ANATEL Announces Act No. 2436 with Mandatory Cybersecurity Requirements for Customer Premises Equipment (CPE) Devices
At 10:28 PM on March 7, 2023, ANATEL made a groundbreaking announcement regarding the cybersecurity requirements for Customer Premises Equipment (CPE) devices used to connect to the internet service provider's network. The new Act, named Act No. 2436, will impose mandatory cybersecurity requirements on all CPE devices and will come into force on March 10th, 2024.
The Act will include various requirements, including password requirements, defense mechanisms against unauthorized access attempts, and mandates for vendors to establish a Coordinated Vulnerability Disclosure Policy as well as policies for releasing software and firmware updates to address security vulnerabilities. It will encompass several types of CPE devices, including cable modems, xDSL modems, ONT/ONU devices, fixed wireless access routers/modems, satellite routers/modems for fixed broadband access, and wireless routers/access points.
These cybersecurity requirements align with various cybersecurity standards, such as ANATEL Resolution No. 740, ANATEL Act No. 77, NST Special Publication 800-63B, Broadband Forum – TR-181 Issue-2, ISO/IEC 29147:2018, and ISO/IEC 30111:2019.
This Act signifies a vital advancement in the battle against cyber threats and unauthorized access attempts. By instituting mandatory cybersecurity standards for CPE devices, ANATEL aspires to foster a safer and more secure internet environment for all users. Consequently, products that provide internet connectivity must comply with these new essential requirements introduced by the Act, as new technical evaluations for cybersecurity will be necessary.
These definitions are further clarified in the references below:
- Regulation for Conformity Assessment and Homologation of Telecommunications Products, approved by Resolution No. 715, on October 23, 2019;
- Cyber Security Requirements for Telecommunications Equipment, approved by Act No. 77, on January 5, 2021;
The OCDs are collaborating with ANATEL to assess the impact on renewals and the implications of on-site testing.
Source - https://informacoes.anatel.gov.br/legislacao/index.php/component/content/article?id=1505