---
title: "Cybersecurity Policy Development"
url: "https://legal.ge/en/service/technology-and-digital-law-en/cybersecurity-policy-development-en"
field: "Technology & Digital Law"
description: "Cybersecurity policy development under Georgian law: minimum requirements, asset management, manager and specialist roles. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-23"
publisher: "legal.ge"
---

# Cybersecurity Policy Development

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/cybersecurity-policy-development-en

## An information security policy: what the law requires

Developing a cybersecurity policy in Georgia is not merely a private corporate matter. The Law of Georgia on Information Security obliges subjects of critical information systems to adopt internal-use rules that define the organisation's information security policy. That policy must satisfy the minimum requirements established under the law, and its constituent elements — asset management, responsible officers and their functions — are themselves regulated by statute. On this page we explain what a lawful policy must contain, who is called the information security manager and the computer security specialist, and how the document connects with the oversight of state agencies.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/cybersecurity-policy-development-en

### Who is obliged to adopt an information security policy?

A subject of a critical information system. It must have adopted internal-use rules defining the organisation's policy and satisfying the minimum requirements of information security established under the law.

### Where does the content of the minimum requirements come from?

They are established taking into account the standards of ISO, NIST and ISACA: for first- and second-category subjects by order of the head of the Operational-Technical Agency, and for third-category subjects by order of the chairperson of the Digital Governance Agency. For commercial banks the National Bank establishes additional standards.

### To whom are the adopted rules submitted?

By category: first and second categories — to the Operational-Technical Agency; third category — to the Digital Governance Agency; the defence sphere — to the Cyber Security Bureau. Changes are notified as well, and binding instructions or recommendations are issued on defects found.

### Can the manager and specialist roles be merged in one person?

The law defines two distinct roles: the manager monitors compliance with the requirements and reports to the leadership, while the specialist is responsible for the practical security of systems and incident response. The organisational decision is yours, but both functions must be designated.