AndorraDecret 418/2022, Critical Infrastructure Regulation, Cybersecurity Incidents of Critical Entities
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This duty reaches an entity that the ANC-AD has designated as a critical entity, or as an entity equivalent to a critical entity (reached by declaring that you operate an essential service); article 13 of the Regulation adds these duties to the incident duties of Llei 22/2022.
- Notify your security incidents on the same terms that Llei 22/2022 sets for an essential entity, to the CSIRT-AD without delay (see the row for articles 14 and 15 of that Law for the clocks) (article 13(2)).
- When a cybersecurity incident is of medium or high level, provide all the data and evidence of the incident that the ANC-AD, the CSIRT-AD or the Police Corps of Andorra asks of you (article 13(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 34.2(c) of Llei 22/2022 classifies a repeated failure, from the second, to notify incidents with a significant disruptive effect as a very serious violation, a fine of 30,001 to 100,000 euros. Article 34.3(b) classifies a breach of a regulatory provision on the minimum precautions as a serious violation, 15,001 to 30,000 euros, and Article 34.4(a) a lesser breach of a regulatory provision as a minor violation, a warning or 500 to 15,000 euros.
- Rule
- Fixed only
- As of
- Minimum
- 500
- Currency
- EUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Agència Nacional de Ciberseguretat del Principat d'Andorra (ANC-AD, Andorra's National Cybersecurity Agency) holds the sanctioning power under Article 30 of Llei 22/2022, including over entities supervised by the Autoritat Financera Andorrana (AFA), at AFA's request.
Settledness
- As of
- Open questions
- How do the 24-hour initial notification and the 72-hour notification of Articles 14 and 15 of Llei 22/2022 apply to an incident of medium or high level under article 13 of the Regulation?
What this law does
A critical entity or entity equivalent to a critical entity must give ANC-AD, CSIRT-AD or the Police Corps all data and evidence of a medium or high level cybersecurity incident that they request. Critical entities and equivalent entities must notify their security incidents as Llei 22/2022 requires of essential entities. Under Llei 22/2022 a repeated failure to notify incidents with a significant disruptive effect is a very serious infraction.
When LexLint raises it
When your app profile says your app runs an essential service.