Cybersecurity law & regulation in Azerbaijan (2026)

Legal framework

Law on Information, Informatization and Protection of Information (as amended by Law No. 539-VIQD, 27 May 2022); Cabinet of Ministers Decision No. 229 (17 July 2023) on CII Security Requirements; Information Security and Cybersecurity Strategy 2023-2027 (Presidential Decree, August 2023); State Service for Special Communication and Information Security (SCIS)

Key points: cybersecurity in Azerbaijan

1. 01CII Legal Basis

   Law No. 539-VIQD (27 May 2022, in force 6 July 2022) inserted a new chapter on 'Security of Critical Information Infrastructure' into the Law on Information, Informatization and Protection of Information, defining CII, cyber threats, cyber attacks and cyber incidents, and imposing security obligations on CII operators.

   journal.scsa.ge coe.int

2. 02CII Security Rules

   Cabinet of Ministers Decision No. 229 (17 July 2023) approved detailed implementing rules requiring CII entities to comply with 29 general security requirements across 7 domains. Covered sectors include public administration, defence, healthcare, financial markets, energy, transport, IT, telecommunications, water supply and ecology.

   journal.scsa.ge researchgate.net

3. 03National Strategy 2023-2027

   A Presidential Decree of August 2023 adopted Azerbaijan's first standalone Information Security and Cybersecurity Strategy (2023-2027) and an Action Plan, assigning roles to SCIS, the Ministry of Digital Development and Transport, the State Security Service and others; goals include CII protection, reducing foreign technology dependency and cybersecurity awareness.

   dig.watch

4. 04Supervisory Authorities

   The State Service for Special Communication and Information Security (SCIS) is the primary cybersecurity authority and hosts the government CERT (cert.gov.az); the Electronic Security Service (CERT.AZ) operates under the Ministry of Digital Development and Transport for broader incident response; the State Security Service also oversees CII protection.

   cert.gov.az cert.az scis.gov.az

5. 05Incident Reporting

   CII operators must report cyber incidents to the competent authority under the 2022 law and 2023 implementing rules. Azerbaijan does not yet have a broadly applicable sector-neutral breach notification obligation covering private entities generally comparable to the EU NIS2 Directive.

   dcaf.ch journal.scsa.ge

6. 06Budapest Convention & Active Engagement

   Azerbaijan has ratified the Council of Europe Budapest Convention on Cybercrime and participates in the CoE Octopus community. In 2025, SCIS engaged at CyCon 2025 (Tallinn) and GISEC Global 2025 (Dubai); the service identified 850 indicators of compromise tied to cyberattacks on government institutions in 2025.

   coe.int cert.gov.az en.apa.az

Timeline of decisions

1. 2 Jun 2026Decision · official
   National Cybersecurity Agency established, succeeding Electronic Security Service

   President Aliyev signed a decree creating the National Cybersecurity Agency under the Ministry of Digital Development and Transport with an expanded remit covering AI-system security, critical-infrastructure resilience, personal-data protection, and enforcement against prohibited online content, directly relevant to overseeing AI deployments.

   Ministry of Digital Development and Transport, Azerbaijan

2. 20 Feb 2025Incident
   APT29 Cyberattack on Azerbaijani Media Attributed to Russian State Intelligence

   A large-scale intrusion hit Baku TV and multiple news websites; Azerbaijan's parliamentary commission publicly attributed the attack to Russia's APT29 (SVR-linked Cozy Bear). Investigators found attackers had maintained covert access for two to three years, making it the most significant publicly attributed cyberattack in Azerbaijan's history.

   The Record (Recorded Future News)

3. 28 Aug 2023Law
   Presidential Decree No. 4060: Information Security and Cybersecurity Strategy 2023-2027, country's first

   Azerbaijan approved its first dedicated cybersecurity strategy, assigning responsibilities to the Ministry of Digital Development and Transport, Electronic Security Service, and State Security Service; provisions on critical-infrastructure protection and personal-data security now form the baseline governance layer for AI system security pending the planned 2027 AI law.

   APA (Azerbaijani state news agency, reporting official presidential decree)

4. 28 Aug 2023Law
   Presidential Decree No. 4060: Azerbaijan's First National Cybersecurity Strategy 2023-2027 Adopted

   President Aliyev signed the Strategy of the Republic of Azerbaijan on Information Security and Cybersecurity for 2023-2027 together with its Action Plan, assigning implementation responsibilities to 23 government entities. The strategy, Azerbaijan's first dedicated cybersecurity strategic document, covers critical infrastructure protection, CERT cooperation, capacity building, and international engagement.

   Trend.Az

5. 17 Jul 2023Law
   Cabinet of Ministers Approves Implementing Rules for Critical Information Infrastructure Security

   The Cabinet adopted detailed technical and procedural rules for CII operators, specifying general and sector-specific security requirements, inspection powers, and incident response obligations across energy, transport, finance, telecoms, and public administration. These rules operationalised the 2022 statutory CII framework.

   Scientific and Practical Cyber Security Journal (SCSA)

6. 27 May 2022Law
   Law No. 539-VIQD: 'Critical Information Infrastructure' Chapter Enacted in Information Law

   The Milli Majlis amended the Law on Information, Informatization and Protection of Information to add a dedicated CII security chapter, formally defining 'critical information infrastructure,' 'cyber attack,' 'cyber incident,' and 'cyber threat' for the first time in statute, and imposing mandatory security obligations on CII operators. The law entered into force on 6 July 2022.

   Inter-Parliamentary Assembly of CIS / Milli Majlis

7. 17 Apr 2021Decision · official
   Presidential Decree No. 1315: SSS and SCIS Designated Lead Authorities for CII Cyber Defence

   President Aliyev's Decree No. 1315 formally named the State Security Service (SSS) as primary authority for cybersecurity of all critical information infrastructure, with SCIS acting jointly for state-body systems. The decree also established an inter-agency commission with powers to conduct inspections and mandate emergency interventions, laying the institutional foundation for the later CII law.

   State Security Service of Azerbaijan (DTX)

8. 1 Apr 2021Decision · official
   Presidential Decree on Critical Information Infrastructure Security Signed

   President Ilham Aliyev signed a decree establishing state measures to secure critical information infrastructure and assigning oversight responsibilities to the Electronic Security Service (CERT.AZ). The decree provided the policy mandate that drove the 2022 legislative amendments.

   Electronic Security Service (CERT.AZ) — Official Statute

9. 16 Mar 2020Decision · official
   Presidential Decree No. 957: SCIS Established as Independent State Service

   SCIS was separated from the Special State Protection Service and constituted as a standalone agency responsible for government network security (AzStatenet), cryptographic protection of state communications, technical cyber-defence support, and coordination of cybersecurity across state institutions. This consolidation gave cybersecurity its own dedicated institutional home.

   SCIS – State Service for Special Communication and Information Security

10. 5 Mar 2013Decision · official
    Presidential Decree No. 833: Electronic Security Service (CERT.AZ) Formally Established

    Decree No. 833 brought the Electronic Security Center (created by Decree No. 708 of September 2012) into the Ministry of Communications and High Technologies as the Electronic Security Service. The service became Azerbaijan's national CERT (CERT.AZ) and the coordinating state authority for ICT and cyber-incident response.

    Electronic Security Service / CERT.AZ

11. 1 Jan 2009Law · official
    Azerbaijan Ratifies Budapest Convention on Cybercrime

    Azerbaijan acceded to the Council of Europe Convention on Cybercrime (Budapest Convention ETS No. 185), the principal multilateral treaty harmonising cybercrime offences and mutual-assistance procedures. Accession required aligning the Criminal Code with the Convention's substantive offences on unauthorised access, data interference, computer-related fraud, and child exploitation.

    Council of Europe – Octopus Cybercrime Community

12. 1 Jan 1998Law · official
    Law on Data, Data Processing and Data Protection, Foundational Information-Security Statute

    Azerbaijan enacted its first comprehensive information law, defining state policy on information systems, categories of data, permissible collection methods, and protection obligations. This foundational statute underpinned all subsequent information-security regulation until the 2022 CII amendments modernised and expanded it.

    Council of Europe document archive (official text)

Sources

1. 1.journal.scsa.ge/wp-content/uploads/2024/12/0046_balajanov.pdf
2. 2.researchgate.net/publication/391312732_Cybersecurity_in_Azerbaijan_Legislative_Measure
3. 3.dig.watch/resource/the-strategy-of-the-republic-of-azerbaijan-on-information-se
4. 4.cert.gov.az/en
5. 5.cert.az/en/statute1
6. 6.scis.gov.az/en/news/view/313/the-039-cidc-2025-039-cyber-festival-has-concluded
7. 7.dcaf.ch/sites/default/files/publications/documents/AzerbaijanCybersecurityGov
8. 8.coe.int/en/web/octopus/-/azerbaijan
9. 9.ncsi.ega.ee/country/az/
10. 10.en.apa.az/ict/850-cyberattacks-identified-on-state-institutions-in-azerbaijan-i
11. 11.cert.gov.az/en/news/special-communication-and-information-security-state-service-