MongoliaLaw on Cyber Security, Critical Information Infrastructure Organizations' Duty to Notify Cyber-Attacks and Failures
Law of Mongolia on Cyber Security, adopted , in force , Art. 19 (notification duties)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds an organization with critical information infrastructure, meaning an organization of a kind article 19.1 lists, such as electricity, water and heating, tier two and three health organizations, banks and financial institutions with consolidated payment, settlement and transaction systems, dominant communications and information technology operators, transport control, fuel and food, data centers and border control, whose information systems' failure could harm Mongolia's security, society and economy (reached by declaring that you operate an essential service).
- Notify the relevant center against cyber-attacks and violations immediately when the normal, uninterrupted operation of your information systems and infrastructure fails because of cyber-attacks and violations (article 19.2.14).
- Notify the relevant center and your users immediately when the normal, uninterrupted operation of your infrastructure fails because of planned inspections and audits, damage, or force majeure events and circumstances affecting networks and systems outside your own infrastructure (article 19.2.15).
- Submit each cyber security risk assessment report and information security audit report to the relevant center against cyber-attacks and violations within one month of receiving it (article 19.2.10).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 24.2 makes a violator, individual or legal person, liable under the Criminal Law or the Law on Violations; the Law's own text states neither a specific offense nor a maximum penalty for these duties.
Who enforces it
Enforcement body
The National center against cyber-attacks and violations, under the structure of the intelligence agency, handles attacks on the information systems of state-owned legal persons with critical information infrastructure (Art. 21.2.2); the Public center, under the state central administrative organization in charge of digital development and communications, handles attacks on other legal persons (Art. 22.2.1). Liability for a violation runs through the authorities administering the Criminal Law and the Law on Violations under Article 24.2.
Settledness
- As of
- Open questions
- Does the Government's common procedure on ensuring cyber security set a format or channel for the article 19.2.14 notification?
What this law does
Article 19.2.14 of the Law on Cyber Security requires an organization with critical information infrastructure to notify the relevant center against cyber-attacks and violations immediately of a failure of the normal, uninterrupted operation of its information systems and infrastructure due to cyber-attacks and violations.
Article 19.2.15 requires it to notify the relevant center and its users immediately of a failure of the normal, uninterrupted operation of its infrastructure due to planned inspections and audits, damage and force majeure events affecting networks and systems outside its own infrastructure. Article 19.2.10 requires it to submit its risk assessment and audit reports to the relevant center within one month of receipt.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.