Marshall IslandsCybersecurity Act 2025, Cybersecurity Incident Reporting Obligations
Cybersecurity Act 2025, 40 MIRC Ch. 4 § 407 (P.L. 2025-0027)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.rmiparliament.org/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0027/2025-0027_1.pdfIn force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
What it requires
- Binds the same designated owner of critical information infrastructure as the risk-management duty above (sections 405 and 406).
- Immediately notify the Director and the computer security incident response team (CSIRT)-MH (the Cyber Security Incident Response Team of the Marshall Islands) of a significant cybersecurity incident affecting your critical information infrastructure, of a significant incident on any interconnected computer system under your control, or of any other incident type the Director specifies by written order.NIST CSF 2.0RS.CO-02
- Submit an early warning within twenty-four hours of becoming aware of the incident, a fuller notification with an initial severity and impact assessment within seventy-two hours, and a final report within thirty days of that notification, or, for an ongoing incident, a progress report within thirty days of that notification followed by a final report within thirty days of the handling of the incident.
- Establish mechanisms and processes to promptly detect a cybersecurity threat, vulnerability, or incident affecting your critical information infrastructure.NIST CSF 2.0DE.CM-09
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 407(4) makes intentionally and without reasonable excuse failing to make a required notification a petty misdemeanor. Section 420 separately allows a corporation to be convicted of an offense under this Act under the Criminal Code's corporate-liability provision (section 2.07(1)), and section 422's general non-compliance schedule attaches a fine, and for an individual potential imprisonment, to a violation of any obligation under the Act.
Penalty structure
Section 422's general non-compliance penalty for failing to comply with any obligation this Act imposes: an individual faces a fine not exceeding $10,000, imprisonment not exceeding two years, or both, and a corporation faces a fine not exceeding $100,000, or suspension or revocation of its cybersecurity accreditations where applicable. Sections 406(9) and 407(4) separately classify a violation of the risk-management or reporting duty itself as a petty misdemeanor; whether that classification carries a penalty distinct from section 422's schedule, or section 422 supplies the penalty for the offense each section creates, was not resolved in the text located.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Director of National Security (Office of National Security) and the CSIRT-MH (Cyber Security Incident Response Team of the Marshall Islands), which the Director establishes and which receives and coordinates the response to a reported incident.
Settledness
- As of
- Open questions
- Has the Director of National Security issued the initial critical-information-infrastructure designation order required by section 419, so that any owner is yet bound to file the twenty-four-hour early warning or seventy-two-hour notification section 407 requires?
- Do sections 406(9) and 407(4)'s own petty-misdemeanor classification carry a penalty distinct from section 422's general non-compliance fine schedule, or does section 422 supply the penalty for the offense each section creates?
What this law does
Section 407 requires the same designated owner of critical information infrastructure to immediately notify the Director of the Office of National Security and the computer security incident response team (CSIRT)-MH of a significant cybersecurity incident affecting the critical information infrastructure, of a significant incident on any interconnected computer system under the owner's control, or of any other incident type the Director specifies by written order.
To comply, the owner must submit an early warning within twenty-four hours of becoming aware of the incident, a fuller notification with an initial severity and impact assessment within seventy-two hours, and a final report within thirty days of that notification, or, for an ongoing incident, a thirty-day progress report followed by a final report within thirty days of the incident's resolution.
The owner must also establish mechanisms and processes to promptly detect a cybersecurity threat, vulnerability, or incident affecting the critical information infrastructure. A person who intentionally and without reasonable excuse fails to make a notification under this section commits a petty misdemeanor.
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .