AndorraDecret 417/2022, National Security Scheme Regulation, Security Management System and Audit
Decret 417/2022 del 12 d’octubre del 2022, pel qual s’aprova el Reglament de l’Esquema nacional de seguretat del Principat d’Andorra, arts. 3, 8, 12, 14, 15 i 16
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This duty reaches an essential or important entity within Llei 22/2022: an entity in an Annex I or Annex II sector that meets the Law's size thresholds (reached by declaring that you operate an essential service, are a bank or securities firm, handle health records or run a social network platform). The Regulation applies to all the information assets needed to provide the essential or important services (article 3).
- Have your management body start, manage and control the information security management system, and delegate the tasks to your Information Security Delegate where you have one (article 8).
- Draw up a statement of applicability listing the reference security measures for each information asset, have your management body approve it, and send it to the competent authority within six months of your identification as an essential or important entity (article 12).
- Adopt the security measures listed in your statement of applicability (article 14).
- Have the information assets that support your essential or important services audited externally every year against the maturity levels the Regulation tabulates, with minimum levels falling due between and (article 16).
- Choose providers that give sufficient guarantees for the services, technology and products they supply, and require each provider to present an external security audit dated less than twelve months before its offer (article 15(1)). Expect those guarantees to include that the services, technology or products are on the ANC-AD register of certified components, with a request to ANC-AD for authorisation where none is available (ANC-AD has two months, and silence is a refusal).
- Bind each subcontracted provider by a written contract that sets the security and service level, penalties for breach, any jurisdictional limits on where the provider's information assets sit, confidentiality, audit and inspection rights and the provider's duty to tell you if it cannot meet the security level (article 15(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 34.3(b) of Llei 22/2022 classifies a breach of a regulatory provision or technical security instruction on the minimum precautions essential and important entities must adopt as a serious violation, a fine of 15,001 to 30,000 euros. Article 34.4(a) classifies a breach of a regulatory provision that is not serious as a minor violation, a warning or a fine of 500 to 15,000 euros.
- Rule
- Fixed only
- As of
- Minimum
- 500
- Currency
- EUR
- Fixed cap
- 30,000
Who enforces it
Enforcement body
The Agència Nacional de Ciberseguretat del Principat d'Andorra (ANC-AD, Andorra's National Cybersecurity Agency) holds the sanctioning power under Article 30 of Llei 22/2022, including over entities supervised by the Autoritat Financera Andorrana (AFA), at AFA's request.
Settledness
- As of
- Open questions
- The extraordinary-audit paragraph of article 16(1) refers to a two-year period for the next ordinary audit while the same paragraph makes the ordinary external audit annual; which period applies?
What this law does
Decret 417/2022 approves the Reglament de l’Esquema nacional de seguretat (ENS-AD), which extends to all information assets needed to provide the essential or important services defined in Llei 22/2022. The Regulation makes the entity's management body responsible for starting, managing and controlling the entity's information security management system. Entities within its scope must adopt the security measures listed in their statement of applicability.
The statement of applicability must be sent to the competent authority within six months of the entity's identification as an essential or important entity. Essential and important entities are subject to an ordinary external security audit every year. Essential and important entities must choose providers that give sufficient guarantees for the services, technology and products supplied to them.
Essential and important entities must require providers to present an external security audit dated less than twelve months before the provider's offer. The Regulation was amended by Decret 417/2024 of . Any breach of a regulatory provision or technical security instruction issued under Llei 22/2022 is an infraction under that Law.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.