Overview

ANATEL Act Nº 2436 introduces mandatory cybersecurity requirements for Customer Premises Equipment (CPE) devices connecting to internet service provider networks. This legislation will take effect on March 10th, 2024.

Key Mandates

The new Act includes several crucial mandates such as:

• Password requirements
• Defense mechanisms against unauthorized access attempts
• Vendor obligations to establish Coordinated Vulnerability Disclosure Policies
• Procedures for releasing software/firmware updates to address security vulnerabilities

This applies to various types of CPE devices, including:

• Cable modems
• xDSL modems
• ONUs (Optical Network Units)
• ONTs (Optical Network Terminals)
• Access points
• Switches for internet
• Modems for Fixed Wireless Access (FWA)
• Wideband satellite modems

Moreover, all CPE devices that are already approved must undergo testing during renewal processes to ensure compliance with these new regulations.