Runs an essential service, in Belgium

Loi du 17 février 2022 (article 105 de la loi du 13 juin 2005 relative aux communications électroniques), mesures de sécurité supplémentaires pour la fourniture de services mobiles 5G · Read the law's page

• If you are a mobile network operator offering a 5G network, obtain an authorization granted jointly by the ministers concerned before you use an element of your 5G network (Article 105, paragraph 1).
• If a royal decree extends the authorization duty to your category (a mobile virtual network operator, the public company ASTRID, or a private-network operator designated as critical-infrastructure or essential-service operator), obtain the same authorization before you use an element of your 5G network (Article 105, paragraph 2).
• If you hold the list of sensitive zones, pass it only to people who need to know it and have access to it for their functions or mission in deploying and operating the 5G network (Article 105, paragraph 7).

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 30-33 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use in the course of your activities or to provide your services.
• Cover at minimum: policies on risk analysis and information-system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in the acquisition, development and maintenance of your network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on the use of cryptography and, where applicable, encryption; personnel security, access-control policies and asset management; multi-factor or continuous authentication and secure voice, video, text and emergency communications where needed; and your own coordinated vulnerability-disclosure policy.
• Have your management body approve these risk-management measures, supervise their implementation, and answer for a violation of this duty; you remain responsible for your own risk analysis and for the choice and implementation of the measures.
• This binds an essential entity or an important entity drawn from Annex I or Annex II; Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex I's digital-infrastructure entry separately names a DNS service provider, a top-level-domain name registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a managed service provider and a managed security service provider, so a service in any of those lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 34-37 · Read the law's page

• Notify the national CSIRT of any significant incident without undue delay, following the arrangements set out in the protocol between the CSIRT and the National Crisis Centre.
• Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact.
• Follow with an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise.
• Submit an interim report if the national CSIRT or the competent sectoral authority asks for one, and a final report no later than one month after the incident notification, describing the incident in detail, its severity and impact, the likely threat or root cause, the mitigation measures applied and in progress, and any cross-border impact.
• If the incident is still ongoing when the final report falls due, submit a progress report at that point, followed by a final report within one month of the final handling of the incident (Article 35, paragraph 1, point 5).
• If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant incident that affects your trust services (Article 35, paragraph 2).
• Where public awareness is necessary to prevent or manage the significant incident, or where disclosure is otherwise in the public interest, the national CSIRT may itself inform the public of the incident or require you to do so.
• This binds the same essential and important entities as this jurisdiction's companion risk-management row, on the same Annex I and Annex II scope.