---
title: "Security Audit Requirements"
url: "https://legal.ge/en/service/technology-and-digital-law-en/security-audit-requirements-en"
field: "Technology & Digital Law"
description: "Security audit standards in Georgia: certification is voluntary; the statutory audit and penetration test are mandatory. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-28"
publisher: "legal.ge"
---

# Security Audit Requirements

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/security-audit-requirements-en

## Certification or the statutory audit

International certification standards for information security management systems are, in Georgia, a private and voluntary instrument: a certificate issued under them acquires no force whatsoever under the country's legislation. For a subject of a critical information system the audit is mandatory not because of a certificate but because of the law — the Law of Georgia on Information Security establishes the obligation to conduct a primary and periodic information security audit and a penetration test of the information system, the authorization regime for those who conduct them, and the mechanism for acting on their conclusions. On this page we explain what is legally required and what role voluntary certification can play alongside it.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/security-audit-requirements-en

### Does an international certificate replace the statutory audit?

No. Certification is voluntary and has no force under Georgian law. For a subject of a critical information system the audit is required by law, and compliance with the requirements of its conclusion is mandatory.

### Who conducts the information security audit?

By category: first — the Operational-Technical Agency (primary audit free of charge) or an organization authorized by the Digital Governance Agency; second — the same agency or an authorized organization; third — the Digital Governance Agency or an authorized organization; defence sphere — the Cyber Security Bureau.

### What happens after the audit if defects are found?

The subject analyses them and defines an action plan with a schedule, submitted within 1 month of completion for approval to the respective agency. The agency assesses the plan and issues recommendations or binding instructions, and monitors implementation.

### How is an auditor verified?

To conduct an audit or penetration test an organization must hold authorization from the Digital Governance Agency, and the employee personally conducting it must have passed a security check under the established procedure.