MongoliaLaw on Cyber Security, Cyber-Attack Notification Duty for Other Legal Persons
Law of Mongolia on Cyber Security, adopted , in force , Art. 17.3
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds every legal person other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this profile records in the jurisdiction summary rather than flags on a declared activity; Article 3.2 extends this duty to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks.
- Abide by the Government's common procedure for ensuring, preventing, detecting and countering cyber-attacks once the Government adopts it under Article 7.1.NIST CSF 2.0GV.OC-03
- On a cyber-attack or violation against your systems, notify the relevant center against cyber-attacks and violations, the Public center for a legal person outside the state information network and outside critical information infrastructure, and obtain assistance where necessary; the text states no numeric clock for this notice.NIST CSF 2.0RS.CO-02
- Comply with the recommendations and requirements the relevant authorities issue to you in relation to ensuring cyber security.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 24.2 makes a violator, individual or legal person, liable under the Criminal Law or the Law on Violations; this Law's own text states neither a specific offense nor a maximum penalty for the Article 17.3 duty, and the Criminal Law and the Law on Violations are not described here to identify one. Mongolia's Criminal Code computer-crime provisions (Chapter 25/26) are already this jurisdiction's scraping row rather than restated here.
Who enforces it
Enforcement body
The Public center against cyber-attacks and violations, operating under the state central administrative organization in charge of digital development and communications, receives the Article 17.3 notification for a legal person outside the state information network and critical infrastructure (Arts. 22.1, 22.2.1); liability for a violation runs through the authorities administering the Criminal Law and the Law on Violations under Article 24.2.
Settledness
- As of
- Open questions
- Has the Government adopted the common procedure Article 7.1 requires for ensuring, preventing, detecting and responding to cyber-attacks, and if not, does the Article 17.3.1 duty to abide by it have any operative content yet?
What this law does
Article 17.3 binds every legal person in Mongolia other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this jurisdiction's summary records rather than flags here.
That legal person must abide by the Government's common procedure for ensuring cyber security once adopted, notify the relevant center against cyber-attacks and violations of a cyber-attack or violation against it and obtain assistance where necessary, and comply with the recommendations and requirements the relevant authorities issue.
The Law extends this duty, like the rest of the Law, to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks unless the Law states otherwise. The Public center, which receives this notification for a legal person outside the state information network and critical infrastructure, operates under the state central administrative organization in charge of digital development and communications.
The text sets no numeric clock for this notice, unlike the immediate-notification duty Articles 16.1.3, 17.1.2 and 19.2.14 place on a state-owned legal person, an information-technology-service legal person, and a critical-information-infrastructure operator. A violator faces liability under the Criminal Law or the Law on Violations, on Article 24.2's own cross-reference; the Law's own text names neither statute's specific offense or maximum penalty.
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, distributes a software product, handles health records, makes high-risk automated decisions, is a listed company, runs an essential service, operates a social platform, processes biometric data, processes personal data, processes voice recordings, provides financial services, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, serves under-18s, ships a mobile app, trains models, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .