Armenia proposes 25,000-user and AMD 400 million thresholds for critical information infrastructure
An information system in Armenia may be designated critical information infrastructure (CII) if a cyber incident making it unavailable would affect 25,000 or more users, or if its recovery costs and book value exceed AMD 400 million (about $1.1 million). A draft government decision proposes the CII identification criteria required under Armenia’s Law on Cybersecurity. The draft was prepared by the Ministry of High-Tech Industry and Artificial Intelligence and the Armenian Information Systems Agency foundation.
Under the law, service providers operating CII must meet stricter cybersecurity requirements. According to the explanatory note, CII is not yet regulated, and the Information Systems Regulatory Commission, the autonomous body in charge, lacks a procedure for assessing systems and adding them to the CII list.
Four criteria
The commission will apply the criteria in order, moving to the next one if the previous one does not apply:
- systemic effect: the system’s unavailability could affect service providers in one or more essential sectors;
- 25,000 or more users;
- the duration and severity of a cyber incident could significantly affect economic activity, the environment, public order, daily life, international relations, governance continuity, national security or public health;
- recovery costs and book value exceed AMD 400 million, or the cost of building a new system and its book value exceed AMD 2 billion (about $5.5 million).
The user threshold is based on EU practice. According to the explanatory note, the threshold is 7% of the population in Estonia and 6% in Germany.
How the list will be built
Using data from the State Revenue Committee, the state register of legal entities and other sources, the commission will check whether an organisation’s activity matches at least one economic activity classification in the essential sectors. Data on large taxpayers will also be taken into account.
The first list will start from the sectors of high criticality in Annex I of EU Directive 2022/2555 (NIS 2), the police list of key facilities under state protection (government decision No. 2073-N of December 27, 2024) and the methodology of the EU Agency for Cybersecurity (ENISA). The explanatory note also cites MITRE Corporation’s Crown Jewels Analysis methodology.
Identified CII and the organisations operating it will be included in a list approved by government decision and in the commission’s register. The list will be reviewed at least once every two years.
The draft requires no additional state budget funding. The decision will take effect on the tenth day after its official publication.
