UzbekistanState Security Service Order 118, categorization of critical information infrastructure objects
Order No. 118 of the Chairman of the State Security Service of the Republic of Uzbekistan (, registered by the Ministry of… Justice under 3570), Temporary Regulation on categorizing critical information infrastructure objects, paras. 3-6, 14, 15 and 18
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Governance, Security
As of .
What it requires
- Applies to the owner of a critical information infrastructure object, meaning a state body or organization, or a legal entity or individual entrepreneur, that holds the object by ownership, lease or another lawful basis, in fields such as public administration, defense, energy, health, the banking and finance system, transport, information and communication technology and telecommunications (paragraphs 1 and 9).
- Categorize each of your critical information infrastructure objects at least once a year as a high, medium or low level object, through a commission you head or an organization agreed with the State Security Service, and complete the categorization within thirty working days (paragraphs 3-6 and 9).
- Draw up an act of the categorization result with the contents paragraph 10 lists, and within five working days of the act send the State Security Service your application to enter the object in the temporary unified registry, on the form in Annex 1 (paragraphs 10-14).
- Review each object's category at least once a year, and within thirty working days after you add or remove software or technical tools or change the object's configuration, cyber protection tools, scale or purpose; send the new act and application within five working days (paragraphs 15 and 18).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Security Service of the Republic of Uzbekistan, the authorized state body, which categorizes critical information infrastructure objects and keeps the registry (paragraph 2).
Settledness
- As of
What this law does
The Order took effect on . The owner of a critical information infrastructure object must categorize its objects at least once a year. The categorization must be completed within thirty working days. Within five working days of the categorization act, the owner must apply to the authorized state body to enter the object in the registry. The Order is valid until .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.