Distributes a software product, in Brazil

Ato nº 2.436, de 7 de março de 2023 (Superintendência de Outorga e Recursos à Prestação, Agência Nacional de Telecomunicações), as amended by Ato nº 7.344, de 15 de junho de 2023; issued under the Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, approved by Resolução nº 740, de 21 de dezembro de 2020, and the Regulamento de Avaliação da Conformidade e de Homologação de Produtos para Telecomunicações, approved by Resolução nº 715, de 23 de outubro de 2019 · Read the law's page

• This binds a manufacturer or supplier of a cable modem, xDSL modem, ONU or ONT, fixed-wireless-access (FWA) router or modem, satellite-broadband router or modem, or wireless router or access point marketed to the general public in Brazil to connect a subscriber to an internet service provider's network; it does not reach a mobile app, a SaaS product, or any product that does not perform this connectivity function.
• Do not ship the device with weak, blank, or identical-across-all-units default credentials, and do not derive an initial password from information easy to obtain by scanning network traffic, such as a MAC address; alternatively, force the user to set a new password meeting the strength rules the first time the device is used or after a factory reset.
• Print any factory-set password on a label on the device and restore it whenever the device is reset to factory settings; require any user-set password to be at least 8 characters with an uppercase letter, a lowercase letter, a number, and a special character, and check new passwords against a password dictionary or an equivalent method to block weak or commonly used ones.
• Do not hard-code credentials or cryptographic keys in the device's software or firmware source code, encrypt or hash any password, key, or credential you store or transmit, implement inactive-session timeouts, ship with unused communication ports and services disabled, and let the user disable non-essential communication features.
• Publish a clear support policy stating how long and in what circumstances you will provide security updates, and provide security updates free of charge for at least 2 years after the product's launch or for as long as you keep distributing it to consumers, whichever period is longer.
• Provide a dedicated, securely reachable channel, such as an HTTPS web form or a PGP-encrypted email address, for a customer, end user, or third party to report a security vulnerability, and publish a coordinated vulnerability-disclosure policy on your website covering how you want to be notified, what a reporter should expect, and your process's scope and limits.
• Maintain a public, Portuguese-language support page listing known vulnerabilities in your products together with their mitigations, and keep making corrected software or firmware available.
• Demonstrate this compliance to Anatel's conformity-assessment agent when you seek homologação for the device, or by presenting your own Cybersecurity Policy showing you meet the full set of supplier requirements; Anatel can suspend a homologação it already granted if it later finds a security flaw or vulnerability, and a suspended homologação bars the product from being distributed in the Brazilian market until the problem is fixed.
• This duty took effect 1 July 2023 and its Annex, which carries the substantive requirements above, has been mandatory since 10 March 2024.