LexLint.ioBeta

Know the law your code answers to.

Law / Kazakhstan

Digital Code, general cybersecurity duty on digital-object owners and holders

Digital Code No. 255-VIII (), Arts. 20, 97-98

In force since .

A security baseline statutes rule binding public and private bodies.

Obligation class
Security

What it requires

  • Protect the confidentiality, integrity and availability of every digital object you own or hold in Kazakhstan, a category that expressly includes software you make available to others.NIST CSF 2.0PR.DS-01
  • Implement technical measures, including cryptographic protection where applicable, together with organizational and legal measures, aimed at preventing, detecting and eliminating cyber threats to that digital object.NIST CSF 2.0ID.RA-06
  • Also follow the specific requirements set by the Law of the Republic of Kazakhstan "On Cybersecurity" and the unified digitalization and cybersecurity requirements adopted under it; their own specific duties are not further detailed here.NIST CSF 2.0GV.OC-03

These lines are LexLint's reading of the law's text.

In the frameworks

NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
CIS Controls
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
FINOS AIGF
1 more
ENISA NIS2 guidance
  • 2.1Risk management framework
  • 3.1Incident handling policy
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
2 more
  • 9.1Cryptography
  • 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

Enforcement body

The authorized body in the sphere of ensuring cybersecurity, an office the Digital Code names by function rather than by institutional name.

Settledness

As of
Open questions
What specific incident-reporting clock, threshold and audit cycle does the Law of the Republic of Kazakhstan "On Cybersecurity" set for a private digital-object holder that is not designated critically important?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 97 defines cybersecurity as the state of protection of a digital object, a category Article 20 defines to include software, digital systems, digital platforms and objects of digital infrastructure, against a breach of its confidentiality, integrity or availability, and assigns the duty to protect a digital object to its owner or holder.

Article 98 requires that protection through a combination of technical, organizational and legal measures aimed at preventing, detecting and eliminating cyber threats, naming cryptographic protection as one of the technical means. Article 97(3) directs the specific content of these measures to the Law of the Republic of Kazakhstan "On Cybersecurity" and to unified digitalization and cybersecurity requirements adopted under it, neither of which is further described here.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .