Amendments to the Cybersecurity Act – Scope and Key Aspects
In State Gazette, No. 25 of 29 March 2022, amendments to the Cybersecurity Act were promulgated. These amendments introduce clarifications and additions to the existing national framework for network and information security, affecting the powers of the competent authorities, coordination between them, and certain obligations of entities subject to the Act.
The amendments are linked to the implementation of applicable European cybersecurity law and to the need for more effective functioning of the national system for managing cyber risks and incidents.
Scope of the Cybersecurity Act
The adopted amendments refine provisions concerning public authorities, operators of essential services, and digital service providers that already fall within the scope of the Act.
The Act continues to apply to organisations whose activities depend on networks and information systems and where disruption may have a significant impact on public or economic activities.
Risk Management and Security Measures
The amendments reaffirm the requirement for organisations within the scope of the Act to implement appropriate technical and organisational measures for network and information security, including measures for:
- managing risks to the security of networks and information systems;
- preventing and mitigating incidents;
- ensuring continuity of the services provided.
Incident Notification
The changes clarify provisions related to incident management and reporting, while preserving the obligation to notify competent authorities of incidents that have, or may have, a significant impact on networks, information systems, or services.
The objective is to improve coordination and information exchange within the national cybersecurity framework.
Institutional Coordination and Oversight
The amendments also affect the allocation of functions and powers among authorities involved in cybersecurity policy implementation, aiming at clearer application of the supervisory and coordination mechanisms provided by the Act.
Significance for the Public Sector and Organisations within Scope
The adopted changes are particularly relevant to:
- public authorities;
- operators of essential services;
- digital service providers,
The amendments represent refinements and additions within the existing legal framework, aimed at clearer application of network and information security requirements and more effective functioning of the national cybersecurity framework.
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
