Provides telecom services, in Albania

Law No. 25/2024 On Cybersecurity, arts. 23, 26(3) and 44-45 · Read the law's page

• This binds the public and private subjects named in Annexes I and II of the law that the National Authority for Cybersecurity (AKSK) identifies as operators of critical or important information infrastructure under article 12, among them energy, transport, banking, health, public electronic communications, ICT service management and, in Annex II, digital service providers (reached by declaring that you are an essential or important entity). Article 50(1) gave subjects 24 months from the law's entry into force on 3 May 2024 to harmonise their activity with it.
• Report every type of cybersecurity incident to the National CSIRT and your sectoral CSIRT within 4 hours of identifying the incident (article 23(3)).
• For a significant incident, within 72 hours of identifying it update the information you reported and give an initial assessment of the incident, including its severity and impact and, where there are any, indicators of compromise (article 23(3)).
• Within one month after notifying the incident, submit a final report to the National CSIRT that describes the incident and its impact, the type of threat or main cause, the measures applied and continuing, and any cross-border impact; for an ongoing incident also submit a progress report while it lasts (article 23(5) and (6)).
• Notify without delay the users of your services who may be affected by a significant cybersecurity incident, telling them what measures they can take in response (article 26(3)).
• Cooperate with the National CSIRT and your sectoral CSIRT in every phase of a cybersecurity incident on your information infrastructure (article 23(2)).

Law No. 54/2024 On Electronic Communications in the Republic of Albania, arts. 54, 56 and 184 · Read the law's page

• This binds undertakings that provide public electronic communications networks or electronic communications services available to the public in Albania (reached by declaring that you provide telecom services).
• Take appropriate and proportionate technical and organisational measures, including encryption where appropriate, to manage the risks to the security of your networks and services and to prevent and minimise the impact of security incidents on users and on other networks and services (article 54(1)).
• If you provide internet access, take measures to protect your users against DDoS attacks (article 54(2)).
• Notify AKEP and the authority responsible for cybersecurity without delay of a cybersecurity incident that has affected the operation of your networks, systems or services (article 54(3)).
• Give AKEP the information it needs to assess the security of your networks and services, including your documented security policies, and submit the results of a security audit by a qualified independent body or a competent authority, at your own cost (article 56(3)).

AKEP Regulation on Network and Service Security, arts. 6, 11 and 12 · Read the law's page

• This binds undertakings that provide public electronic communications networks or electronic communications services available to the public in Albania, whatever the technology (article 3), and is reached by declaring that you provide telecom services.
• As soon as possible after a security incident, make an initial impact assessment against the Annex 2 matrix and classify the incident as of low, medium or high impact (article 6(1) and (2)).
• Notify AKEP electronically within 24 hours of recording a security incident that is classified as of medium or high impact, with the data available then: the date and hour, the affected service, the nature of the incident, its preliminary impact and its duration (article 11(1)).
• File Annexes 1 and 2 with AKEP within 72 hours of recording the incident, send updated annexes whenever the reported data change significantly, and file the annexes with updated data as the final report within 30 calendar days of recording the incident (article 11(2) to (4)).
• Keep all data on the incident, including logs, investigative evidence and internal communications, for at least 12 months from filing the final notification, and answer AKEP's requests for further information without delay (article 11(7)).

AKEP Regulation on Network and Service Security, arts. 7, 10 and 12 · Read the law's page

• This binds undertakings that provide public electronic communications networks or electronic communications services available to the public in Albania, whatever the technology (article 3), and is reached by declaring that you provide telecom services.
• Adopt a written internal information security policy approved by your management, publish it, communicate it to all personnel, and review it at least once a year or after any significant security incident or major change in your infrastructure (article 7(1), point a).
• File with AKEP once a year, by the end of February and covering the previous calendar year, a report on the security measures you applied and the state of security of your networks and services, in the format of Annex 3 (article 10(1)).
• If you earn more than 50,000,000 lek a year from electronic communications, have service contracts with central or local government bodies, have more than 2,000 subscribers, or run internet interconnection lines that bring wholesale internet to Albania, file with AKEP either an ISO 27001 certificate with its certification audit report or a security audit report by the competent state authority for cybersecurity, at your own cost (article 10(2)).