LexLint.ioBeta

Know the law your code answers to.

Law / Andorra

Llei 22/2022, Cybersecurity Risk-Management Obligations

Llei 22/2022, del 9 de juny, arts. 12, 13, 17 i 18

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • This duty reaches your service where you employ 50 or more people, or your annual turnover or annual balance sheet total exceeds ten million euros, and you fall within an Annex I essential-entity sector (energy, transport, banking, financial-market infrastructure, health, water, digital infrastructure, public administration) or an Annex II important-entity sector, which names providers of online marketplaces, online search engines and social networking services platforms among Andorra's digital service providers.
  • Adopt technical and organisational measures proportionate to the cybersecurity risks facing your networks and information systems, covering at minimum a security policy for your critical infrastructure and information systems, a risk-management policy, incident management, business continuity and crisis management, supply-chain security, security in the acquisition, development and maintenance of your systems, testing and audit procedures, and the use of cryptography and encryption.NIST CSF 2.0GV.PO-01
  • Designate an Information Security Delegate, a natural person, a unit or a collegiate body, as the point of contact and technical coordination between your organisation and the competent national authority and the computer security incident response team (CSIRT)-AD, and designate a substitute to assume the role during an absence, vacancy or illness.NIST CSF 2.0GV.RR-02
  • Adopt the security measures the National Security Scheme (Esquema Nacional de Seguretat) sets for your sector, which you may supplement with recognised international standards.NIST CSF 2.0GV.OC-03

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Article 34.4(a) classifies non-compliance with a regulatory provision or technical security instruction issued under this Law as a minor violation, a warning or a fine of 500 to 15,000 euros, unless it rises to a serious violation. Article 34.3(a) classifies non-compliance with the rest of this Law's obligations, which is where a breach of Articles 12, 13, 17 or 18 falls by default, as a serious violation, 15,001 to 30,000 euros. A breach of Articles 12, 13, 17 or 18 does not reach the very-serious tier (30,001 to 100,000 euros), which Article 34.2 reserves for identification failures, uncorrected supervision-chapter deficiencies, and the incident-handling and notification failures Articles 14 and 15 impose.

Rule
Fixed only
As of
Minimum
500
Currency
EUR
Fixed cap
30,000

Who enforces it

Enforcement body

The Agència Nacional de Ciberseguretat del Principat d'Andorra (ANC-AD, Andorra's National Cybersecurity Agency) holds the sanctioning power under Article 30, including over entities supervised by the Autoritat Financera Andorrana (AFA, the Andorran Financial Authority), at AFA's request. AFA is itself the competent national authority, coordinating with ANC-AD, for the banking and financial-market-infrastructure sectors.

Settledness

As of
Open questions
  • Does the 50-employee or ten-million-euro size threshold under Article 2.1 test a digital service provider on a standalone basis, or does an affiliated or linked enterprise's headcount and turnover count toward it?
  • Has the Esquema Nacional de Seguretat that Article 12 requires essential and important entities to apply been adopted in the technical detail Article 6.4(d) contemplates, or does an entity's Article 12 duty currently rest on the Law's own text alone?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Llei 22/2022, del 9 de juny, de mesures per a la seguretat de les xarxes i dels sistemes d'informació (the Law of on Measures for the Security of Networks and Information Systems) applies to essential and important entities, defined by its Annex I and Annex II sector lists, that employ 50 or more people or whose annual turnover or annual balance sheet total exceeds ten million euros.

Article 13 requires these entities to adopt technical and organisational measures proportionate to the cybersecurity risks facing the networks and information systems they use to provide their services, in order to achieve a high level of resilience, covering at minimum a security policy for their critical infrastructure and information systems, a risk-management policy, incident management, business continuity and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems, testing and audit procedures, and the use of cryptography and encryption.

Annex II names digital service providers, specifically providers of online marketplaces, online search engines and social networking services platforms, among the important entities this duty reaches, and Annex I separately reaches the banking and financial-market-infrastructure sectors and public administration entities of the Andorran government.

Each essential or important entity must also designate an Information Security Delegate (Delegat de la Seguretat de la Informació, DSI), a natural person, a unit or a collegiate body, as the point of contact and technical coordination between the entity and the competent national authority and computer security incident response team (CSIRT)-AD.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.

Back to the example  ·  Lint your app

Page updated .