SloveniaZEKom-2, Operator Security Measures (Articles 115 and 116)
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- If you are an operator under the Zakon o elektronskih komunikacijah (ZEKom-2), establish and maintain a documented information security management system (SUVI) and continuity management system (SUNP) in line with the information security law, and take appropriate, effective and proportionate technical, operational and organizational measures to protect the integrity, authenticity, confidentiality and availability of your network and information systems and to limit the effect of incidents on your customers (Article 115(1)).NIST CSF 2.0GV.PO-01NIST CSF 2.0PR.IR-03
- Treat the SUVI and SUNP as a business secret, review the emergency-communication part of the SUNP at least once a year, and obtain the prior approval of the competent bodies before adopting or changing it (Article 115(2) and (3)).NIST CSF 2.0ID.IM-04
- If you operate a mobile communications network that you supply to critical infrastructure operators, essential service providers, government bodies or holders of key parts of the state security system, also observe the additional security requirements and restrictions of Article 116.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS), the agency that issues the general act under Article 115(4); the competent national authority for information security assists it with security audits (Article 123).
Settledness
- As of
What this law does
Article 65 of the Zakon o informacijski varnosti (ZInfV-1) replaced Article 115 of the Zakon o elektronskih komunikacijah (ZEKom-2, Electronic Communications Act) so that operators' security duties run through the information security law.
Article 115(1), as replaced, requires an operator to establish and maintain a documented information security management system (SUVI) and a continuity management system (SUNP) and to take appropriate, effective and proportionate technical, operational and organizational measures to ensure the integrity, authenticity, confidentiality and availability of the network and information systems it uses and to prevent or reduce the impact of incidents on recipients of its services.
The operator must treat the SUVI and SUNP as a business secret, and must review the part of the SUNP that covers emergency communication at least once a year, with prior approval of the competent bodies for its adoption and any change. Article 115(4) has the national agency issue a general act prescribing special technical guidance and technical and organizational measures for operators where ENISA documents or Commission guidelines show that sector-specific measures are needed.
Under Article 62(3) of the ZInfV-1, an essential or important entity that is an operator adopts the risk-management measures of Articles 21 and 22 of that Act within one year of its entry into force, and until then the security measures of chapter VII of the ZEKom-2 apply. The ZInfV-1 entered into force on the fifteenth day after its publication in the Uradni list, which was , so on .
Article 116(1) of the ZEKom-2 adds further security requirements and restrictions for operators of mobile communications networks that supply those networks to critical infrastructure operators, essential service providers, government bodies or holders of key parts of the state security system.
When LexLint raises it
When your app profile says your app provides telecom services or runs an essential service.