UzbekistanLaw on Cybersecurity, duties of critical information infrastructure subjects
Law No. O'RQ-764 () "On Cybersecurity," Arts. 26-29
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a subject of critical information infrastructure, meaning a state body or organization, or a legal entity or individual entrepreneur, that holds a critical information infrastructure object by ownership, lease or another lawful basis, in fields such as public administration, defense, energy, health, the banking and finance system, transport and information and communication technology (Article 3); categorization of an object and its entry in the unified registry follow the State Security Service's rules (Articles 26-28).
- Keep the information systems of your critical information infrastructure objects running without interruption (Article 28).
- Meet the cybersecurity requirements the authorized state body, the State Security Service, sets for your critical information infrastructure objects (Article 29).
- Install and use monitoring systems that meet the technical requirements for the hardware, software and hardware-software tools used, and carry out the instructions the State Security Service gives to remove violations found (Article 28).
- Give the State Security Service access to your monitoring systems or objects so it can monitor the state of cybersecurity, and connect your objects' cybersecurity system to its monitoring and incident management system when it so decides (Articles 28 and 29).
- Have the staff responsible for the cybersecurity of the objects pass the attestation the State Security Service holds, and tell it when the registry data for an object change (Articles 28 and 29).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Security Service of the Republic of Uzbekistan, the authorized state body, with its working body the Cybersecurity Center state unitary enterprise.
Settledness
- As of
What this law does
The Law took effect on . A critical information infrastructure subject must keep the information systems of its objects running without interruption. A critical information infrastructure subject must meet the cybersecurity requirements the authorized state body sets for its objects. The staff responsible for the cybersecurity of critical information infrastructure objects must pass attestation held by the authorized state body. The authorized state body sets the criteria for categorizing critical information infrastructure objects.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services or handles health records.