Cyber risk management in Georgia is no longer purely a private-sector discretion: the Law of Georgia on Information Security imposes mandatory organisational measures on defined subjects — from policy and asset classification to audit, penetration testing and incident response. The first and most consequential question every company must ask is a verification question: does it fall within the scope of this law at all? This page is built around that logic: first the scope, then the obligations, and finally the architecture of responsibility.
Who the Law Covers — the Verification Question
Under Article 3, the law applies to a subject of a critical information system, and to any organisation or agency subordinate or connected to such a subject through employment, internship, contractual or other relations, where within those relations it ensures the availability of an information asset.
The list of critical information system subjects and their criticality classification are approved by government decree, guided by criteria including the severity and scale of the consequences of the system’s disruption or failure, the expected economic loss, the necessity of the services the system provides for the normal functioning of society, and the number of users. The law does not extend to mass media, editorial offices of publishing houses, scientific, educational, religious and public organisations or political parties. At the same time, any legal entity or state authority that is not a subject may voluntarily assume the obligations arising from the law — for many companies this is precisely the route by which best practice becomes a competitive standard.
Policy and Minimum Requirements
Article 4 obliges the subject to adopt internal rules for the use of information security, which define the organisation’s information security policy. The policy must satisfy minimum requirements established with regard to internationally recognised standards, by orders of the competent authorities according to categories. The adopted rules are submitted for review to the competent authority, which analyses the documents and issues binding instructions or recommendations to remedy the defects identified; any change to the rules is likewise notified.
Asset Inventory and Classification
Article 5 governs the first step of risk-based management: the subject inventories its information systems to record every information asset, assigning each a criticality class — confidential or for internal use — while the rest counts as open information. The record describes each asset’s significance, value and existing level of protection, and when an asset is created its class is determined by the author or the responsible person.