KyrgyzstanLaw on Cybersecurity, duties of critical information infrastructure subjects
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a subject of critical information infrastructure, meaning a state body, local self-government body, or an enterprise, organization or institution that holds a critical information infrastructure object, in public administration and state e-services, health, science, transport, telecommunications, the credit-financial sphere, defense, electricity, fuel, food or mining (Article 8); the National Bank sets the points that name it for a subject it supervises.
- Take the necessary measures to ensure the cybersecurity of your critical information infrastructure objects and meet the cybersecurity requirements the Cabinet of Ministers sets for them by category of significance (Articles 10(2) and 12).
- Carry out the instructions and measures of the authorized state body in the cybersecurity sphere, or of the National Bank if it supervises you (Article 10(2)).
- Arrange a cybersecurity audit of your entity, and send the audit results for your critical information infrastructure objects to the authorized state body, or to the National Bank if it supervises you (Articles 10(2) and 15(1)).
- Your head and the staff responsible for cybersecurity answer for the security of the objects, for immediate informing about cyber incidents and for arranging the audit (Article 8(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Committee for National Security, which the Government has designated as the authorized state body in the sphere of ensuring cybersecurity.
Settledness
- As of
What this law does
The Law was published in the newspaper Erkin Too on . The Law enters into force fifteen days after its official publication. Critical information infrastructure is the set of objects operating in public administration and state e-services, health, science, transport, telecommunications, the credit-financial sphere, defense, electricity, fuel, food and mining.
A critical information infrastructure subject must take the necessary measures to ensure the cybersecurity of its objects and meet the cybersecurity requirements for them. A critical information infrastructure subject must arrange a cybersecurity audit of the subject. The results of a cybersecurity audit of critical information infrastructure objects must be sent to the authorized state body, or to the National Bank for a subject it supervises. A breach of the Law entails liability under the legislation of the Kyrgyz Republic.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.