BrazilAnatel Cybersecurity Regulation for Telecommunications, security policy and controls
Resolução nº 740 de 21 de dezembro de 2020 (Anatel), Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, arts. 2º, 6º, 7º, 13, 19 e 20
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a provider of collective-interest telecommunications services other than a small provider, with the extensions in articles 2-A and 2-B of the Annex (reached by declaring that you provide telecommunications services). The Regulation entered into force on and a provider had 180 days to comply, until (article 27).
- Prepare, implement and maintain a Cybersecurity Policy approved by your board of directors or an equivalent collegiate body, with a director responsible for it, and keep it available to Anatel on request (articles 6, 13 and 14).
- Use telecommunications products and equipment only from suppliers that hold a cybersecurity policy compatible with the Regulation and undergo periodic independent audits, and make the audit results available to Anatel on request (article 7).
- Run cybersecurity vulnerability assessment cycles carried out by an independent assessing body or qualified company, and submit the results to Anatel (articles 10 and 19).
- Send Anatel information on your Critical Telecommunications Infrastructures, covering at least network data and geographic mapping of physical structures and routes (article 20).
- Publish an extract of your Cybersecurity Policy with its non-sensitive information on your website, and give Anatel a report on the execution of the Policy every year or when it asks (articles 15 and 16).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Anatel (Agência Nacional de Telecomunicações), which applies the administrative sanctions of Law 9,472 of 1997 to an infringement of the Regulation (article 25).
What this law does
Article 2 of the Regulation applies to all providers of collective-interest telecommunications services, except small providers. Article 6 requires the company to prepare, implement and maintain a Cybersecurity Policy. Article 7 requires a provider to use telecommunications products and equipment from suppliers that hold a compatible cybersecurity policy and undergo periodic independent audits.
Article 13 requires the Cybersecurity Policy to be approved by the board of directors or an equivalent collegiate body. Article 19 requires the vulnerability assessment cycles to be carried out by an independent assessment body or qualified company. Article 20 requires a provider to send Anatel information on its Critical Telecommunications Infrastructures, covering at least network data and geographic mapping of physical structures and routes.
Article 25 subjects an infringement of the Regulation to the administrative sanctions of Law 9,472 of . The approving Resolution states that it enters into force on . Article 27 requires a provider to comply with the Regulation within 180 days of its entry into force.
When LexLint raises it
When your app profile says your app provides telecom services.