AndorraDecret 418/2022, Critical Infrastructure Regulation, Security Plan, Audit and Supplier Guarantees
Decret 418/2022 del 12 d’octubre del 2022, pel qual s’aprova el Reglament d’infraestructures crítiques del Principat d’Andorra, arts. 3, 5, 10 i 12
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This duty reaches an entity that the ANC-AD has designated as a critical entity, or as an entity equivalent to a critical entity, because at least one infrastructure it manages in Andorra is an identified critical infrastructure (reached by declaring that you operate an essential service). The ANC-AD notifies the entity within one month of its identification (articles 3 and 5).
- Have your management body create the entity security plan without undue delay, run it, keep its documents under access control, adapt it to the directions of your competent authority or the ANC-AD, and make it available to your competent authority. The plan must contain at least your general security policy, the essential services that depend on each critical infrastructure, the dependencies between critical infrastructures, a risk analysis of each, an inventory of subcontracted services, and the technical and organisational measures in force or ready to activate (article 10).
- Send each new version of the entity security plan to the ANC-AD without undue delay and in any case within one week from the day after its approval, and tell the ANC-AD without undue delay of any temporary security measure not included in the plan (article 10(3)).
- Have the critical infrastructures audited externally at least every year, and also after a substantial change to the infrastructures entered in the national catalogue, against the maturity levels the Regulation tabulates, with minimum levels falling due between and ; keep the previous year's audit reports available to the competent authorities by the end of the first quarter (article 12).
- Correct the deficiencies an audit finds; failing to correct deficiencies that expose you to significant incidents can lead to sanction proceedings under Llei 22/2022 (article 12(5)).
- Ensure that your subcontracted providers give sufficient guarantees and that the services, technology and products you acquire are on the ANC-AD register of certified components, or obtain the ANC-AD's authorisation (it has two months, and silence is a refusal); require each provider to present an external security audit dated less than eighteen months before its offer, and each later subcontractor an audit dated less than eighteen months before it starts (article 12(6)).
- Give the ANC-AD each year a summary of the contracts and subcontracts concluded under article 12(6), and tell it each year which firms performed the external audits and which standard frameworks they used (article 12(6)(f)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 34.3(b) of Llei 22/2022 classifies a breach of a regulatory provision or technical security instruction on the minimum precautions that protect critical infrastructures, networks and information systems as a serious violation, a fine of 15,001 to 30,000 euros. Article 34.4(a) classifies a breach of a regulatory provision that is not serious as a minor violation, a warning or a fine of 500 to 15,000 euros.
- Rule
- Fixed only
- As of
- Minimum
- 500
- Currency
- EUR
- Fixed cap
- 30,000
Who enforces it
Enforcement body
The Agència Nacional de Ciberseguretat del Principat d'Andorra (ANC-AD, Andorra's National Cybersecurity Agency) holds the sanctioning power under Article 30 of Llei 22/2022, including over entities supervised by the Autoritat Financera Andorrana (AFA), at AFA's request.
Settledness
- As of
- Open questions
- Which entities has the ANC-AD designated as critical entities or equivalent entities, since the plan, audit and supplier duties run against them from the notification of their designation?
What this law does
Decret 418/2022 approves the Reglament d’infraestructures crítiques (RIC-AD), which applies to the critical infrastructures of critical entities and entities equivalent to critical entities, to those entities and to the competent authorities. ANC-AD approves the designation of an entity as a critical entity or an entity equivalent to a critical entity. An entity qualifies for designation if at least one infrastructure it manages in Andorra is an identified critical infrastructure.
A designated entity's management body must create the entity security plan without undue delay. The entity security plan must contain at least the documents Article 10 lists. A designated entity's management body must communicate each new version of the plan to ANC-AD within a maximum of one week from the day after its approval. Critical entities and equivalent entities are subject to an ordinary external security audit at least every year.
Critical entities and equivalent entities must ensure that their subcontracted providers give sufficient guarantees for the services, technology and products supplied. Critical entities and equivalent entities must ensure that the services, technology and products they acquire are listed in the ANC-AD register of certified components. Critical entities and equivalent entities must require providers to present an external security audit dated less than eighteen months before the provider's offer.
Failure to adopt measures correcting audit deficiencies that expose the entity to significant incidents may lead to sanction proceedings under Llei 22/2022. The Regulation was amended by Decret 416/2024 of .
When LexLint raises it
When your app profile says your app runs an essential service.