Certification or the statutory audit
International certification standards for information security management systems are, in Georgia, a private and voluntary instrument: a certificate issued under them acquires no force whatsoever under the country's legislation. For a subject of a critical information system the audit is mandatory not because of a certificate but because of the law — the Law of Georgia on Information Security establishes the obligation to conduct a primary and periodic information security audit and a penetration test of the information system, the authorization regime for those who conduct them, and the mechanism for acting on their conclusions. On this page we explain what is legally required and what role voluntary certification can play alongside it.