Article 16. Rights and duties of cybersecurity subjects

Cybersecurity subjects have the right to:

receive from the authorized state body information about cyber threats, vulnerabilities of software, equipment, and technologies for the purpose of ensuring their cybersecurity;

receive information and consultations from the authorized state body about the means and methods of protection against cyberattacks, as well as methods for their detection and prevention;

Develop and implement measures to ensure their cybersecurity.

cybersecurity subjects are obliged to:

prevent the illegal dissemination, theft, loss, violation of integrity, blocking, and falsification of data in information systems and resources, as well as other types of unauthorized access (entry) to information systems and resources, and take timely corresponding measures upon the detection of such cases;

take measures for the operational restoration of data in information systems and resources in order to minimize negative consequences in case of violation of access procedure and in case of their modification or deletion as a result of unauthorized access to them;

notify the authorized state body about occurred cybersecurity incidents and cybercrimes, take measures to prevent the loss of relevant digital traces for the full disclosure of these incidents, and also ensure the permanent storage of information necessary for the analysis of cybersecurity incidents and the investigation of cybercrimes;

implement mutual exchange with the authorized state body of data in the sphere of protection and conducting monitoring of the safe operation of cybersecurity objects;

observe the cybersecurity requirements determined by the authorized state body in ensuring the cyber protection of information systems and resources;

ensure the functioning of mechanisms for taking measures regarding cybersecurity incidents and the operation of subdivisions for ensuring cybersecurity, and in case of their absence — use outsourcing services with the permission of the authorized state body in the established manner;

grant the authorized state body the right of access to monitoring systems and (or) cybersecurity objects for the implementation of organizational and technical measures for monitoring the assurance of cybersecurity.