The Purpose of the Law and the Information Security Framework
The Georgian law on information security was adopted to promote the effective and efficient protection of information security, to establish the rights and duties of the public and private sectors in this sphere, and to define the mechanisms of state control over information security policy. In practical terms, the state determines who counts as a subject of a critical information system, what obligations attach to that status, and how specialized response groups react to computer incidents. For companies dependent on digital infrastructure, knowledge of this law is the foundation of managing compliance risk.
The law applies to a subject of a critical information system and to any organization connected with it through employment, internship, contractual or other relations that ensure the availability of an information asset. It does not apply to the mass media, the editorial offices of publishers, or scientific, educational, religious and public organizations and political parties, regardless of the significance of their activity, and it does not affect the norms regulating freedom of information, the processing of personal data and the protection of state, commercial and personal secrets.
Categories of Criticality and the Registry
The list of subjects of critical information systems is approved, and the criticality classification of a respective subject is established, by a decree of the Government of Georgia, whose draft is presented to the government by the Ministry of Justice in agreement with the Ministry of Defense, the Ministry of Internal Affairs and the State Security Service. In compiling the list, the following criteria are taken into account: the severity and scale of the expected consequences of the disruption or failure of the system; the expected economic damage; the necessity of the service for the normal functioning of society; the number of users; and the material condition of the subject together with the expected costs of the obligations imposed by this law.
The distribution among categories matters in practice: the rules attached to subjects of the first, second and third categories — from sensor configuration to the response group receiving notifications — differ. A commercial bank that is not a subject is guided by the rules of the National Bank, and a legal entity or state authority that is not a subject may voluntarily assume the obligations arising from this law.
Incident Identification and Notification
A subject of a critical information system carries out the identification of a computer incident, which includes the study and description of the incident and the response to it; for this purpose the subject uses a network sensor. The configuration rules for the network sensor are established, for a subject of the first or second category, by an order of the head of the Operational-Technical Agency; for a subject of the third category, by an order of the chair of the Digital Governance Agency; and for a subject within the defense sphere, by an order of the Minister of Defense. The configuration rules must exclude access to the content data of the subject's communications.
On the identification of an incident in a subject of the first or second category, the computer incident response group of the Operational-Technical Agency is notified immediately; in a subject of the third category — the response group of the Digital Governance Agency; in the defense sphere — the response group of the Cybersecurity Bureau. The group studies and describes the incident, responds to it, and submits binding instructions to the subject for execution; such an instruction may not provide for an obligation of access to the sensor, information asset or system of a subject of the second or third category, and the subject must respond within a reasonable term and report on the measures taken. An ongoing incident in the network of a first-category subject is identified by the response group of the Operational-Technical Agency or by the subject's computer security specialist; the same group holds the right of access to that category's network sensor — except where the data identifying the traffic contains information on banking transfers.