AlbaniaAKEP Regulation On Organisational and Technical Security Measures, Incident Reporting
AKEP Regulation on Network and Service Security, arts. 6, 11 and 12
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds undertakings that provide public electronic communications networks or electronic communications services available to the public in Albania, whatever the technology (article 3), and is reached by declaring that you provide telecom services.
- As soon as possible after a security incident, make an initial impact assessment against the Annex 2 matrix and classify the incident as of low, medium or high impact (article 6(1) and (2)).
- Notify AKEP electronically within 24 hours of recording a security incident that is classified as of medium or high impact, with the data available then: the date and hour, the affected service, the nature of the incident, its preliminary impact and its duration (article 11(1)).
- File Annexes 1 and 2 with AKEP within 72 hours of recording the incident, send updated annexes whenever the reported data change significantly, and file the annexes with updated data as the final report within 30 calendar days of recording the incident (article 11(2) to (4)).
- Keep all data on the incident, including logs, investigative evidence and internal communications, for at least 12 months from filing the final notification, and answer AKEP's requests for further information without delay (article 11(7)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Authority of Electronic and Postal Communications (AKEP), whose regulation treats a violation as an administrative offence fined under article 184 of Law No. 54/2024 (article 12).
Settledness
- As of
- Open questions
- Has the regulation, approved without an assigned number, been published in the Official Gazette, and which fine tier of article 184 of Law No. 54/2024 applies to a failure to report an incident?
What this law does
Article 11(1) requires an electronic communications undertaking to notify AKEP electronically within 24 hours of recording a security incident. Article 11(1) makes that notification mandatory only where the incident is classified as of medium or high impact. Article 11(2) requires Annexes 1 and 2 to be filed within 72 hours of recording the incident. Article 11(4) requires the updated Annexes 1 and 2 as the final report within 30 calendar days of recording the incident.
Article 11(7) requires undertakings to keep all data on an incident for at least 12 months from filing the final notification. Article 12 treats a violation of the regulation that is not a criminal offence as an administrative offence fined under article 184 of Law No. 54/2024. Article 14 provides that the regulation enters into force on the date of its approval by the Governing Council of AKEP. The regulation was approved by decision no. 8 of of the Governing Council of AKEP.
When LexLint raises it
When your app profile says your app provides telecom services.