AlbaniaLaw On Cybersecurity, Incident Reporting by Operators of Critical and Important Information Infrastructure
Law No. 25/2024 On Cybersecurity, arts. 23, 26(3) and 44-45
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the public and private subjects named in Annexes I and II of the law that the National Authority for Cybersecurity (AKSK) identifies as operators of critical or important information infrastructure under article 12, among them energy, transport, banking, health, public electronic communications, ICT service management and, in Annex II, digital service providers (reached by declaring that you are an essential or important entity). Article 50(1) gave subjects 24 months from the law's entry into force on to harmonise their activity with it.
- Report every type of cybersecurity incident to the National CSIRT and your sectoral CSIRT within 4 hours of identifying the incident (article 23(3)).
- For a significant incident, within 72 hours of identifying it update the information you reported and give an initial assessment of the incident, including its severity and impact and, where there are any, indicators of compromise (article 23(3)).
- Within one month after notifying the incident, submit a final report to the National CSIRT that describes the incident and its impact, the type of threat or main cause, the measures applied and continuing, and any cross-border impact; for an ongoing incident also submit a progress report while it lasts (article 23(5) and (6)).
- Notify without delay the users of your services who may be affected by a significant cybersecurity incident, telling them what measures they can take in response (article 26(3)).
- Cooperate with the National CSIRT and your sectoral CSIRT in every phase of a cybersecurity incident on your information infrastructure (article 23(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 44 defines the failure to report an incident as an administrative offence, and article 45 sets a fine for it.
Penalty structure
Article 45(1) point a fines the administrative offences of article 44 points a and d 1,000,000 to 10,000,000 lek.
- Rule
- Fixed only
- As of
- Minimum
- 1,000,000
- Currency
- ALL
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The National Authority for Cybersecurity (Autoriteti Kombëtar për Sigurinë Kibernetike), the regulatory body responsible for supervising and enforcing the cybersecurity legislation in the Republic of Albania (article 7(1)).
Settledness
- As of
- Open questions
- Which incidents does the Director General's regulation under article 23(8) treat as significant, and what reporting format and deadlines does it set beyond the 4-hour and 72-hour clocks of article 23(3)?
What this law does
Article 23(3) obliges operators of critical and important information infrastructure to report every type of cybersecurity incident to the National CSIRT and the sectoral CSIRT within 4 hours of identifying the incident. Article 23(3) also requires an operator, for a significant incident, to update the information and make an initial assessment of severity and impact within 72 hours of identifying the significant incident.
Article 23(5) requires a final report to the National CSIRT within one month after the incident notification. Article 26(3) requires operators to notify without delay the users of their services who are potentially affected by a significant cybersecurity incident. Article 44 point a makes the failure to report a cybersecurity incident under article 23(3) an administrative offence.
Article 45(1) point a sets a fine of 1,000,000 to 10,000,000 lek for the administrative offences in points a and d of article 44. Article 50(1) gives the subjects responsible for cybersecurity 24 months from the law's entry into force to harmonise their activity with it. The National Authority for Cybersecurity states that the law entered into force on .
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, provides telecom services, is a bank or is a securities firm.