Article 28. Rights and duties of critical information infrastructure subjects

Critical information infrastructure subjects have the right to:

receive from the authorized state body information about cyber threats, vulnerabilities of software, equipment, and technologies for the purpose of ensuring the cybersecurity of critical information infrastructure objects;

receive information and consultations from the authorized state body about the means and methods of protection against cyberattacks, as well as methods for their detection and prevention;

develop and implement measures to ensure the cybersecurity of critical information infrastructure objects.

Critical information infrastructure subjects are obliged to:

ensure the continuous functioning of the information systems of critical information infrastructure objects;

bring to the attention of the authorized state body information about cybersecurity incidents;

provide assistance to officials of the authorized state body or the working body for ensuring cybersecurity in the detection, prevention, and elimination of the consequences of cyberattacks, and the determination of the causes and conditions of the origin of cybersecurity incidents;

install and operate monitoring systems while observing the technical requirements for the operation of hardware, software, and hardware-software tools for preventing cyberattacks, eliminating their consequences, as well as taking measures regarding cybersecurity incidents at critical information infrastructure objects;

ensure the security of critical information infrastructure objects in accordance with cybersecurity requirements;

fulfill the instructions of the authorized state body on the elimination of detected offenses regarding the assurance of cybersecurity at critical information infrastructure objects;

take measures to eliminate the consequences of cybersecurity incidents and cyberattacks on critical information infrastructure objects;

grant the authorized state body rights of access to monitoring systems or critical information infrastructure objects for the implementation of organizational and technical measures for monitoring the state of cybersecurity assurance;

notify the authorized state body upon the change of information about an object included in the unified register of critical information infrastructure objects.