Source Code Analysis in Light of the Hungarian Cybersecurity Act (kibertan.tv)

How should software development companies interpret Act XXIII of 2023 (the Hungarian Cybersecurity Act, ‘kibertan.tv’)?

2023.09.12

1. If the software development company is a medium-sized enterprise or larger, it clearly falls within the scope of the Act.

The Act classifies outsourced ICT services as a highly critical sector

provider of outsourced (managed) ICT services: an organisation that provides services relating to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other electronic information systems, either at the customer’s premises or remotely

2. If it is a micro or small enterprise, it falls within the scope of the Act “only” indirectly.

2.1. The client for whom it develops or provides software falls within the scope of the Act because it belongs to one of the specified sectors and is not a micro or small enterprise.

2.2. The client for whom it develops or provides software falls within the scope of the Act because, although it is a micro or small enterprise, the organisation is a

provider of electronic communications services,
trust service provider,
DNS service provider,
top-level domain name registry, or
domain name registration service provider

3. What must a company do if it is directly within the scope of the Act?

establish an information security management system;
appoint a person responsible for electronic security
carry out a risk analysis of its electronic information systems and the data processed in them;
assign its electronic information systems and the data processed in them to security classes;
implement the administrative, physical and logical protective measures prescribed for the applicable security classes,
have its systems audited every 2 years.

Organisations must ensure:

the handling of security incidents;
the establishment and maintenance of business continuity;
the integration of information security into the procurement, development and operation processes of electronic information systems and the software and hardware products they use;
the security training of the organisation’s staff

4. What exactly does this look like in chronological order?

The company must determine that the Act applies to it and, by 30 June 2024, notify the Supervisory Authority for Regulated Activities (Szabályozott Tevékenységek Felügyeleti Hatósága) of this fact so that it can be registered.
From October 2024, it must pay the supervisory fee to the Supervisory Authority for Regulated Activities.
From October 2024, it must put the protective measures into effect.
By 31 December 2024, it must sign a contract with an audit firm listed in the register of the Supervisory Authority for Regulated Activities.
By 31 December 2025, it must also have completed its first audit

5. What needs to be done if the software development company’s client is also within the scope of the Act?

The ICT product developed and made available by the software development company must fit into the national cybersecurity certification schemes, which may specify one or more of the “basic”, “substantial” and “high” assurance levels for ICT products. The assurance level provides assurance that the ICT products concerned meet the relevant security requirements and security functions, and have undergone an evaluation at a level intended to

a. at the “basic” assurance level, the basic, known risks of security incidents and attacks, b. at the “substantial” assurance level, known cybersecurity risks and the risk of security incidents and cyberattacks carried out by actors with limited skills and resources, c. at the “high” assurance level, the risk of cyberattacks carried out by actors with significant skills and resources using state-of-the-art technology – minimise.

The assurance level must be commensurate with the level of risk associated with the intended use of the ICT product, in terms of the probability and impact of security incidents.

In summary, your client will classify the ICT product “under” the “basic”, “substantial” or “high” security level

6. What are the general requirements associated with the “basic”, “substantial” or “high” security level?

For the “basic” assurance level

the technical documentation (with regard to meeting the requirements of the given certification scheme)

For the “substantial” assurance level

the technical documentation (with regard to meeting the requirements of the given certification scheme)
verification of the absence of publicly known vulnerabilities;
testing to determine whether the ICT product correctly implements the necessary security functions

For the “high” assurance level

the technical documentation (with regard to meeting the requirements of the given certification scheme)
verification of the absence of publicly known vulnerabilities;
testing to determine whether the ICT product implements the necessary security functions correctly and in line with the state of the art
assessment, by means of penetration testing, of how resistant it is to attacks carried out by skilled actors.

7. How can it be demonstrated that the ICT product meets the requirements for the “basic” security level?

At the “basic” security level, for ICT products classified as low risk, conformity self-assessment is an option

The manufacturer issues a national statement of conformity confirming that it has been examined whether the requirements of the national cybersecurity certification scheme are met. The examination must include an evaluation of compliance with the requirements of the national cybersecurity certification scheme in accordance with the methodology set out in the certification scheme.

Within 15 days, for the purpose of registration, the following must be sent – also in an electronically searchable format – to the certification authority (the Supervisory Authority for Regulated Activities):

a copy of the statement of conformity,
the technical documentation, the national cybersecurity
evaluation report prepared on the basis of the evaluation method specified in the certification scheme, and all other relevant evaluation information relating to conformity with the designated certification scheme.

Based on the registration, the Authority verifies compliance with the statement

8. How can Szitár-Net Kft. help with carrying out the conformity self-assessment?

Our company, Szitár-Net Kft., holds silver SVAR (premier technical support partner) status in Hungary for SonarQube, the best-known source code analysis system. We have been working with source code analysis for more than 5 years and can provide consulting support for the conformity self-assessment of the system under examination.

9. How can it be demonstrated that the ICT product meets the requirements for the “substantial” and “high” security levels?

Conformity with the requirements for the “substantial” and “high” security levels can only be certified by conformity assessment bodies entered in the register of the Supervisory Authority for Regulated Activities.

Conformity assessment body currently in the register:

HUNGUARD Számítástechnikai-, informatikai kutató - fejlesztő és általános szolgáltató Korlátolt Felelősségű Társaság

Assurance level: High Status: Active

10. How can Szitár-Net Kft. help with meeting the requirements for the “substantial” and “high” security levels?

In the assessment methodology of conformity assessment bodies, too, one of the most important elements is source code analysis and the cybersecurity aspects associated with it.