MoldovaLaw 48/2023 on Cybersecurity: Cyber Incident Notification
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a private-law legal person that is a medium-sized enterprise or larger, provides services in a critical sector or subsector the Government sets, and is identified as a service provider by the competent authority; it also binds, whatever its size, a legal person of a type the Government sets that is a public electronic-communications network or service provider, a trust-service provider, the registrar of the .md top-level domain, a domain-name registration service, the sole national provider of an essential service, and a public-law legal person (Article 3). You reach it by declaring that you operate an essential service or provide telecom services.
- Notify the competent authority without undue delay, and no later than 24 hours after you become aware, of any cyber incident with a significant impact on the security of your network or system or on the continuity of your service, and of one whose significant impact is not evident but can reasonably be presumed (Article 12(1)(a) and (b)).
- Notify the competent authority within the same 24 hours of the significant impact on your own service of a cyber incident that affected a third party your service depends on (Article 12(1)(c)).
- Submit to the competent authority, no later than 72 hours after you become aware of the incident, an update of the information already sent and an initial assessment of the incident, including its severity, its impact and indicators of compromise where available (Article 12(3)).
- Inform the users of your services who may be affected by a significant cyber threat, without undue delay and no later than 24 hours after you become aware of it, of the measures they can take, and inform the general public if you cannot identify and notify them individually (Article 12(6)).
- Send the competent authority a final report within one month after the updated information, covering at least the causes of the incident, how long it took to resolve, the measures applied and its impact (Article 12(8)).
- If a third party administers or hosts your network or system, make sure that it informs you within these time limits or informs the competent authority at the same time (Article 12(4)).
- A public-law legal person notifies the government cyber incident response center of the incident, which informs the competent authority (Article 12(11)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 21 refers the liability of the staff of the competent authority, of public authorities and of service providers for failing to perform their duties to the general legislation, and the Law states no offense or penalty amount of its own.
Who enforces it
Enforcement body
The competent authority the Government designates under Article 7(1), which supervises and controls service providers' compliance with the Law (Article 7(3)(e)).
Settledness
- As of
- Open questions
- What notification procedure, impact test and report formats has the Government approved under Article 12(9), and do they change the 24-hour, 72-hour and one-month steps?
What this law does
Article 12(1) requires a service provider to inform the competent authority, without undue delay and no later than 24 hours after becoming aware, of a cyber incident with a significant impact on network or system security or on service continuity, of an incident whose significant impact is not evident but can reasonably be presumed, and of the significant impact on its service of an incident that affected a third party it depends on.
Article 12(3) requires an update and an initial assessment of the incident within 72 hours of becoming aware. Article 12(8) requires a final report within one month after the updated information is sent. Article 12(6) requires a service provider to inform the users who may be affected by a significant cyber threat, within 24 hours of becoming aware, of the measures they can take, and to inform the general public where it cannot notify them individually.
Article 12(5) sets the conditions under which an incident counts as having a significant impact. Article 13 lets any legal person not identified as a service provider, and any natural person, notify the competent authority voluntarily of significant incidents, cyber threats and near misses.
When LexLint raises it
When your app profile says your app runs an essential service or provides telecom services.