, informing of cyber incidents
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a subject of critical information infrastructure, meaning a state body, local self-government body, or an enterprise, organization or institution that holds a critical information infrastructure object, in public administration and state e-services, health, science, transport, telecommunications, the credit-financial sphere, defense, electricity, fuel, food or mining (Article 8); the National Bank sets the points that name it for a subject it supervises.
- Inform the authorized state body in the cybersecurity sphere of cyber incidents affecting your critical information infrastructure, or the National Bank if it supervises you (Article 10(2)(3)); the Law states no hour count, and your head and the staff responsible for cybersecurity answer for informing immediately (Article 8(5)).
- If you are a state body, local self-government body or an enterprise, organization or institution with state participation using information infrastructure objects, provide for timely detection of unauthorized access to information and for immediately informing the authorized state body, and pass on the known data on cyber threats and cyberattacks (Article 17).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Committee for National Security, which the Government has designated as the authorized state body in the sphere of ensuring cybersecurity.
Settledness
- As of
What this law does
The Law defines a cyber incident as an event that breaches or stops the functioning of an information infrastructure object or breaches the security of the information it processes, including one caused by a cyberattack. Critical information infrastructure subjects must inform the authorized cybersecurity body of cyber incidents, or the National Bank where the subject is supervised by it.
Responsibility for immediate informing about cyber incidents rests with the heads of critical information infrastructure subjects and the staff responsible for cybersecurity. State bodies, local self-government bodies and enterprises with state participation must provide for the timely detection of unauthorized access to information and for immediately informing the authorized body.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.