Cybersecurity law & regulation in Georgia (2026)
Cybersecurity in Georgia: comprehensive law.
Georgia's primary cybersecurity instrument is the Law on Information Security, which designates critical information system subjects, imposes mandatory immediate incident reporting to CERT-GOV-GE, and requires those subjects to adopt internal security policies. National-level coordination is provided by the National Security Council's Department of Information and Cybersecurity, which oversees implementation of the 2021-2024 National Cybersecurity Strategy, the country's third such strategy. CERT-GOV-GE, operational since 2011 under the Ministry of Justice's Data Exchange Agency, serves as the principal technical response body.
Legal framework
Law of Georgia on Information Security (2012, as amended through 2025); National Cybersecurity Strategy 2021-2024; CERT-GOV-GE under the Data Exchange Agency of the Ministry of Justice; Department of Information and Cybersecurity of the National Security Council
Key points: cybersecurity in Georgia
Law on Information Security
Enacted in 2012 and amended multiple times (amendments recorded as recently as 2025 on matsne.gov.ge), the Law defines 'critical information system subject' as any state body or legal person whose uninterrupted operation is essential to defence, economic security, or public life, and sets binding security obligations for such entities.
Mandatory Incident Reporting to CERT
Critical information system subjects must notify CERT-GOV-GE immediately upon identifying a computer incident and take urgent steps to preserve incident-related information. CERT is empowered to request access to affected systems and infrastructure for incident response.
CERT-GOV-GE
Founded in 2011, CERT-GOV-GE operates under the Data Exchange Agency of the Ministry of Justice. It coordinates incident management, information exchange with critical infrastructure entities, and serves as Georgia's primary technical cybersecurity authority.
National Cybersecurity Strategy 2021-2024
Approved by Government Resolution No. 482 on 30 September 2021, the third national strategy sets four priority goals: developing cyber culture and organisational capacity; strengthening governance resilience and public-private partnership; building cyber workforce and technical capability; and enhancing Georgia's international cybersecurity standing.
Critical Infrastructure Classification
The list of critical information system subjects and their criticality classification is approved by government ordinance, submitted by the Ministry of Justice in agreement with the Ministries of Defence and Internal Affairs and the State Security Service. The original 2013 list identified 36 critical objects.
Budapest Convention & Geopolitical Context
Georgia is a party to the Council of Europe Convention on Cybercrime (Budapest Convention). As of 2025-2026, however, deteriorating relations with Western partners have led to reduced international cybersecurity assistance, affecting Georgia's capacity-building trajectory.
Timeline of decisions
- Guidance · officialIMF Technical Assistance Report: Cyber Risk Regulation Gaps at National Bank of Georgia
The IMF published a technical assistance report finding that while the National Bank of Georgia (NBG) has incident-reporting rules in place, significant gaps remain in cyber-risk governance, supervisory practices, information sharing, and stress-testing frameworks. The report recommended NBG develop an overarching financial-sector cybersecurity strategy.
IMF
- DecisionEU Grants Georgia Candidate Status, Cybersecurity Alignment with NIS Directive Required
The European Council granted Georgia EU candidate status conditional on nine reforms, including alignment with EU cybersecurity standards such as the NIS Directive. The status accelerated EU-funded capacity-building for Georgia's Cyber Security Bureau, though Georgia's accession process was later de-facto suspended in November 2024 amid democratic backsliding concerns.
Civil Georgia
- Guidance · officialThird National Cybersecurity Strategy 2021-2024 Adopted (Government Resolution No. 482)
Georgia's government adopted its third national-level cybersecurity strategy, setting four priority goals: cyber-culture development, resilience of governance frameworks and public-private partnership, enhancement of technical cyber capabilities, and strengthening Georgia's role as an international contributor to cybersecurity. It succeeded the 2013-2015 and 2017-2018 strategies.
National Security Council of Georgia
- Decision · officialUS and UK Publicly Attribute 2019 Cyberattacks to Russia's GRU Sandworm Unit
The United States Department of State and UK NCSC jointly attributed the October 2019 mass cyberattack on Georgia to Russia's GRU Unit 74455 (Sandworm), marking a significant multilateral public attribution and establishing that hybrid state-sponsored cyber operations against Georgia are a recurring pattern.
US Department of State
- IncidentLargest cyberattack in Georgian history: ~15,000 websites defaced
A mass web-defacement attack — attributed with high confidence to a nation-state actor by the Carnegie Endowment for International Peace — took down or defaced roughly 15,000 Georgian websites in a single day, including government agencies, courts, TV stations, and commercial banks. The attack exposed critical gaps in national cyber-resilience and intensified calls for centralised incident-response capacity.
DFRLab (Atlantic Council)
- IncidentMass GRU Sandworm Cyberattack Defaces Thousands of Georgian Websites and Disrupts Broadcast TV
Russia's GRU Sandworm unit (Unit 74455) conducted a widespread disruptive attack against several thousand Georgian government and private websites, defacing them with imagery of former President Saakashvili, and knocked two major TV broadcasters (Imedi and Maestro) off the air, the largest cyber incident in Georgian history to date.
Radio Free Europe/Radio Liberty
- DecisionLEPL Cyber Security Bureau established under Ministry of Defence
By Decree No. 8 of the Defence Minister, the Legal Entity of Public Law (LEPL) Cyber Security Bureau commenced operations on 28 February 2014 as Georgia's first national CERT, mandated under the 2012 Law on Information Security to manage cybersecurity incidents across state and critical-infrastructure information systems.
NATO CCDCOE
- Law · officialLaw of Georgia on Information Security Enacted, Critical Infrastructure Framework Established
Georgia enacted its foundational Information Security Law (document No. 1679424), establishing mandatory cybersecurity obligations for critical information system subjects, defining 'critical information system', and formalising the role of CERT.GOV.GE under the Data Exchange Agency for incident management and coordination across government and critical infrastructure.
Legislative Herald of Georgia (Matsne)
- GuidanceFirst National Cybersecurity Strategy 2013-2015 Published
Georgia published its inaugural national cybersecurity strategy, covering 2013-2015, coordinated by the Data Exchange Agency. It established Georgia's first structured policy framework for protecting state networks, promoting cyber literacy, and coordinating incident response, forming the basis for all subsequent strategies.
CyBIL Portal (Council of Europe)
- Law · officialBudapest Convention on Cybercrime Enters into Force for Georgia
After signing the Council of Europe's Budapest Convention on Cybercrime in 2008, Georgia's ratification brought the treaty into force, obligating harmonisation of domestic cybercrime law with international standards on illegal access, data interference, system interference, and cross-border law enforcement cooperation.
Council of Europe
- Decision · officialCERT.GOV.GE Established Under the Data Exchange Agency
Georgia stood up its national government Computer Emergency Response Team (CERT.GOV.GE) under the Ministry of Justice's Data Exchange Agency, creating the primary body responsible for detecting, registering, analysing, and responding to critical cyber incidents within government networks and critical infrastructure.
Data Exchange Agency of Georgia
- DecisionData Exchange Agency (DEA) Established as Georgia's Central E-Governance and Cybersecurity Body
The government established the Data Exchange Agency as an independent legal entity under the Ministry of Justice to coordinate e-governance, develop cybersecurity strategy, and supervise CERT.GOV.GE, becoming the institutional anchor of Georgia's entire cybersecurity governance structure.
United Nations University
- IncidentRussia-Georgia War: First Documented Simultaneous Cyber-Kinetic Military Campaign
Concurrent with the Russian military invasion over South Ossetia, coordinated DDoS attacks knocked out 54 Georgian government, news, and financial websites, the first widely documented case of cyber operations running in parallel with conventional military operations. The incident became a landmark case study that directly drove Georgia's subsequent cybersecurity institution-building.
Modern War Institute, West Point
Sources
- matsne.gov.ge/en/document/view/1679424
- nsc.gov.ge/en/NEWS/georgia-national-cybersecuri.html
- ncsi.ega.ee/country/ge/
- ge.andersen.com/data-breach-notification-georgia/
- coe.int/en/web/cybercrime/institutions_ge
- dig.watch/resource/national-cybersecurity-strategy-of-georgia-for-2021-2024-and
- bindinghook.com/from-ally-to-outcast-whats-next-for-georgias-cyber-future/
- idfi.ge/en/cyber_security_reform_in_georgia_existing_challenges_international
Next for Georgia: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026