LexLint.ioBeta

Know the law your code answers to.

Law / Liechtenstein

Cyber-Sicherheitsgesetz (CSG), Incident Notification

Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 6

In force since .

A vulnerability and incident reporting rule binding public and private bodies.

Obligation class
Reporting, Security

What it requires

  • This binds an essential or important entity under Article 1 and Annexes 1 and 2, which name an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider (Annex 2 Item 6) among the digital-service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
  • Notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating, where relevant, whether the incident is suspected to result from unlawful or malicious acts or to have cross-border effect.NIST CSF 2.0RS.CO-02
  • Follow with a full notification within 72 hours of becoming aware, updating the early warning where relevant and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.NIST CSF 2.0RS.CO-02
  • Submit an intermediate report on the Stabsstelle Cyber-Sicherheit's request, and a final report within one month of the 72-hour notification, describing the incident's severity and impact in detail, the likely threat or root cause, and the mitigation measures taken.NIST CSF 2.0RS.CO-03
  • If the incident is still ongoing when the final report falls due, submit a progress report at that point and a final report within one month of the incident being dealt with (Article 6(2)(e)).NIST CSF 2.0RS.CO-03

These lines are LexLint's reading of the law's text. Also read by: Stabsstelle Cyber-Sicherheit (guidance, recorded ).

In the frameworks

NIST CSF 2.0
  • RS.CO-02Internal and external stakeholders are notified of incidents
  • RS.CO-03Information is shared with designated internal and external stakeholders
CIS Controls
  • 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
FINOS AIGF
ENISA NIS2 guidance
  • 3.1Incident handling policy
  • 3.4Event assessment and classification
  • 3.5Incident response
  • 3.6Post-incident reviews
  • 4.3Crisis management

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 23(1)'s penalty for an Article 4 or Article 6 infringement is an administrative fine (Busse) for an Übertretung (contravention), imposed by the Stabsstelle Cyber-Sicherheit only where the conduct does not itself constitute a criminal offence within the courts' jurisdiction; no provision reviewed here makes an Article 4 or Article 6 infringement itself a criminal offence.

Penalty structure

Article 23(2)(a) sets the fine for an essential entity's infringement, including a Article 4 or Article 6 infringement, at up to CHF 10,000,000 or up to 2 percent of the total worldwide turnover made in the preceding financial year by the undertaking to which the essential entity belongs, whichever amount is higher, mirroring NIS2 Article 34(4). Article 23(2)(b) sets an important entity's fine at up to CHF 7,000,000 or up to 1.4 percent of that turnover, whichever amount is higher, mirroring NIS2 Article 34(5).

Rule
Higher of
As of
Currency
CHF
Fixed cap
10,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

Stabsstelle Cyber-Sicherheit (Cyber Security Office), Liechtenstein's competent authority under the Cyber-Sicherheitsgesetz, which reviews compliance with Article 4's risk-management measures and Article 6's reporting duties and hosts Liechtenstein's CSIRT.

Settledness

As of
Guidance link
https://scs.llv.li
Guidance body
Stabsstelle Cyber-Sicherheit

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 6 requires an essential or important entity to notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) of a significant security incident without delay.

It requires an early warning within 24 hours of becoming aware of the incident, stating where relevant whether it is suspected to result from unlawful or malicious acts or to have cross-border effect, followed by a full notification within 72 hours that updates that assessment with the incident's severity, impact and any indicators of compromise.

An intermediate report is due on the Office's request, and a final report is due within one month of the 72-hour notification, describing the incident, its cause and its mitigation in detail. Annex 2 Item 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider among the digital-service providers this duty reaches expressly.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.

Back to the example  ·  Lint your app

Page updated .