LiechtensteinCyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities
Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 1, 3, 4, 5
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential or important entity under Article 1 and Annexes 1 and 2, which name an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider (Annex 2 Item 6) among the digital-service providers it reaches expressly, generally at the medium-or-large-company threshold of Article 1064(2) or (3) of the Personen- und Gesellschaftsrecht (Persons and Companies Act); the wider sector classes Annexes 1 and 2 also reach (critical-infrastructure operators across energy, transport, banking, health and public administration, and the digital infrastructure sector's own DNS, top-level-domain, cloud-computing, data-centre and content-delivery-network providers, which Article 3 binds regardless of size) are reached too, by declaring that you are an essential or important entity.
- Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a security incident on the recipients of your services and on other services.NIST CSF 2.0ID.RA-06
- Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and disaster recovery, and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluating your measures' effectiveness; basic cyber-hygiene procedures and training; cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, plus secured voice, video and text communication.NIST CSF 2.0GV.PO-01
- Have your leadership body (Leitungsorgan) approve and oversee these measures and attend, and offer your staff, regular training on recognising and assessing cybersecurity risk and risk-management practice.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Stabsstelle Cyber-Sicherheit (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 23(1)'s penalty for an Article 4 or Article 6 infringement is an administrative fine (Busse) for an Übertretung (contravention), imposed by the Stabsstelle Cyber-Sicherheit only where the conduct does not itself constitute a criminal offence within the courts' jurisdiction; no provision reviewed here makes an Article 4 or Article 6 infringement itself a criminal offence.
Penalty structure
Article 23(2)(a) sets the fine for an essential entity's infringement, including a Article 4 or Article 6 infringement, at up to CHF 10,000,000 or up to 2 percent of the total worldwide turnover made in the preceding financial year by the undertaking to which the essential entity belongs, whichever amount is higher, mirroring NIS2 Article 34(4). Article 23(2)(b) sets an important entity's fine at up to CHF 7,000,000 or up to 1.4 percent of that turnover, whichever amount is higher, mirroring NIS2 Article 34(5).
- Rule
- Higher of
- As of
- Currency
- CHF
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Stabsstelle Cyber-Sicherheit (Cyber Security Office), Liechtenstein's competent authority under the Cyber-Sicherheitsgesetz, which reviews compliance with Article 4's risk-management measures and Article 6's reporting duties and hosts Liechtenstein's CSIRT.
Settledness
- As of
- Guidance link
- https://scs.llv.li
- Guidance body
- Stabsstelle Cyber-Sicherheit
- Open questions
- Has the EEA Joint Committee adopted the decision incorporating Directive (EU) 2022/2555 into the EEA Agreement, which Article 29(2) of the Cyber-Sicherheitsgesetz makes the trigger for Article 2(1)(a)'s own entry into force?
What this law does
Article 1 binds a public or private entity listed in Annex 1 or Annex 2 that qualifies as a medium or large company under Article 1064(2) or (3) of the Personen- und Gesellschaftsrecht (Persons and Companies Act) and provides its services or carries out its activities in Liechtenstein.
Article 4 requires such an essential or important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses for its operations or to provide its services, and to prevent or minimise the impact of a security incident on the recipients of its services and on other services.
These measures must cover at least ten baseline categories mirroring NIS2 Article 21: risk analysis and information-system-security policy, incident handling, business continuity (including backup management and disaster recovery) and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems including vulnerability management and disclosure, evaluating the measures' effectiveness, basic cyber-hygiene procedures and training, cryptography and encryption, personnel security and access control, and multi-factor or continuous authentication.
Article 5 requires the entity's leadership body (Leitungsorgan) to approve and oversee those measures and to attend, and offer its staff, regular training on recognising and assessing cybersecurity risk. Annex 2 Item 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider among the digital-service providers this duty reaches expressly.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .