Duty LXD-7306
Provides telecom services, in Iceland
Security Policy and Risk Management of Telecommunications Companiessince 5 lines
Log nr. 70/2022 um fjarskipti, Art. 78 and 103 · Read the law's page
- Applies to a telecommunications company that provides public electronic communications services or operates a public electronic communications network in Iceland. Reached by declaring that you provide telecom services.
- Set yourself a documented security policy and procedures to assess, manage and minimise the risks that may threaten your operations (Article 78).
- Protect, as far as you can, information that passes over the network against being lost, damaged or altered by accident or accessed by an unauthorised person (Article 78).
- Carry out a risk assessment at regular intervals on the basis of the security policy, and set and reassess security measures accordingly (Article 78).
- Have a documented response plan and a plan for continuous and uninterrupted operation and service, to limit damage if your operations are seriously disrupted (Article 78).
Notification of Security Incidents by Telecommunications Companies and Information to Userssince 6 lines
Log nr. 70/2022 um fjarskipti, Art. 80 and 81(1) · Read the law's page
- Applies to a telecommunications company that operates a public electronic communications network or provides public electronic communications services in Iceland. Reached by declaring that you provide telecom services.
- Notify the national cybersecurity team and the Post and Telecom Administration without delay of every serious security incident that threatens the security or operation of public networks or services (Article 80).
- Notify the Post and Telecom Administration without delay if there is a risk that the security or confidentiality of information on telecommunications networks will be breached, or if it has been (Article 80).
- In judging how serious an incident is, look in particular to the number of users affected, how long it lasts, its geographical spread and scale, the extent to which the network or service is affected, and its effect on economic and social activity (Article 80).
- Include in the notification any possible outsourcing arrangement and any possible contagion effect, even across borders (Article 80).
- Inform the users who may be affected, free of charge, of a special or extensive threat to a network or service, and of the security measures and remedies available (Article 81(1)).