Brazil ANATEL Act nº 2436 with cyber security requirements for assessing the conformity of CPE (Customer Premises Equipment) became in force on March 10th, 2024. This Act establishes a set of mandatory cybersecurity requirements CPE devices used to connect to the Internet service provider’s network, such as:
a) Cable modem;
b) xDSL modem;
c) ONU, ONT;
d) Router or modem intended for fixed wireless access (FWA – Fixed Wireless Access);
e) Router or modem for fixed broadband access via satellite;
f) Wireless router or access point.
On 9th of March ANATEL released the Official Letter nº 83 and here are the main topics:
• ANATEL will accept to homologate new devices and renew certificates without the Cyber security testing, as long as the applicant approved formally the project to OCD (give the formal acceptance to OCD proposal) until Mar 9th. In these cases, applicant will need to present the cyber security testing report until July 6th, 2024. If applicant fail to present the report until this date, ANATEL will suspend the certificate.
• This exception is an alternative to applicants and if this option is adopted, the applicant will need to sign a declaration letter committing to present the cyber security report until the deadline defined by ANATEL and, in case of failure during the testing, remove all units sold to Brazil market or arrange a recall of those units, according to the conditions described in the Brazilian Consumer Law.
• Reinforce that new approvals or renewals started as for Mar 10th will need to present the cyber security testing report without any exception to obtain the ANATEL approval.