Cybersecurity · Mongolia
Cybersecurity regulation in Mongolia (2026)
Mongolia shaded by its cybersecurity status
Mongolia enacted a standalone Law on Cyber Security on 17 December 2021 — its first comprehensive cybersecurity statute after a decade of drafting — establishing obligations for operators of critical information infrastructure (CII), mandatory incident reporting, biennial security evaluations, and annual audits. Two national CSIRTs were operationalised in 2023: the National CSIRT under the GIA (covering state/CII sectors) and the Public CSIRT/CC under MDDIC (for the general public and private sector). An Oxford GCSCC Cybersecurity Capacity Review published in February 2025 found the legal framework functional but noted gaps in enforcement, terminology standardisation, and human-resource capacity.
Key points
The Law on Cyber Security was approved by parliament on 17 December 2021 and entered into force thereafter. It is the primary instrument governing cybersecurity across all sectors, applying to citizens, legal persons, foreign nationals, and foreign-invested entities operating within Mongolia's information networks.
The law defines CII as information systems whose failure could harm national security, society, or the economy, covering electricity, water, heating, and other essential sectors. CII operators face heightened obligations including mandatory security evaluations every two years and annual information security audits conducted by state-registered auditors.
Articles 16–19 of the Law on Cyber Security impose mandatory notification duties on CII operators and government institutions to report cyber incidents to the designated competent authorities (National CSIRT/GIA for state sector; Public CSIRT/CC for others). Non-CII legal persons must notify the relevant centre when a cyber-attack or violation occurs or is imminent.
Mongolia established two CSIRTs in 2023: the National CSIRT under the General Intelligence Agency (responsible for government and CII incident response) and the Public CSIRT/CC under MDDIC (serving the broader public and private sector). A Cybersecurity Council provides unified coordination and policy oversight.
Mongolia's Criminal Code Chapter 26 was amended in conjunction with the Cyber Security Law to align cybercrime definitions with the Council of Europe Budapest Convention, to which Mongolia is a party. Related amendments were also made to the Laws on Communications, Infringement, and Criminal Procedure.
An Oxford GCSCC Cybersecurity Capacity Maturity Model review published in February 2025 confirmed the law's functional status but identified implementation gaps: absent national audit standards, weak enforcement mechanisms, and limited skilled personnel. MDDIC's 2024–2028 Strategic Plan (adopted January 2025) commits to strengthening enforcement, awareness, and ethical AI governance.
Mongolia - other topics
Last verified 5/24/2026 · Orientation, not legal advice - verify against the primary sources linked above. Explore the full world map →