The proposal aims to update the legal norms related to cryptographic protection of information, technical data protection, and state control in the field of cyber threats.
The draft law amends the existing laws "On the Licensing and Permit System" and "On Cybersecurity." In particular, it introduces mandatory licensing for organizations engaged in cryptographic and technical information protection. Activities subject to licensing include the development and production of cryptographic protection means, their installation and adjustment, as well as monitoring cyber threats, detecting spy devices, and responding to cyberattacks.
Furthermore, the draft law expands the definition of information infrastructure, introduces a new term "state information infrastructure," and clarifies the rights and obligations of its owners, including requirements for internal audits and informing government agencies about cyber incidents.
Additionally, the powers of the authorized body in the field of digital forensics, penetration testing (pentest), oversight of the development and operation of information protection means, as well as regulation of the import and export of cryptographic tools, are described separately.
The explanatory note to the draft law emphasizes that the lack of licensing has led to the emergence of numerous companies in the market that lack the necessary qualifications, increasing the risk of data leaks and vulnerabilities in information systems. The new norms are intended to create a transparent market for services, enhance the quality of technical protection, and strengthen the digital sovereignty of the Kyrgyz Republic.
