LexLint.ioBeta

Know the law your code answers to.

Law / Montenegro

Law on Information Security, General Security Measures

Law on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3)

In force since .

A security baseline statutes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • This binds you if you access or process data, or use and manage a network and information system, in Montenegro, whether you are a business, another legal entity or a natural person, and regardless of your sector or size (Article 2).
  • Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).NIST CSF 2.0GV.PO-01NIST CSF 2.0PR.PS-04
  • Physically secure the premises, spaces and devices that house your network and information system (Article 14).NIST CSF 2.0PR.AA-06
  • Protect the confidentiality, integrity and availability of the data you process, store or transmit through the planning, design, construction, use, maintenance and decommissioning of that system (Article 15).NIST CSF 2.0PR.DS-01
  • Designate an employee to monitor your compliance with these measures (Article 18(3)).NIST CSF 2.0GV.RR-02

These lines are LexLint's reading of the law's text. Also read by: Ministarstvo javne uprave, digitalnog društva i medija (Ministry of Public Administration, Digital Society and Media) (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
  • PR.AC-P2Physical access to data and devices is managed.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • PR.AA-06Physical access to assets is managed, monitored, and enforced commensurate with risk
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
  • PR.PS-04Log records are generated and made available for continuous monitoring
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
7 more
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.1Risk management framework
  • 2.2Compliance monitoring
  • 3.1Incident handling policy
  • 3.2Monitoring and logging
7 more
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
  • 9.1Cryptography
  • 11.2Management of access rights
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 70 frames a violation as an administrative misdemeanor (“prekršaj”) carrying only the fine the Article sets, and creates no separate criminal offence. Montenegro's Criminal Code Article 353 (unauthorised use of a computer or computer network) is a distinct offence against a system committed by an intruder, already filed on this jurisdiction's scraping-topic row.

Penalty structure

Article 70(1) fines the legal entity 500 to 5,000 EUR for failing to apply the Article 11 to 15 measures or to designate a compliance-monitoring employee, and Article 70(1) fines the responsible individual within that entity 30 to 1,500 EUR for the same violation; a repeat violation can add a 3-to-6-month suspension of the entity's professional activity. An entity the Government has designated essential or important instead faces the higher fine tier this jurisdiction's companion row on essential and important entities describes (Articles 68 and 69).

Rule
Fixed only
As of
Minimum
500
Currency
EUR
Fixed cap
5,000

Who enforces it

Enforcement body

The Cybersecurity Agency of Montenegro (Agencija za sajber bezbjednost) for every organ or other entity outside the state administration (Article 6); the Ministry of Public Administration, Digital Society and Media, through an inspector for information society services, for a state administration body (Articles 64 to 67).

Settledness

As of
Guidance link
https://www.gov.me/en/mju
Guidance body
Ministarstvo javne uprave, digitalnog društva i medija (Ministry of Public Administration, Digital Society and Media)
Open questions
Does Article 18(3)'s duty to designate an employee to monitor compliance with these measures apply to a sole proprietor who falls within Article 2's scope but has no employee to designate?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 2 binds every state organ, ministry, local self-government body, legal entity exercising public authority, business company, other legal entity and natural person that accesses or processes data, or uses and manages a network and information system, in Montenegro.

Article 18(2) requires every such organ or entity that the Government has not designated an essential or important entity to apply the data-protection measures of Article 12 (rules for handling data, access logging, and security oversight), the physical-protection measures of Article 14, and the network-and-information-system-protection measures of Article 15 (protecting the confidentiality, integrity and availability of data through the planning, design, construction, use, maintenance and decommissioning of that system), and Article 18(3) requires every organ or entity, designated or not, to name an employee to monitor its own compliance with these measures.

An essential or important entity carries the same Article 12, 14 and 15 duties as part of the wider Article 11 to 16 measures this jurisdiction's companion row on essential and important entities describes.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .