BrazilANEEL Resolution 964 of 2021, notification of higher-impact cyber incidents
Resolução Normativa ANEEL nº 964, de 14 de dezembro de 2021, arts. 2º, 6º e 7º
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www2.aneel.gov.br/cedoc/ren2021964.pdfIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a concessionaire, permit holder or authorized operator of electric-power services or facilities, and the entities responsible for system operation, energy trading or the management of sector charges (reached by declaring that you operate an essential service). It applies from (article 11).
- Notify the designated sectoral coordination team of each higher-impact cyber incident that substantially affects the security of your installations, your operation, the services to users or data, as soon as you are aware of the incident and its size (article 6).
- Include in the notification an analysis of the cause and impact and the mitigation actions adopted (article 6, paragraph 1).
- Adopt a confidential and non-discriminatory procedure for sharing information on threats and other cybersecurity information, with anonymity allowed (article 7).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
ANEEL (Agência Nacional de Energia Elétrica), which fixes the administrative fines imposed on concessionaires, permit holders and authorized operators of electric-power facilities and services (article 3, item X, of Lei 9.427 of 1996).
What this law does
Article 6 requires agents to notify the designated sectoral coordination team of the higher-impact cyber incidents that substantially affect the security of installations, operations, services to users or data. Article 6 requires the notification to be made as soon as the agent is aware of the incident and its size. Article 6 requires the notification to include an analysis of the cause and impact and the mitigation actions adopted.
Article 7 requires agents to adopt a procedure for sharing information on threats in a confidential and non-discriminatory way. Article 11 states that the Resolution enters into force on .
When LexLint raises it
When your app profile says your app runs an essential service.