The government has approved changes to the cybersecurity bill, tightening obligations for operators of critical and important information infrastructures. The package provides for fines that in some cases reach up to 10 million lek, while also expanding the role of security institutions in the new oversight and response architecture.
High fines for failure to report and inaccurate data
According to the version approved at the Council of Ministers meeting on November 12, operators will have new obligations to report cyber incidents, declare security measures, and provide information on how information systems are administered.
For failing to submit, within the deadline, the self-declaration of security measures and for failing to declare how systems are administered, fines ranging from 500,000 to 2 million lek are предусмотрed. Meanwhile, for inaccurate, incomplete, or outdated data, sanctions range from 200,000 to 1 million lek.
What must be submitted to AKSK
The bill requires the entities concerned to declare to the National Cybersecurity Authority the technical, organizational, and operational measures they have taken to protect their systems.
In addition, they must provide information on the entity that administers the technological infrastructure, the type of hosting, the location of the infrastructure, and the security measures being implemented. This means more mandatory reporting to the state and greater administrative responsibility for operators considered highly important.
SHISH and the military join the cyber intelligence group
One of the most sensitive points of the package is the creation of a cooperation group for cyber intelligence. Under the bill, this structure will include representatives of AKSK, the Ministry for Europe and Foreign Affairs, the Ministry of Interior, SHISH, the General Staff of the Armed Forces, and the Defense Intelligence and Security Agency.
The group will be led by AKSK and will be tasked with exchanging information on possible cyber threats, assessing the impact on national security, the economy, and public services, as well as providing recommendations on cybersecurity policies.
Mandatory incident reporting and confidential list of operators
The changes stipulate that operators must report every cybersecurity incident to the national and sectoral incident response teams, and cooperate with these structures for the prevention of, response to, and recovery from attacks.
The bill also expands AKSK’s responsibilities in the field of protecting citizens and vulnerable groups, as well as in cybersecurity certification. Likewise, the list of operators of critical and important information infrastructures will be confidential, will be approved by a decision of the Council of Ministers, and will be updated at least once every two years.
Local government also included among highly important sectors
The package also includes the local government administration in the category of sectors of high importance for cybersecurity. This significantly expands the circle of institutions and entities that will be subject to the new requirements and administrative sanctions.
For other administrative violations provided for in the law, the government envisages fines that may reach up to 10 million lek, a measure that increases pressure on operators while simultaneously increasing institutional control over digital infrastructures.
The changes approved by the government strengthen the reporting and punitive framework in the name of cybersecurity, but at the same time also expand the access of state structures to information and the administration of critical systems.
The real debate remains the balance between the need for protection from attacks and the expansion of the powers of security institutions, especially when the list of operators is kept confidential and control is further concentrated in the executive.