Architects of Digital Trust.
Request a consultationქარ

CRITICAL INFRASTRUCTURE & REGULATORY COMPLIANCE

Critical Information Systems Security & Compliance

Implement Georgian information security requirements. Plan the right independent audit.

Request an Information Security AuditDiscuss Compliance Support

Critical information systems support essential public services, economic activity and the reliable operation of vital infrastructure.

Georgia's Law on Information Security establishes requirements for information security governance, asset protection, cybersecurity and compliance assessment for formally designated critical information system entities.

IO Consulting supports implementation and compliance improvement, and conducts DGA-authorized information security audits where the entity's category, applicable audit arrangements and independence requirements permit the engagement.

Digital trust

  • Public systems
  • Financial infrastructure
  • Energy networks
  • Telecommunications
  • Data centres
Connected services, systems and dependencies. Formal designation and category are established by the applicable legal acts.

DESIGNATION & APPLICABLE RULES

Who Is Subject to the Law?

The law applies to critical information system entities and, in the cases it specifies, associated organizations and persons. Formal designation and category follow the government resolution and its amendments.

Designation considers the possible consequences of disruption, economic impact, the importance of services to the public and other statutory criteria. Select a category to see its supervisory and audit arrangements.

Explore a formally designated category

Category I

Government-designated public and municipal bodies, qualifying legal entities under public law and state enterprises, within the statutory definitions and official list.

Competent authority
LEPL Operative-Technical Agency of Georgia (OTA)
Statutory audit arrangements
The initial audit falls within OTA's statutory remit; periodic audits may be conducted by OTA or a DGA-authorized organization. Applicable financial-system exceptions and engagement conditions must be checked. An authorized firm may participate in an OTA audit through OTA's own contracting and audit-group arrangements, acting in OTA's name.

These summaries explain the framework. Confirm the organization's exact legal identity, current designation and category against Government Resolution No. 646 and all applicable amendments before choosing an audit or implementation scope.

GOVERNANCE, CONTROLS & EVIDENCE

What Must a Critical Information System Entity Put in Place?

Meeting the applicable requirements calls for a functioning information security management system, clear accountability, risk management and regular evaluation of controls. The implementation is tailored to the entity's formal category and operating environment.

  • Information Security Policy

    Develop, approve, implement and update security policies and organizational rules aligned with the applicable requirements.

  • Information Asset Management

    Identify and inventory information assets, classify them and define responsibilities and appropriate protection measures.

  • Risk Assessment & Treatment

    Identify and assess information security risks, agree treatment decisions and maintain evidence of the selected measures.

  • Security Responsibilities

    Define the information security manager's responsibilities and the roles, reporting lines and competence of other responsible personnel.

  • Technical & Organizational Controls

    Implement the relevant minimum controls, maintain operating evidence and evaluate their design and effectiveness.

  • Incident Management & Notification

    Establish detection, escalation, response and notification processes using the reporting routes and responsibilities applicable to the entity's category.

  • Initial & Periodic Audits

    Plan the initial and periodic information security audits under the competent authority's procedure, using an eligible auditor and the required scope.

  • Corrective Action & Reporting

    Prepare the required corrective action plan, assign implementation responsibilities and meet the applicable submission and follow-up obligations.

This is an overview of key obligation areas. Minimum requirements, incident notifications, audit timing and corrective-plan reporting must be mapped to the relevant category and subordinate regulations. Applicable National Bank of Georgia provisions are checked separately for commercial banks.

TWO DISTINCT ENGAGEMENTS

Implementation Support and Independent Audit

Implementation & Regulatory Compliance

We help organizations translate the applicable Georgian information security requirements into a practical management system, defined responsibilities and operating controls.

The work starts with current-state assessment and prioritization, then develops policies, risk and asset management, control improvements and evidence for an independently conducted audit.

Implementation support is scoped separately from the legally required independent audit. Where we implement an entity's ISMS, its independent audit must be planned with another eligible auditor or the competent authority.

The Engagement Can Include

  • Regulatory gap assessment and prioritized roadmap
  • ISMS design, governance and implementation
  • Information asset inventory and classification
  • Risk assessment and treatment arrangements
  • Security policies and procedures
  • Incident management and response planning
  • Security awareness and role-based training
  • Audit readiness and remediation support
Plan Compliance Implementation

Authorized Independent Information Security Audit

We conduct information security audits within our documented DGA authorization, the applicable statutory audit arrangements and independence requirements. Eligibility is confirmed for the entity and engagement before acceptance.

The audit evaluates conformity with the applicable information security requirements, the implementation and operation of organizational and technical controls, relevant processes and the evidence presented.

The agreed outputs include a documented audit conclusion, findings, nonconformities and recommendations under the applicable rules. Category I initial audits and defence-sector statutory audits follow their designated public-authority arrangements.

The Engagement Can Include

  • Category, authorization, independence and audit scope
  • Documentation and required information review
  • Information security governance assessment
  • Risk management assessment
  • Technical and organizational control evaluation
  • Evidence evaluation and documented conclusions
  • Findings and nonconformities
  • Formal audit reporting and required submissions
Discuss Audit Eligibility & Scope

DOCUMENTED AUDIT AUTHORIZATION

DGA Authorization for Information Security Audits

The Digital Governance Agency's certificate ISA24022026 grants the certificate holder authority to conduct information security audits of critical information system entities. The certificate's stated validity runs until 31 January 2027.

Certificate Holder
შპს „იო კონსალტინგი“
Company Registration Number
400454021
Certificate Number
ISA24022026
Issued
Valid Until
Authorized Activity
Information security audits of critical information system entities, within the certificate conditions and applicable Georgian legislation.

A STRUCTURED, EVIDENCE-BASED ASSESSMENT

How We Conduct an Information Security Audit

The audit is planned around the applicable category, legal criteria and agreed scope. Each stage connects the requirements to evidence, documented findings and the entity's responsibilities.

Explore the audit stages

  1. Audit Planning

    Confirm formal designation, category, statutory audit arrangements, authorization and independence. Agree the scope, criteria, responsibilities and evidence plan.

  2. Documentation Review

    Review information security policies, procedures, asset inventories, classifications, risk assessments and other required documented information.

  3. Control Assessment

    Evaluate the design, implementation and operation of relevant technical and organizational controls through the agreed audit activities and operating evidence.

  4. Findings & Nonconformities

    Document evidence, nonconformities, control weaknesses and relevant risks against the applicable requirements, with clear traceability to the audit criteria.

  5. Audit Conclusion & Reporting

    Prepare the audit conclusion, findings and recommendations in the required form, and confirm the applicable reporting and submission arrangements.

  6. Corrective Action & Follow-up

    The entity prepares and implements its corrective action plan and meets the applicable reporting deadlines. Audit follow-up and clarification of findings remain within the permitted independent assessment role.

The sequence is adapted to the applicable audit procedure and scope. Statutory reporting routes, deadlines and any permitted follow-up are confirmed for the category. The entity retains responsibility for its management system, controls and remediation.

COMMON QUESTIONS

Understand the Requirements Before You Plan the Engagement

Who is covered by Georgia's Law on Information Security?

The law applies to designated critical information system entities and to associated organizations and persons in the cases it specifies. The organization's official designation and category must be checked against the applicable government resolution and amendments; defence-sector entities follow separate statutory arrangements.

How can we confirm our organization's designation?

Check the organization's exact legal identity against the current official designation lists under Government Resolution No. 646 and all relevant amendments. Confirm the category and any specific provisions before defining the compliance or audit scope. Sector examples on this page do not establish legal designation.

How does implementation differ from an independent audit?

Implementation develops or improves the management system, processes and controls needed to meet requirements. An independent audit evaluates conformity using defined criteria and evidence. The services have different responsibilities, eligibility and independence conditions, so their scope and provider arrangements are planned separately.

Is IO Consulting authorized to conduct information security audits?

DGA certificate ISA24022026, issued on 24 February 2026 to შპს „იო კონსალტინგი“, grants authority to conduct information security audits of critical information system entities and states validity until 31 January 2027. Each engagement must also satisfy the relevant category's audit arrangements, authorization conditions and independence rules. Category I initial audits and defence-sector audits follow their designated statutory authority arrangements.

Are initial and periodic audits required?

The law provides for initial and periodic information security audits. The applicable procedure, timing, scope, reporting and any permitted deferral depend on the entity's formal category and relevant regulations. Corrective action planning and submissions after findings must also follow the category-specific requirements, including applicable National Bank arrangements for commercial banks.

Can the same firm implement our ISMS and perform its statutory independent audit?

The authorization rules prohibit an organization and/or auditor from auditing an entity where that organization or person implemented the ISMS. A separate team or contract does not remove the organizational prohibition. We assess prior implementation work and conflicts before accepting an audit. If IO Consulting implements your ISMS, the independent audit must be arranged with another eligible provider or the competent authority.

PLAN YOUR NEXT STEP

Define the Right Route to Compliance

Discuss your organization's designation, category, information security arrangements and immediate priorities with IO Consulting.

We will help define a practical implementation scope or confirm the eligibility and scope of an independent audit, with responsibilities and independence conditions agreed at the outset.

Discuss an Independent AuditPlan Compliance Support