Internet consultation on new cyber rules launched

These new rules are part of the Cybersecurity Act and the Cybersecurity Decree. Both the law and the decree went out for consultation earlier.

Ministerial Regulation Sector Government

The Government Sector Cybersecurity Regulation will flesh out the Act and the Decree with provisions specific to the public sector. This is similar to proposed regulations for other sectors that went out for consultation at the same time.

The Cybersecurity Regulation Sector Government consists of a number of components:

• an elaboration of the duty of care for information security, where in particular the Baseline Information Security Government 2 (BIO2) is required;
• A specification of the circumstances under which you must report an incident;
• the designation of several Computer Security Incident Response Teams (CSIRTs) to different groups of government entities.

Participate? Here's how it works

Everyone is invited to respond: governments, businesses, experts and citizens. The consultation period runs from Nov. 11 to Dec. 23, 2025. After that, all responses will be reviewed. Adjustments to the scheme will follow where necessary.

The government plans to bring the laws, decrees and regulations into force in the 2nd quarter of 2026.