North MacedoniaLaw on Security of Network and Information Systems, Entities Covered and Cyber Security Risk Management Measures
Law on Security of Network and Information Systems, arts. 4, 8 and 31-32
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the public-sector institutions listed in article 4(1), medium and large entities in the energy, transport, banking, financial market, health, digital infrastructure and business-to-business ICT service management sectors (article 4(2), points 1 to 7), and, whatever their size, providers of public electronic communications networks or services and trust service providers (article 4(3)), that the Law classifies as essential or important entities under article 8 (reached by declaring that you are an essential or important entity). It applies from (article 62).
- Take appropriate technical, operational and organisational measures, proportionate to the risk, to manage the risks to the network and information systems through which you provide your services, covering at least risk analysis, incident handling, business continuity, supply chain security, secure acquisition, development and maintenance including vulnerability handling, assessment of the measures' effectiveness, cyber hygiene and training, cryptography, and multi-factor authentication where needed (article 32(1) and (3)).
- Have your management bodies adopt a risk assessment under the methodology of article 8(3) and repeat it at least once a year, update your cyber security risk management measures, supervise their implementation, and arrange regular training for the members of those bodies and for your employees (article 31).
- If you do not meet the article 32(3) measures, take all necessary, appropriate and proportionate corrective action immediately and within 30 days at the latest (article 32(7)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Articles 54 and 55 sit in Chapter VIII, the Law's misdemeanour provisions, and set fines for a breach of the security measures.
Penalty structure
Article 54(1) fines an essential entity up to 2% of its total annual revenue in the previous business year, unless a special law prescribes a higher fine, and article 54(2) fines an important entity up to 1.4% of that revenue, for failing to take the article 32(1) and (3) measures.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Ministry of Digital Transformation for the public-sector bodies in article 4(1) points 3 to 7 and 9; the Agency for Electronic Communications, through the National Center for Computer Incident Response (MKD-CIRT), for the other public-sector bodies and for the entities in article 4(2) and (3) (article 11(1)).
Settledness
- As of
- Open questions
- Has the Government adopted the detailed lists of essential and important entities that article 7(1) requires, and the technical and methodological requirements for the article 32 measures that article 32(5) and (6) assign to MKD-GOV_CSIRT and MKD-CIRT?
What this law does
Article 4(2) applies the Law to medium and large entities that provide services in energy, transport, banking, the financial market, health, digital infrastructure and the management of ICT services. Article 4(3) applies the Law to all legal persons seated in the Republic that provide public electronic communications networks or services or trust services, whatever their size. Article 5(2) excludes the National Bank of the Republic of North Macedonia from the Law.
Article 61(2) defers the Law's application to the areas in points 8 to 16 of article 4(2) until North Macedonia accedes to the European Union. Article 62 provides that the Law enters into force on the eighth day after publication in the Official Gazette and applies from . Article 32(1) obliges essential and important entities to take appropriate technical, operational and organisational measures proportionate to the risk.
Article 32(7) requires an entity that does not meet the article 32(3) measures to take corrective action immediately and within 30 days at the latest. Article 54(1) fines an essential entity up to 2% of its total annual revenue for failing to take the article 32 measures, unless a special law prescribes a higher fine.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, provides telecom services, is a bank or is a securities firm.