---
title: "Critical Infrastructure Protection"
url: "https://legal.ge/en/service/military-and-national-security-law-en/critical-infrastructure-protection-en"
field: "Military & National Security Law"
description: "Obligations of critical information system subjects: inventory, audit, penetration testing and the action plan — 1 month. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-11-07"
publisher: "legal.ge"
---

# Critical Infrastructure Protection

> Source: legal.ge, https://legal.ge/en/service/military-and-national-security-law-en/critical-infrastructure-protection-en

## Inventory and Classification of Information Assets

Under Article 5 of the law on information security, a critical information system subject must inventory its information systems to record every information asset. Each asset is assigned a criticality class — confidential or internal-use — while all other assets are open information. The inventory describes each asset’s significance, value and existing protection level; at creation, the class is set by the author or responsible person. Asset management rules for first- and second-category subjects are set by order of the head of the Operative-Technical Agency, for the third category — by the Digital Governance Agency, in defense — by the Minister of Defense; for commercial banks, additional standards come from the National Bank.

## Information Security Audit and Penetration Testing

Under Article 6, the subject must conduct an initial and a periodic information security audit — an assessment of compliance with the minimum standards — ending with a conclusion whose requirements are mandatory. The initial audit of a first-category subject is carried out free of charge by the Operative-Technical Agency; the periodic audit — by the Agency or an organization authorized by the Digital Governance Agency. For second-category subjects the same bodies apply, for the third — the Digital Governance Agency or an authorized organization, in defense — the Cybersecurity Bureau. Audit requirements do not apply to payment, securities settlement and reserve management systems, nor to systems used for monetary and currency operations. Under the same rules a penetration test is carried out — per a pre-planned, documented task — ending with a mandatory conclusion. Where weaknesses are found, the subject draws up an action plan with a schedule and submits it for approval within 1 month to the relevant authority; for commercial banks — the National Bank. The audit proceeds in cooperation with the information security manager and the computer security specialist.

## Authorization of Auditors

Article 6-1 defines who may conduct audits and penetration tests: an organization that has passed authorization at the Digital Governance Agency. The person carrying out the audit must have passed a security check under a procedure set by a normative act of the head of the State Security Service. In commercial banks, organizations from an additional list of authorized organizations may also be engaged, submitted by the National Bank to the Digital Governance Agency.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/military-and-national-security-law-en/critical-infrastructure-protection-en

### What is the inventory of information assets?

The recording of every information asset with the assignment of a criticality class: confidential, internal-use or open information.

### Within what period must an action plan be submitted?

Within 1 month of completion of the audit or penetration test, for approval by the relevant authority.

### Whom does the specialist notify of an incident?

The computer security specialist immediately notifies the relevant authority’s computer incident response team.

### Who inspects a first-category subject?

The Operative-Technical Agency may inspect its information technology infrastructure — covering networks, configurations and equipment.