Cybersecurity requirements for banks and financial companies in Georgia, and where ISO 27001 fits

Georgian banks work under several overlapping sets of rules. ISO/IEC 27001 does not replace any of them, but a well-built ISMS can carry most of the evidence they require.

The National Bank of Georgia framework

The main sector rule is the Regulation on the Cybersecurity Management Framework of Commercial Banks, approved by National Bank of Georgia (NBG) Decree No. 56/04 of 22 March 2019. It is built on the structure of the NIST Cybersecurity Framework: identify, protect, detect, respond and recover. According to the IMF technical assistance report on Georgia published in December 2024, the framework includes:

• an annual self-assessment and an annual independent audit covering all components of the framework, with NBG guidance on how those audits are notified and rotated;
• at least one penetration test a year covering network-connected systems;
• incident information sharing rules adopted in 2023, under which significant incidents are reported to the NBG within 24 hours, followed by a detailed report;
• a separate cybersecurity framework for micro banks, issued in 2023, and a 2023 guideline on cloud outsourcing for critical or important functions.

The same report recommended that the NBG move towards a broader ICT and cyber risk guideline reflecting ISO/IEC 27001:2022, current NIST guidance and the EU DORA regulation. Banks should follow NBG communications for updates rather than assume the 2019 text is final.

The Law on Information Security

The Law of Georgia on Information Security, amended in 2021, divides critical information system subjects into three categories. State bodies fall under the Operational-Technical Agency. Private organisations such as banks form the third category, overseen by the Digital Governance Agency of the Ministry of Justice. The IMF reported that the three systemically important banks had been designated in this category, and that the agency's expectations for them are based on the ISO/IEC 27000 family. A bank in this position has to satisfy a NIST-based regulator and an ISO-based agency at the same time.

Personal data

Commercial banks, insurers, microfinance organisations and credit bureaus must appoint a data protection officer under the Law of Georgia on Personal Data Protection. Personal data incidents must be recorded and, where required, notified to the State Audit Office, which took over supervision from the Personal Data Protection Service in March 2026, within 72 hours. Your incident process therefore has two regulatory clocks: the NBG one and the data protection one.

How ISO 27001 helps a Georgian bank

An ISMS gives one risk assessment, one set of controls and one improvement cycle that can be mapped to all of the above.

1. Map once. ISO/IEC 27001:2022 Annex A has 93 controls. Map them to the NIST CSF functions used in the NBG regulation and to the agency's requirements. Each control then has one owner and one evidence set.
2. Use the risk assessment for the NBG self-assessment. The ISMS risk register and statement of applicability provide most of the input the annual self-assessment needs.
3. Align incident management. One procedure with classification criteria, the NBG 24-hour step and the 72-hour data protection step.
4. Supplier and cloud control. ISO 27001 supplier controls and the cloud controls in ISO/IEC 27017 support the NBG cloud guideline.
5. Testing. The annual penetration test becomes an input to ISMS risk treatment, not a separate document.
6. Continuity. Recovery requirements are easier to show with a business continuity management system under ISO 22301.

One caution: the NBG independent audit and an ISO 27001 certification audit are not the same thing. An accredited ISO certificate does not by itself satisfy the NBG audit requirement. The benefit is that both audits look at the same, well-organised evidence.

Financial companies outside the NBG cyber rules

The IMF noted that the NBG cybersecurity rules applied only to commercial banks and micro banks at the time of its review. Payment service providers, insurers, microfinance organisations and fintech firms still face personal data obligations, contractual demands from partner banks and card schemes, and due diligence from foreign investors. For them ISO 27001 is often the most practical way to answer all of those with one certificate. Companies that store, process or transmit card data also need PCI DSS validation, which is confirmed by a self-assessment questionnaire and attestation of compliance or by a QSA report on compliance, with ASV scans. There is no PCI DSS certificate; see our PCI DSS page.

What BALTUM does for financial organisations

We map your current controls against the NBG framework, the agency's requirements where they apply, the personal data law and ISO/IEC 27001:2022, and show one consolidated gap list. We then help build the ISMS, prepare the documents and evidence, train staff, run the internal audit and support the certification audit with an accredited certification body. The scope and plan are set after the first assessment. More on the standard: ISO 27001.

This article is a summary for orientation, not legal advice. To discuss your bank or financial company, use the form on this site or write to info@baltum.org.

Frequently asked questions

Does the National Bank of Georgia require ISO 27001 certification?

The NBG cybersecurity regulation for commercial banks is based on the NIST Cybersecurity Framework and does not require ISO 27001 certification. Many banks still use an ISO 27001 ISMS to organise the evidence that the NBG and other authorities ask for.

Can one ISMS cover NBG rules and the personal data law?

Yes. The legal register, risk assessment and incident procedure can include both, with separate reporting steps for the NBG and for the State Audit Office.

More articles from BALTUM Georgia