Duty LXD-7080
Runs an essential service, in Brazil
ANEEL Resolution 964 of 2021, cybersecurity policy of electric-power agentssince 5 lines
Resolução Normativa ANEEL nº 964, de 14 de dezembro de 2021, arts. 1º, 4º, 5º e 9º · Read the law's page
- This binds a concessionaire, permit holder or authorized operator of electric-power services or facilities, and the entities responsible for system operation, energy trading or the management of sector charges (reached by declaring that you operate an essential service). It applies from (article 11).
- Adopt a cybersecurity policy that covers, at a minimum, your cybersecurity objectives, data classification, technical controls, incident logging and analysis, resilience tests and procedures for prevention, handling and response to cyber incidents (article 4).
- Apply at least one cybersecurity maturity model every year (article 4, item II).
- Have the policy approved by your Board of Directors or an equivalent collegiate body, designate an officer responsible for it, and review and update it periodically (article 5).
- Keep records and send ANEEL or the designated sectoral coordination team, whenever requested, the maturity model results, the cyber risks identified with their treatment and the data of your incident response teams (article 9).
ANEEL Resolution 964 of 2021, notification of higher-impact cyber incidentssince 4 lines
Resolução Normativa ANEEL nº 964, de 14 de dezembro de 2021, arts. 2º, 6º e 7º · Read the law's page
- This binds a concessionaire, permit holder or authorized operator of electric-power services or facilities, and the entities responsible for system operation, energy trading or the management of sector charges (reached by declaring that you operate an essential service). It applies from (article 11).
- Notify the designated sectoral coordination team of each higher-impact cyber incident that substantially affects the security of your installations, your operation, the services to users or data, as soon as you are aware of the incident and its size (article 6).
- Include in the notification an analysis of the cause and impact and the mitigation actions adopted (article 6, paragraph 1).
- Adopt a confidential and non-discriminatory procedure for sharing information on threats and other cybersecurity information, with anonymity allowed (article 7).