Brazil Launches Public Consultation No. 50

Brazil is launching Public Consultation No. 50 to revise the definition of a weak password within the mandatory minimum cybersecurity standards for Customer Premises Equipment (CPE), as outlined in Law No. 2436, enacted on March 7th, 2023. Following the implementation of the CPE security requirements, manufacturers, certification bodies, and testing laboratories reached out to the Certification and Numbering Management (ORCN) to address challenges in compliance and to report a semantic error in section 3.1.3, which defines a weak password.

This public consultation aims to clarify these issues and amend the definition of a weak password to enhance cybersecurity measures. Stakeholders are invited to submit their comments from October 15th to October 24th, 2024.

Proposed Modification

Article 1: Revise numeral 3.1.3 of the Annex of Law No. 2436, establishing the following definition for a weak password:

3.1.3. Weak password: a password that does not meet at least one of the following criteria:

• a) At least 8 characters in length.
• b) Contains at least one uppercase letter, one lowercase letter, and one number.

Article 2: This amendment will take effect upon publication in the ANATEL Electronic Attention Bulletin.

This initiative underscores Brazil's commitment to strengthening cybersecurity frameworks for CPE and addressing industry concerns.

Source

Link to Source - https://apps.anatel.gov.br/ParticipaAnatel/Home.aspx