MoldovaLaw 48/2023 on Cybersecurity: Service Provider Security Measures
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a private-law legal person that is a medium-sized enterprise or larger, provides services in a critical sector or subsector the Government sets, and is identified as a service provider by the competent authority; it also binds, whatever its size, a legal person of a type the Government sets that is a public electronic-communications network or service provider, a trust-service provider, the registrar of the .md top-level domain, a domain-name registration service, the sole national provider of an essential service, and a public-law legal person (Article 3). You reach it by declaring that you operate an essential service or provide telecom services.
- Apply security measures continuously to prevent and resolve cyber incidents, and to prevent and limit their effect on service continuity and on the security of your networks and information systems (Article 11(1)).
- Assess the vulnerabilities and security risks of your networks and information systems, determine the severity of a possible incident's impact, describe the measures to resolve an incident, and write an assessment report (Article 11(2)(1)).
- Implement technical and organizational measures proportionate to the risks and in line with the standards the Government approves, including at least policies on risk analysis and network security, incident handling, cryptography and encryption, measures of business continuity and crisis management, security in acquiring, developing and maintaining systems including vulnerability disclosure and handling, human-resources and access control, supply-chain security, basic cyber hygiene and training, and secure authentication and communications (Article 11(2)(2)).
- Keep your security documentation current, monitor the security of your networks and information systems, take steps to reduce the impact and spread of incidents, and verify that your security measures are complete and compliant, including through security audits whose results you document (Article 11(2)(3) to (6)).
- Stay responsible for applying these security measures when you authorize a third party to administer your network or system or use a third party to host it (Article 11(3)).
- Give the competent authority the access to information, property and premises it needs for a state control, which it carries out under Law 131/2012 on a reasoned act and with prior notice to you (Article 19(1) to (3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 21 refers the liability of the staff of the competent authority, of public authorities and of service providers for failing to perform their duties to the general legislation, and the Law states no offense or penalty amount of its own.
Who enforces it
Enforcement body
The competent authority the Government designates under Article 7(1), which supervises and controls service providers' compliance with the Law (Article 7(3)(e)).
Settledness
- As of
- Open questions
- Which legal entities has the competent authority identified as service providers, and which sectors and subsectors has the Government set as critical, given that Article 3(1) reaches a private-law provider only once it is identified?
- Have the sector-specific security requirements that Article 11(4)(b) assigns to the Government been approved, and what do they require of each category of service provider?
What this law does
Article 3(1) applies the Law to private-law legal persons that are medium-sized enterprises or larger, provide services in a critical sector or subsector the Government sets, and are identified as service providers by the competent authority.
Article 3(2) applies the Law, whatever the size of the entity, to a legal person of a type the Government sets that is a public electronic-communications network or service provider, a trust-service provider, the registrar of the .md top-level domain, a domain-name registration service, the sole national provider of an essential service, or a public-law legal person.
Article 11(1) obliges a service provider to apply security measures continuously to prevent and resolve cyber incidents and to limit their effect on service continuity and on network and system security. Article 11(2)(1) obliges it to assess the vulnerabilities and security risks of its networks and information systems and to write an assessment report.
Article 11(2)(6) obliges it to verify that its security measures are complete and compliant, including through security audits, and to document the results. Article 14 applies the measures of Article 11(1) to (3) and the notification duties of Article 12 to public-law legal persons. Article 19 provides for state control over private-law service providers under Law 131/2012. Article 23 sets the Law in force on .
When LexLint raises it
When your app profile says your app runs an essential service or provides telecom services.