Article 101 - Status and functions of the Cyber Security Bureau 1. The information security policy for critical information system subjects in the field of defence shall meet the minimum requirements for information security in the field of defence (taking into account the criticality classification of critical information system subject in the field of defence). The Cyber Security Bureau shall define those requirements in accordance with the standards and requirements established by the International Organisation for Standardisation (ISO) and Information Systems Audit and Control Association (ISACA). 2. The Cyber Security Bureau shall be established in accordance with this Law and the Law of Georgia on Legal Entity under Public Law. 3. The scope of activities of the Cyber Security Bureau shall not fall beyond the Data Exchange Agency, whose powers, functions and scope of activity shall be defined by this Law and the Law of Georgia on Data Exchange Agency - Legal Entity under Public Law. 4. The list of critical information system subjects in the field of defence shall be approved and the classification of the relevant subject criticality shall be determined by an appropriate act of the Government of Georgia. The Ministry for Justice of Georgia shall submit the draft act to the Government of Georgia in agreement with the Ministries of Defence and Internal Affairs of Georgia and the State Security Service of Georgia. When making the list, the following criteria shall be taken into account: the severity and scope of the expected results of the information system malfunction or failure in terms of state defence; the severity of economic damage for the subjects and/or the State; the necessity for information system services for smooth functioning of the state defence; the number of information system users; material status of a subject and the amount of expected expenses incurred as a result of imposing relevant obligations on the subject. 5. The Minister for Defence of Georgia shall approve the statute and structure of the Cyber Security Bureau. 6. The main function of the Cyber Security Bureau is to carry out the activities provided for by the legislation of Georgia, including this Law, within the powers granted to it. 7. Articles 6, 7, 9(4), and 10(2) shall not apply to the activity of the Cyber Security Bureau. Law of Georgia No 1829 of 24 December 2013 – website, 28.12.2013 Law of Georgia No 3933 of 8 July 2015 – website, 15.7.2015 Article 102 - Director of the Cyber Security Bureau 1. The Minister for Defence of Georgia shall appoint and dismiss the Director of the Cyber Security Bureau. 2. The Director of the Cyber Security Bureau shall have two Deputies, including one First Deputy performing the duties of the Director in his/her absence. The Director of the Cyber Security Bureau shall appoint and dismiss the Deputy Directors in agreement with the Minister for Defence of Georgia. 3. The Director of the Cyber Security Bureau shall act within the powers granted by this Law and the Statute of the Cyber Security Bureau. 4. The Director of the Cyber Security Bureau may appoint and dismiss the employees of the Cyber Security Bureau in the manner provided for by the legislation of Georgia. 5. The Director of the Cyber Security Bureau shall issue a normative act, an order, in the cases and within the scope defined by this Law and other legislative acts of Georgia. The Minister for Defence of Georgia shall issue normative acts governing the defence policy in the field of cyber security. 6. The Minister for Defence of Georgia shall approve the staff list and salaries for the Cyber Security Bureau in the manner provided for by the legislation of Georgia. Law of Georgia No 1829 of 24 December 2013 – website, 28.12.2013 Article 103 – CERT of the Cyber Security Bureau 1. CERT– CERT.MOD.GOV.GE (the Computer Emergency Response Team) shall manage cyber-attacks against a critical information system subject in the field of defence that endangers the human life and health, the state interests and defence, also shall manage other incidents occurred against the information security and the related activities that serve to eliminate priority threats to cyber security. 2. Priority threats for CERT of the Cyber Security Bureau and the duties of CERT shall be defined in Article 8(2) and (3) of this Law. Law of Georgia No 1829 of 24 December 2013 – website, 28.12.2013 Chapter IV - Transitional and Final Provisions Article 11 - Transitional provisions http://www.matsne.gov.ge 14000000005001016807