BrazilANEEL Resolution 964 of 2021, cybersecurity policy of electric-power agents
Resolução Normativa ANEEL nº 964, de 14 de dezembro de 2021, arts. 1º, 4º, 5º e 9º
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www2.aneel.gov.br/cedoc/ren2021964.pdfIn force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a concessionaire, permit holder or authorized operator of electric-power services or facilities, and the entities responsible for system operation, energy trading or the management of sector charges (reached by declaring that you operate an essential service). It applies from (article 11).
- Adopt a cybersecurity policy that covers, at a minimum, your cybersecurity objectives, data classification, technical controls, incident logging and analysis, resilience tests and procedures for prevention, handling and response to cyber incidents (article 4).
- Apply at least one cybersecurity maturity model every year (article 4, item II).
- Have the policy approved by your Board of Directors or an equivalent collegiate body, designate an officer responsible for it, and review and update it periodically (article 5).
- Keep records and send ANEEL or the designated sectoral coordination team, whenever requested, the maturity model results, the cyber risks identified with their treatment and the data of your incident response teams (article 9).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
ANEEL (Agência Nacional de Energia Elétrica), which fixes the administrative fines imposed on concessionaires, permit holders and authorized operators of electric-power facilities and services (article 3, item X, of Lei 9.427 of 1996).
What this law does
Article 1 applies the Resolution to concessionaires, permit holders and authorized operators of electric-power services or facilities and to the entities responsible for system operation, energy trading or the management of sector charges. Article 4 requires the cybersecurity policies to contain, at a minimum, the content it lists. Article 4 requires the policies to provide for applying at least one cybersecurity maturity model every year.
Article 5 requires the policy to be approved by the Board of Directors or an equivalent collegiate body. Article 5 requires the agent to designate an officer responsible for the cybersecurity policy. Article 9 requires agents to keep records and to send ANEEL or the designated sectoral coordination team, on request, the maturity model results, the cyber risks identified with their treatment, and the data of the incident response teams. Article 11 states that the Resolution enters into force on .
When LexLint raises it
When your app profile says your app runs an essential service.