AlbaniaAKEP Regulation On Organisational and Technical Security Measures, Security Programme and Reporting
AKEP Regulation on Network and Service Security, arts. 7, 10 and 12
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This binds undertakings that provide public electronic communications networks or electronic communications services available to the public in Albania, whatever the technology (article 3), and is reached by declaring that you provide telecom services.
- Adopt a written internal information security policy approved by your management, publish it, communicate it to all personnel, and review it at least once a year or after any significant security incident or major change in your infrastructure (article 7(1), point a).
- File with AKEP once a year, by the end of February and covering the previous calendar year, a report on the security measures you applied and the state of security of your networks and services, in the format of Annex 3 (article 10(1)).
- If you earn more than 50,000,000 lek a year from electronic communications, have service contracts with central or local government bodies, have more than 2,000 subscribers, or run internet interconnection lines that bring wholesale internet to Albania, file with AKEP either an ISO 27001 certificate with its certification audit report or a security audit report by the competent state authority for cybersecurity, at your own cost (article 10(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Authority of Electronic and Postal Communications (AKEP), whose regulation treats a violation as an administrative offence fined under article 184 of Law No. 54/2024 (article 12).
Settledness
- As of
- Open questions
- Has the regulation, approved without an assigned number, been published in the Official Gazette?
What this law does
Article 7(1) point a requires undertakings to adopt a written internal information security policy approved by management and reviewed at least once a year. Article 10(1) requires undertakings to file a report on the security measures applied with AKEP once a year, by February of each year. Article 10(2) requires an undertaking with more than 2,000 subscribers, or one that meets another listed condition, to file an ISO 27001 certificate or a security audit report with AKEP.
Article 10(2) makes the undertaking bear the cost of that audit in every case. Article 12 treats a violation of the regulation that is not a criminal offence as an administrative offence fined under article 184 of Law No. 54/2024.
When LexLint raises it
When your app profile says your app provides telecom services.