MongoliaLaw on Cyber Security, Critical Information Infrastructure Organizations' Security Duties
Law of Mongolia on Cyber Security, adopted , in force , Art. 19 (security duties)
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an organization with critical information infrastructure, meaning an organization of a kind article 19.1 lists, such as electricity, water and heating, tier two and three health organizations, banks and financial institutions with consolidated payment, settlement and transaction systems, dominant communications and information technology operators, transport control, fuel and food, data centers and border control, whose information systems' failure could harm Mongolia's security, society and economy (reached by declaring that you operate an essential service).
- Adopt internal procedures for ensuring cyber security, introduce standards to ensure information security, and plan and implement the management, organizational and technical measures needed to secure your information systems and networks (articles 19.2.1, 19.2.3 and 19.2.7).
- Have an officer or unit on staff in charge of ensuring cyber security (article 19.2.4).
- Have a cyber security risk assessment conducted every year, and a full or partial one when your information systems or networks are modified, and take measures on its conclusions, recommendations and requirements (article 19.2.5).
- Have an information security audit conducted every two years, and submit each risk assessment and audit report to the relevant center against cyber-attacks and violations within one month of receipt (articles 19.2.6 and 19.2.10).
- Have an information system for the detection, registration and termination of cyber-attacks and violations, and store the information system action log for the period the common procedure for ensuring cyber security sets (articles 19.2.8 and 19.2.9).
- Adopt and implement an action plan for cyber-attacks and violations, and a plan that keeps your information system and infrastructure running without interruption and restores them after damage (articles 19.2.2 and 19.2.13).
- Comply with the requirements the relevant authorities issue, and take measures to eliminate the violations and errors they detect (article 19.2.11).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 24.2 makes a violator, individual or legal person, liable under the Criminal Law or the Law on Violations; the Law's own text states neither a specific offense nor a maximum penalty for these duties.
Who enforces it
Enforcement body
The National center against cyber-attacks and violations, under the structure of the intelligence agency, handles attacks on the information systems of state-owned legal persons with critical information infrastructure (Art. 21.2.2); the Public center, under the state central administrative organization in charge of digital development and communications, handles attacks on other legal persons (Art. 22.2.1). Liability for a violation runs through the authorities administering the Criminal Law and the Law on Violations under Article 24.2.
Settledness
- As of
- Open questions
- Has the Government adopted the common procedure on ensuring cyber security that the audit, risk assessment and log-retention duties of article 19.2 refer to?
- Which organizations has the Government identified as organizations with critical information infrastructure under the article 19.1 categories?
What this law does
Article 4.1.12 of the Law on Cyber Security defines an organization with critical information infrastructure as an organization with an information system or information network whose cyber security failure could cause failure of its operations and harm the security, society and economy of Mongolia.
Article 19.1 lists the kinds of business that are organizations with critical information infrastructure, among them banks and financial institutions with consolidated digital systems for payment, settlement and transactions. Article 19.2.4 requires such an organization to have an officer or unit on staff in charge of ensuring cyber security.
Article 19.2.5 requires it to have a cyber security risk assessment conducted every year, and article 19.2.6 requires an information security audit every two years. Article 19.2.10 requires it to submit the risk assessment and audit reports to the relevant center against cyber-attacks and violations within one month of receipt. Article 19.2.8 requires it to have an information system for the detection, registration and termination of cyber-attacks and violations. Article 24.2 makes a violator of the Law liable under the Criminal Law or the Law on Violations.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.