MontenegroLaw on Information Security, Cyber Threat and Incident Reporting
Law on Information Security, Arts. 28 to 37
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
What it requires
- This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).
- Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).NIST CSF 2.0RS.CO-02
- Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).NIST CSF 2.0RS.CO-02
- For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).NIST CSF 2.0RS.CO-03
- For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text. Also read by: Agencija za sajber bezbjednost Crne Gore (Cybersecurity Agency of Montenegro) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 70 frames a reporting-clock violation as an administrative misdemeanor (“prekršaj”) carrying only the fine the Article sets, and creates no separate criminal offence.
Penalty structure
Article 70(1) items 5 to 15 fine the legal entity 500 to 5,000 EUR, the same range as this jurisdiction's general security-measures row, for missing the monthly report, the 24-hour initial notification, or any of the medium- or high-incident follow-up, continuing or final report clocks; the responsible individual within that entity is fined a further 30 to 1,500 EUR for the same violation, and a repeat violation can add a 3-to-6-month suspension of the entity's professional activity. This range applies regardless of essential or important entity designation, because Chapter IV's reporting duties are not gated by it.
- Rule
- Fixed only
- As of
- Minimum
- 500
- Currency
- EUR
- Fixed cap
- 5,000
Who enforces it
Enforcement body
The Cybersecurity Agency of Montenegro (Agencija za sajber bezbjednost) for every organ or other entity outside the state administration (Article 6); the CIRT of the state administration, within the Ministry of Public Administration, Digital Society and Media, for a state administration body (Article 5).
Settledness
- As of
- Guidance link
- https://www.gov.me/en/asb
- Guidance body
- Agencija za sajber bezbjednost Crne Gore (Cybersecurity Agency of Montenegro)
- Open questions
- Article 30 counts the 24-hour initial-notification clock from the moment an organ or other entity becomes aware of a cyber threat or incident, so does an entity that first learns of an incident from a downstream customer's report satisfy that clock by notifying within 24 hours of the customer's report rather than of the incident's own occurrence?
What this law does
Article 28 requires every organ and other entity to assess the impact of a cyber threat or incident on the continuity of the services it provides, by the number of users affected, the duration, and the geographic reach. Article 29 requires an assessment of no impact to be reported once a month to the Cybersecurity Agency, or to the Government CIRT for a state administration body.
Article 30 requires an assessment of possible significant impact to be reported within 24 hours of becoming aware of it, on a prescribed form; the Agency or CIRT then rates the incident low, medium or high under Article 31.
A medium-rated incident carries a 72-hour first report, further reports without delay on any new development, continuing reports every 72 hours while it lasts, and a final report within 30 days of resolution (Article 33); a high-rated incident carries the same sequence on continuing reports every 24 hours instead (Article 34), and a high-rated incident the Agency and CIRT cannot resolve within ten days can be escalated to a Government-declared cyber crisis under Article 35.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .