cybersecurity
Measures and capacities to protect networked systems.
How the laws define this
Regulators consistently establish cybersecurity around technical, organizational, and resilience measures designed to protect networks, systems, and data from unauthorized access, disruption, damage, or cyber threats. The central objective across these texts remains safeguarding the confidentiality, integrity, or availability of digital services and information. However, these instruments diverge significantly in their regulatory scope and application. The Cybersecurity Law frames the concept broadly around preventing harm to national security, social order, and legitimate individual rights in cyberspace. In contrast, Regulation (EU) 2023/1230 focuses narrowly on machinery, mandating ten years of software updates for connected machines to protect safety functions from digital manipulation. Other frameworks target specific sectors, such as the Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT), which applies to financial institutions and explicitly extends protection to physical hardware, software, and electronic data against theft, damage, and service misdirection.
Synthesised from the 9 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 6 of the 9 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| European Union | Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on machinery and repealing Directive 2006/42/EC of the European Parliament and of the Council and Council Directive 73/361/EEC | In Force | Limits cybersecurity to protecting connected machines from digital manipulation or cyberattacks, mandating 10-year software updates to prevent safety function compromises. |
| Chile | Law No. 21.663 — Framework Law on Cybersecurity and Critical Information Infrastructure | In Force | Explicitly includes practices and safeguards protecting IT assets against threats to confidentiality, integrity or availability, serving as baseline for obligations. |
| Malaysia | Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated) | In Force | Focuses on protecting financial institutions' information systems from theft, damage, disruption or misdirection of services they provide. |
| Vietnam | Cybersecurity Law | Repealed | Broadens to ensuring cyberspace activities do not harm national security or social order, encompassing legal, technical and organizational measures. |
| Slovakia | National Cybersecurity Strategy 2021–2025 | Superseded | Aligns explicitly with EU and national law, emphasizing both technical and organisational measures for strategic prioritisation. |
| Malaysia | Selangor AI White Paper | Adopted | Highlights practices, technologies and processes to protect against digital attacks, unauthorized access, theft, damage or disruption. |
Definitions (9)
Measures, capacities and resilience mechanisms aimed at protecting network and information systems, including incident response, risk management, governance of critical resources and integration of security requirements into procurement and standards.
The law defines 'cybersecurity' as the set of measures, practices and safeguards aimed at protecting networks, systems, information and IT assets against threats that may compromise confidentiality, integrity or availability, used as the baseline concept for obligations and standards under the framework.
The protection of information systems, critical infrastructure, and data integrity through resilience measures, incident response capabilities, and alignment with EU best practices and national standards, integrated across public projects.
The combination of technical measures, institutional arrangements and governance practices aimed at protecting networks, ICT systems and data from threats and ensuring resilience of digital services. The Strategy highlights capacity building, incident response, and institutional roles (e.g., CSIRT.SK) as core components.
Measures, both technical and organisational, intended to protect networks, information systems and the data they process against unauthorized access, disruption, damage or other threats; defined in line with EU and national law for purposes of strategic prioritisation and implementation.
Ensuring activities in cyberspace do not harm national security, social order and safety, or the legitimate rights and interests of agencies, organizations, and individuals. It encompasses legal, technical, and organizational measures to prevent, detect, mitigate, and respond to cyber threats and incidents.
Cybersecurity encompasses the practices, technologies, and processes designed to protect computer systems, networks, and data. Its purpose is to safeguard against digital attacks, unauthorized access, theft, damage, or any form of disruption.
In the context of machinery, cybersecurity refers to the measures taken to protect machines, especially connected ones, from digital manipulation, unauthorized access, or cyberattacks. The regulation mandates manufacturers to provide software updates for 10 years to maintain cybersecurity and prevent safety function compromises.
Cybersecurity is defined as the protection of information systems from theft or damage to the hardware, software, and electronic data, as well as from disruption or misdirection of the services they provide. The policy mandates specific controls and measures to achieve and maintain a high level of cybersecurity within financial institutions.
Not to be confused with
Cyber-resilience focuses on the ability to prevent, detect and respond to incidents, while cybersecurity encompasses broader measures to protect systems from threats.
Network security specifically protects network operation and data integrity, narrower than cybersecurity's protection of systems, information and assets.
Questions and answers
What does cybersecurity require for machinery manufacturers in the EU?
Regulation (EU) 2023/1230 mandates manufacturers to provide software updates for 10 years to protect connected machines from digital manipulation, unauthorized access or cyberattacks and prevent safety function compromises.
What obligations does Chile's cybersecurity law impose?
Law No. 21.663 requires public agencies and essential service providers to implement cybersecurity risk management and mandatory incident reporting.
How is cybersecurity addressed in financial institutions under Malaysian policy?
Bank Negara Malaysia's RMiT policy document sets out specific controls and measures for financial institutions to achieve and maintain high cybersecurity protecting systems from theft, damage or disruption.
Related Terms
data security
Ensuring data is effectively protected and lawfully used through necessary measures....
network security
Measures protecting network operation and data integrity....
Cyber Resilience
Ability to prevent, detect and respond to cyber incidents....
Active cyber defence
Authorised proactive defensive detection and containment measures....
Trust and Security
Measures to protect privacy, integrity and continuity of digital services....