Law On Cyber Security – Security | #government | #hacking | #cyberattack | #hacking | #aihp

On June 30, 2021, the Government of Mongolia submitted a draft
Law on Cyber security and supplementary draft laws to the State
Great Khural(or the Parliament). On December 17, 2021 at the
plenary session, the State Great Khural approved the draft Law on
Cyber security. The law has adopted the first time in Mongolia and
has been discussed and developed 7 times over the past decade.

Within framework of the Fourth Industrial Revolution, our
country has established a legal system for ensuring national
cybersecurity, a vital law that creates legal conditions for the
development and security of the country, as well as information
security, which is an integral part of national
security¹.

In case of violation of the Law on Cyber security and
investigating the violation, the terminology, element of crime and
the concept of Chapter 26 of the Criminal Code of Mongolia have
been amended in accordance with the Law on Cyber Security and the
UN Budapest Convention. In addition, Law on Infringement, the Law
on Communications, the Law on Infringement procedure and the Law on
Criminal Procedure have been amended in connection with the
adoption of the Law on Cyber security².

An overview of highlighted new regulations of the Law on Cyber
security is outlined in this legal alert.

Purpose of the Law

The purpose of the Law on Cyber security is to establish a
system, principles and legal basis for cybersecurity operations,
and to manage the relations ensuring the integrity, confidentiality
and accessibility of information in cyberspace and cyber
environment.

Scope of the Law

Coordinates, organizes and monitors the relations between the
state, individuals and legal entities related to cyber
security.

Unless otherwise provided by law, this law shall apply to
foreign citizens, stateless persons, and legal entities of foreign
country and with foreign investment which operates through
Mongolia’s information system and information network.

Definitions

“Cyber security“- means the integrity and
confidentiality of information in a cyber environment;

“Cyber space“- means tangible and intangible
field consisting of the Internet and other information and
communication networks and the interconnected set of information
infrastructure to ensure their operation;

“Cyber environment“- means an information
system and information network environment that allows to access,
login, collect, process, store and use of information;

“Cyber- attack“- means an action aimed at
undermining the cyber security of an information system or
information network;

“Cyber security breach“- means an act or
omission that threatens the integrity, confidentiality or
accessibility of information;

“Center for Combatting Cyber-attacks and
violations“- means an entity with the main function to
coordinate the activities of preventing, detecting, suppressing,
responding to and restoring information systems and providing
professional management;

“Cyber security risk assessment“- means
specialized activities to determine the probability of a cyber
security breach, threat, vulnerability its consequences, risk
reduction and prevention measures for electronic information,
information systems and information networks;

“Organization with critical information
infrastructure“- means an organization with an
information system and information network that could cause a
damage to Mongolia’s national security, society and economy due
to the loss of cyber security;

“National cyber-attack“- an attack on the
information systems and information networks of an organization
with critical information infrastructure that can disrupt the
normal functioning of the organization and harm the national
Security, society and economy of Mongolia;

“Integrated state information network” – a
set of state Internet, official and special use networks with
integrated infrastructure aimed at exchanging information between
government organizations and ensuring cyber security;

Areas of cyber security:

• cyber security policy, management and organization;
• technical and technological measures to ensure cyber
  security;
• prevention and education of cyber-attacks and violations;
• detection, suppression, retaliation and recovery of
  cyber-attacks and violations.

Cyber security risk assessment

• Cyber security risk assessment will be conducted by a legal
  entity which registered with the state central administrative body
  in charge of digital development and telecommunications. The legal
  entity shall have a full-time employee with a valid certificate
  issued by an international professional association,
  standardization organization or equivalent or similar
  organization.
• Procedures and methodologies for cyber security risk assessment
  shall be approved by the state central administrative body in
  charge of digital development and telecommunications in cooperation
  with intelligence agencies.

Information security audit

An information security auditing shall be performed by a legal
entity registered with the state central administrative body in
charge of digital development and telecommunication. The legal
entity to conduct an information security auditing shall have:

• a full-time staff member with a valid certificate of
  information security auditing which issued by an international
  professional association, standardization organization or
  equivalent or similar organization;
• the employee does not work under a parallel contract with other
  legal entities authorized to conduct similar audits;
• other requirements under the law.

To view the full article click here

Footnote

1 http://parliament.mn/n/mo3on 

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.