Provides financial services, in Andorra

Llei 22/2022, del 9 de juny, arts. 12, 13, 17 i 18 · Read the law's page

• Adopt technical and organizational measures proportionate to the cybersecurity risks facing your networks and information systems, covering at minimum a security policy for your critical infrastructure and information systems, a risk-management policy, incident management, business continuity and crisis management, supply-chain security, security in the acquisition, development and maintenance of your systems, including the handling and disclosure of vulnerabilities, testing and audit procedures, and the use of cryptography and encryption (Article 13(3)).
• Take into account each supplier's and service provider's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including its secure development procedures (Article 13(4)).
• Adopt security policies for your critical infrastructure, networks and information systems that follow the principles of comprehensive security, risk management, prevention, response and recovery, lines of defense, periodic reassessment and segregation of duties, and that contain at minimum: risk analysis and management, third-party and supplier risk management, a catalog of security measures, staff management and professionalism, acquisition of security products or services, incident detection and management, recovery and continuity plans, continuous improvement, interconnection of systems, and logging of user activity (Article 12(4)).
• Record your security measures in a statement of applicability and send it to the competent authority within six months of your identification as an essential or important entity or of the National Security Scheme's entry into force, whichever is later, and review it at least every three years (Article 12(3)).
• Have your management body approve the cybersecurity risk-management measures you adopt under Article 13, supervise their implementation and answer for the entity's breaches of that Article, and have its members attend periodic training that equips them to understand and assess cybersecurity risks and management practices (Article 17).
• Designate an Information Security Delegate, a natural person, a unit or a collegiate body, as the point of contact and technical coordination between your organization and the competent national authority and the CSIRT-AD, and designate a substitute to assume the role during an absence, vacancy or illness. Notify the Delegate's contact details to the competent authority within one month of the designation, and any change within one month of the change. Make sure the Delegate has specialist cybersecurity expertise and experience, the resources needed, a position in the organization that allows timely involvement in security matters and real communication with senior management, and independence from those responsible for the systems in the Delegate's area (Article 18(1)-(4) and (8)).
• Adopt the security measures the National Security Scheme (Esquema Nacional de Seguretat) sets for your sector, which you may supplement with recognized international standards.
• If you are a critical entity, also take appropriate and proportionate measures to prevent incidents, to protect sensitive sites and facilities physically, to resist, mitigate and recover from incidents (including business continuity and alternative supply chains), and to manage staff security and make staff aware of these measures; for staff in critical functions, give the competent authority a report that includes the person's identity from documentary proof, any relevant criminal record, previous employment and training, and any other objective information needed to judge suitability (Article 12(2)).
• Send your competent authority, within six months of the publication in the Butlletí Oficial del Principat d'Andorra of the list of essential and important services, your name, the address of your main and other legal establishments in Andorra (or of your representative) and up-to-date contact details, and report any change without delay and in any case within three months of the change; failing to do so is a very serious violation where you have an establishment in Andorra or the ANC-AD has told you of your obligations (Articles 10(1)-(2) and 34.2(a)).
• If you provide essential or important services in Andorra without being established there, appoint a representative in Andorra who is subject to the country's jurisdiction; without one, the ANC-AD may identify you, inform you of your obligations under the Law and take legal action against you for breaching them (Article 19(1)).
• This duty reaches an essential or important entity, public or private, that offers a service the national competent authorities have designated on the list of essential and important services (Articles 3(35), 3(36) and 6(4)(b)) in an Annex I essential-entity sector (energy, transport, banking, financial-market infrastructure, health, water, digital infrastructure, public administration) or an Annex II important-entity sector, which names providers of online marketplaces, online search engines and social networking services platforms among Andorra's digital service providers, where you employ 50 or more people or your annual turnover or annual balance sheet total exceeds ten million euros (Article 2(1)). It also reaches such an entity of any size in these cases: whatever their size, an entity whose services are provided by a public electronic communications network or service, a trust service provider, a top-level domain registry or a DNS service provider in the Annex I digital infrastructure sector; a public administration entity; the sole provider of a service in Andorra; an entity whose disruption could affect public security, public order or public health or induce systemic risks; an entity that is critical for its sector or for interdependent sectors nationally or at municipal level; and an entity identified by regulation as critical or equivalent to a critical entity (Article 2(2)). A provider not established in Andorra is covered when it provides essential or important services there.
• Where sector-specific rules on ICT risk management, ICT incident handling or notification, digital operational resilience testing, information-sharing or ICT third-party risk have an effect at least equivalent to this Law's duties, those rules apply in priority to the entities they cover; this does not displace the incident-notification duty in Article 15 so far as it is compatible with the sectoral rules (Article 2(3)-(4)).

Llei 22/2022, del 9 de juny, arts. 14 i 15 · Read the law's page

• Manage and resolve any security incident affecting the critical infrastructure, networks or information systems you use to provide your essential or important service, including by ensuring any external provider of those systems applies the necessary security measures, and request the CSIRT-AD's opinion or specialized support where needed; the CSIRT-AD's indications to mitigate effects and restore affected systems are binding on you.
• Give the CSIRT-AD and the competent authority all the information they require to carry out their functions under the Law, including additional information to analyze the nature, causes and effects of notified incidents (Article 14(2)); cooperate with the authority's supervision, facilitate its inspections, provide the information it requires and apply the instructions it issues (Article 22(2)).
• Notify the CSIRT-AD, without delay and in any event within 72 hours of detecting it, of any incident that has or may have significant effects on your essential or important service, including any information that lets the authority or the CSIRT-AD determine the incident's cross-border effects. If, when you notify, you do not yet have information on the incident's effect on your essential or important services, you may omit it and must send it as soon as possible; if 72 hours after the notification you still have not gathered it, send the CSIRT-AD a justificatory report of the steps you took to obtain it and the reasons it could not be obtained (Article 15(1)).
• Treat an incident as significant if it has caused or may cause substantial operational disruption or financial loss to your entity, or has affected or may affect other natural or legal persons by causing considerable material or moral harm, judged by the number of users affected and the market share concerned, the incident's duration, the lack of alternatives, the geographic extent, the degree of disruption to the service, the impact on crucial economic and social activity, the importance of the affected systems or information, the dependence of other strategic sectors and the effect on social and economic activity or public safety, and reputational damage; regulation may add sector-specific factors (Article 15(3)).
• Submit to the CSIRT-AD an initial notification of the incident without undue delay and in any event within 24 hours of becoming aware of it, stating where applicable whether the incident is presumed to result from an unlawful or malicious act (Article 15(4)(a)).
• Send the CSIRT-AD any intermediate notifications needed, or that it requests, to update or complete the initial notification and to report on the incident's progress while it remains unresolved (Article 15(4)(b)).
• Send the CSIRT-AD a final report no later than one month after the initial notification, with a detailed description of the incident, its severity and impact, the type of threat or root cause likely to have triggered it, and the mitigation measures applied and ongoing (Article 15(4)(c)).
• Where appropriate, notify the recipients of your service, without undue delay, that a significant incident is likely to affect them and what measures or remedies they can take in response.
• Notify the competent authority, through the CSIRT-AD and without delay, of any significant cyber threat to your essential or important service that, in your view, could result in a significant incident, meaning a threat that can give rise to an incident that is significant under Article 15(3); where appropriate, tell the recipients of your services who may be affected by the threat, without undue delay, what measures or remedies they can apply, and the threat itself. The initial notification, intermediate notifications and final report of Article 15(4) apply to threat notifications as well (Article 15(2) and (4)).
• Make your incident and threat notifications through the Information Security Delegate you designated under Article 18; a notification under the Law does not replace the duty to report to the authorities facts that may be a crime, or any notification you owe other bodies under their own rules. Where public awareness is needed to prevent or handle an incident, or disclosure is in the public interest, the ANC-AD may, after consulting you, inform the public of the incident or require you to do so if you have not (Article 15(7), (8), (10) and (11)).
• This duty reaches the same entities as this Law's risk-management obligations: essential and important entities offering a service the national competent authorities have designated in an Annex I or Annex II sector, which for Annex II includes Andorra's online marketplace, online search engine and social networking services platform providers, where you employ 50 or more people or your annual turnover or annual balance sheet total exceeds ten million euros (Article 2(1)); it also reaches an entity of any size in the cases Article 2(2) lists (public electronic communications networks and services, trust service providers, top-level domain registries and DNS providers, public administration entities, sole providers of a service in Andorra, entities whose disruption could affect public security, public order or public health or induce systemic risks, entities critical for their sector or for interdependent sectors, and entities identified as critical or equivalent to critical), whatever its size, so the 24-hour and 72-hour clocks run for those entities too.
• You may miss the Article 15(1) and 15(2) deadlines in duly justified cases, such as force majeure (Article 15(5)).

Decret 417/2022, del 12 d’octubre del 2022, pel qual s’aprova el Reglament de l’Esquema nacional de seguretat del Principat d’Andorra, arts. 3, 8, 12, 14, 15 i 16 · Read the law's page

• This duty reaches an essential or important entity within Llei 22/2022: an entity offering a service the national competent authorities have designated in an Annex I or Annex II sector that meets the Law's scope, which is its size thresholds (Article 2(1)) or, whatever its size, one of the entity types listed in Article 2(2) (reached by declaring that you operate an essential service, are a bank or securities firm, handle health records or run a social network platform). The Regulation applies to all the information assets needed to provide the essential or important services (article 3).
• Have your management body start, manage and control the information security management system, and delegate the tasks to your Information Security Delegate where you have one (article 8).
• Classify each service and information asset by availability, integrity and confidentiality to a security class and level, and re-evaluate the class whenever the criteria change and at least once a year (articles 6(4) and 10); keep an inventory of the basic information assets that support the services (article 11); review the action plan for the information security management system at least once a year or on any change to the services (article 8(2)(b)); and keep a register of every change to assets, classes and measures, available to your supervising authority (article 13(1)(a)).
• Draw up a statement of applicability listing the reference security measures for each information asset, have your management body approve it, and send it to the competent authority within six months of your identification as an essential or important entity (article 12). A reference measure may be left out only with a stated justification: a specific risk assessment shows it is not needed, an equivalent measure is in place, or the implementation guide says so (article 12(1)(d)).
• Adopt the security measures listed in your statement of applicability (article 14). Your Information Security Delegate may decline a measure that does not reduce the risks, costs too much compared with the risk reduction, or covers risks other measures already cover, but must then tell your management body of the risks of not implementing it so that it can decide whether to approve the measures (article 14(2)).
• Have the information assets that support your essential or important services audited externally every year against the maturity levels the Regulation tabulates, with minimum levels falling due between 1 March 2025 and 31 March 2029, and again whenever the services, the information assets that support them or a significant number of the required security measures change substantially (article 16(1)-(2)).
• Correct the deficiencies an audit finds; failing to correct deficiencies that expose you to significant incidents can lead to sanction proceedings under Llei 22/2022 (article 16(5)).
• Choose providers that give sufficient guarantees for the services, technology and products they supply, and require each provider to present an external security audit dated less than twelve months before its offer, carried out under internationally recognized cybersecurity frameworks (article 15(1)). Expect those guarantees to include that the services, technology or products are on the ANC-AD register of certified components. Where you cannot obtain registered components, cannot find a provider with that audit, or the provider already holds recognized certificates, you may ask the ANC-AD to authorize the purchase or engagement (ANC-AD has two months, and silence is a refusal).
• Do not let a provider you select subcontract without your prior written authorization, specific or general; the provider must tell you of any planned addition or replacement of subcontractors so that you can object or change provider. Require each later subcontractor to present an external security audit dated less than twelve months before the subcontracting starts, with the same route to ANC-AD authorization where no audited provider is available (article 15(2)).
• Bind each subcontracted provider by a written contract that sets, as a minimum, the security and service level, penalties for breach, any jurisdictional limits on where the provider's information assets sit, confidentiality and security training for the people who handle the information, all necessary security measures, flow-down of the same security duties to any further subcontractor by written contract, assistance with your duties under articles 12 to 15 of the Law, the conditions for rescuing the service, the information, audit and inspection rights that you and your supervising authority need, and the provider's duty to tell you at once if it cannot meet the security level (article 15(3)).
• Give the ANC-AD each year a summary of the contracts and subcontracts concluded under article 15, referring to the register of certified components contracted in each case, and tell it each year which firms performed the external audits and which standard frameworks they used (article 15(5)).