BrazilAnatel Cybersecurity Requirements for CPE (Customer Premises Equipment)
Ato nº 2.436 de 7 de março de 2023 (Superintendência de Outorga e Recursos à Prestação, Agência Nacional de Telecomunicações), as amended by Ato nº 7.344, de 15 de junho de 2023; issued under the Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, approved by Resolução nº 740, de 21 de dezembro de 2020, and the Regulamento de Avaliação da Conformidade e de Homologação de Produtos para Telecomunicações, approved by Resolução nº 715, de 23 de outubro de 2019
In force since .
A product security requirements rule binding private bodies.
- Obligation class
- Security, Disclosure
What it requires
- This binds a manufacturer or supplier of a cable modem, xDSL modem, ONU or ONT, fixed-wireless-access (FWA) router or modem, satellite-broadband router or modem, or wireless router or access point marketed to the general public in Brazil to connect a subscriber to an internet service provider's network; it does not reach a mobile app, a SaaS product, or any product that does not perform this connectivity function.
- Do not ship the device with weak, blank, or identical-across-all-units default credentials, and do not derive an initial password from information easy to obtain by scanning network traffic, such as a MAC address; alternatively, force the user to set a new password meeting the strength rules the first time the device is used or after a factory reset.NIST CSF 2.0PR.PS-06
- Print any factory-set password on a label on the device and restore it whenever the device is reset to factory settings; require any user-set password to be at least 8 characters with an uppercase letter, a lowercase letter, a number, and a special character, and check new passwords against a password dictionary or an equivalent method to block weak or commonly used ones.NIST CSF 2.0PR.AA-03
- Do not hard-code credentials or cryptographic keys in the device's software or firmware source code, encrypt or hash any password, key, or credential you store or transmit, implement inactive-session timeouts, ship with unused communication ports and services disabled, and let the user disable non-essential communication features.NIST CSF 2.0PR.PS-06NIST CSF 2.0PR.PS-01
- Publish a clear support policy stating how long and in what circumstances you will provide security updates, and provide security updates free of charge for at least 2 years after the product's launch or for as long as you keep distributing it to consumers, whichever period is longer.NIST CSF 2.0PR.PS-02
- Provide a dedicated, securely reachable channel, such as an HTTPS web form or a PGP-encrypted email address, for a customer, end user, or third party to report a security vulnerability, and publish a coordinated vulnerability-disclosure policy on your website covering how you want to be notified, what a reporter should expect, and your process's scope and limits.NIST CSF 2.0ID.RA-08
- Maintain a public, Portuguese-language support page listing known vulnerabilities in your products together with their mitigations, and keep making corrected software or firmware available.NIST CSF 2.0RS.CO-02NIST CSF 2.0PR.PS-02
- Demonstrate this compliance to Anatel's conformity-assessment agent when you seek homologação for the device, or by presenting your own Cybersecurity Policy showing you meet the full set of supplier requirements; Anatel can suspend a homologação it already granted if it later finds a security flaw or vulnerability, and a suspended homologação bars the product from being distributed in the Brazilian market until the problem is fixed.NIST CSF 2.0GV.OC-03
- This duty took effect and its Annex, which carries the substantive requirements above, has been mandatory since .
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P10A vulnerability management plan is developed and implemented.
- PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for authorized individuals, processes, and devices.
- PR.PT-P2The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established
- PR.AA-03Users, services, and hardware are authenticated
- PR.PS-01Configuration management practices are established and applied
- PR.PS-02Software is maintained, replaced, and removed commensurate with risk
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
1 more
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
This Ato creates an administrative product-conformity requirement enforced through homologação, not a criminal offense; no provision of the Ato or its Annex attaches imprisonment or a criminal fine to non-compliance.
Who enforces it
Enforcement body
The Superintendência de Outorga e Recursos à Prestação sets these requirements and Anatel oversees them through the device's conformity assessment and homologação; Resolução nº 740/2020's Regulamento de Segurança Cibernética directs that cybersecurity aspects be considered in that homologação procedure (art. 22), and Anatel's own published guidance states it monitors homologated products in the market on an ongoing basis and can suspend a product's homologação, barring its distribution in Brazil, if it finds a security flaw. No published record of a specific enforcement action under this Ato is confirmed in the primary text.
What this law does
A manufacturer or supplier of specified consumer customer-premises equipment, meaning a cable modem, xDSL modem, ONU or ONT, fixed-wireless-access or satellite-broadband router or modem, or wireless router or access point sold in Brazil to connect a subscriber to an internet service provider's network, must meet mandatory minimum cybersecurity requirements before Anatel will certify the device.
The device may carry no default, blank, or weak passwords and no password shared across all units as manufactured. It may also carry no credentials or cryptographic keys hard-coded in the device's software or firmware. The manufacturer must provide at least two years of free security updates after launch or for as long as the product stays on the market, whichever is longer.
It must also maintain a published, securely reachable channel plus a coordinated vulnerability-disclosure policy for reporting a security flaw. Anatel enforces the requirement through the device's conformity assessment (homologação) and can suspend a product's homologação, which bars its distribution in Brazil, if it later finds a security flaw.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .