An information security policy: what the law requires
Developing a cybersecurity policy in Georgia is not merely a private corporate matter. The Law of Georgia on Information Security obliges subjects of critical information systems to adopt internal-use rules that define the organisation's information security policy. That policy must satisfy the minimum requirements established under the law, and its constituent elements — asset management, responsible officers and their functions — are themselves regulated by statute. On this page we explain what a lawful policy must contain, who is called the information security manager and the computer security specialist, and how the document connects with the oversight of state agencies.
The essential content of the policy and the minimum requirements
Under the law, a subject of a critical information system must adopt internal-use rules for information security that serve the implementation of the law's provisions and define the organisation's information security policy. The policy, in turn, must satisfy the minimum requirements of information security. Those requirements are established by taking into account the standards and requirements set by the International Organization for Standardization (ISO), the United States National Institute of Standards and Technology (NIST) and the Information Systems Audit and Control Association (ISACA) — for subjects of the first and second categories by order of the head of the Operational-Technical Agency, and for subjects of the third category by order of the chairperson of the Digital Governance Agency. Policy drafting therefore begins with studying those orders: a document that does not reflect them will be treated as deficient when it is submitted to the supervisory agency.
The adopted rules must be submitted for review to the relevant agency: subjects of the first and second categories — to the Operational-Technical Agency; subjects of the third category — to the Digital Governance Agency; and subjects within the defence sphere — to the Cyber Security Bureau. The agencies are also notified of any change made to the rules. They carry out a general analysis of the submitted documents and, to cure the defects found, submit binding instructions or recommendations for execution. In addition, the agencies are empowered to demand from the subject other information connected with the development, deployment, monitoring and improvement of the policy. A separate regime applies to commercial banks: the National Bank of Georgia is authorised to demand the submission of their internal-use rules and to issue binding instructions or recommendations with respect to the additional standards and requirements it establishes for them.