North MacedoniaLaw on Security of Network and Information Systems, Significant Incident and Threat Notification
Law on Security of Network and Information Systems, arts. 33 and 54
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the same essential and important entities as this jurisdiction's companion row on entities covered and cyber security risk management measures (reached by declaring that you are an essential or important entity), from (article 62).
- Notify the competent computer incident response team immediately, and within three hours at the latest, from the moment you learn of a significant cyber security incident or a significant cyber threat that affects the provision of your services, with all the information that lets it establish the incident's cross-border impact (article 33(1)).
- Within 24 hours of learning of a significant cyber security incident, send the competent team an early warning that states, where appropriate, whether you suspect unlawful or malicious action or a cross-border impact (article 33(3), point 1).
- Within 72 hours of learning of a significant cyber security incident, send the competent team an incident notification that updates the early warning and gives your initial assessment of the incident's severity and impact and, where available, indicators of compromise (article 33(3), point 2).
- On the competent team's request, send an interim report on the status of the incident, and within one month of the incident notification send a final report that describes the incident, its severity and impact, the type of threat or root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing at that point, send a progress report then and a final report within one month of its resolution (article 33(3), points 3 to 5).
- Where possible, inform the recipients of your services who may be affected by a serious cyber threat, immediately and by the next working day at the latest, of the measures or remedies they can take in response (article 33(2)).
- If you are a trust service provider, notify the competent team without undue delay and within 24 hours of learning of a significant cyber security incident that affects your trust services (article 33(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Articles 54 and 55 sit in Chapter VIII, the Law's misdemeanour provisions, and set fines for a failure to report.
Penalty structure
Article 54(1) fines an essential entity up to 2% of its total annual revenue in the previous business year, unless a special law prescribes a higher fine, and article 54(2) fines an important entity up to 1.4% of that revenue, for failing to notify the competent team of a significant cyber security incident under article 33(1) and (4).
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Ministry of Digital Transformation for the public-sector bodies in article 4(1) points 3 to 7 and 9; the Agency for Electronic Communications, through the National Center for Computer Incident Response (MKD-CIRT), for the other public-sector bodies and for the entities in article 4(2) and (3) (article 11(1)).
Settledness
- As of
- Open questions
- How does the three-hour notification of article 33(1) relate to the 24-hour early warning of article 33(3), point 1, and which competent team (MKD-GOV_CSIRT, MKD-CIRT or a sectoral team) receives the notice for each class of entity?
What this law does
Article 33(1) obliges essential and important entities to notify the competent computer incident response team immediately, and within three hours at the latest, of learning of a significant cyber security incident or significant cyber threat. Article 33(3) point 1 requires an early warning to the competent team within 24 hours of learning of a significant cyber security incident.
Article 33(3) point 2 requires an incident notification to the competent team within 72 hours of learning of a significant cyber security incident. Article 33(3) point 4 requires a final report to the competent team within one month of the incident notification. Article 33(4) requires a trust service provider to notify the competent team within 24 hours of learning of a significant cyber security incident that affects its trust services.
Article 33(2) requires entities, where possible, to inform the recipients of their services who may be affected by a serious cyber threat by the next working day at the latest. Article 54(1) fines an essential entity up to 2% of its total annual revenue for failing to notify the competent team of a significant cyber security incident.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, provides telecom services, is a bank or is a securities firm.