The Albanian government has approved proposed amendments to the cybersecurity law that would establish a dedicated cyber intelligence group, introduce new obligations for operators of critical and important information infrastructure, and impose fines for non-compliance.
Under the draft law, the cyber intelligence cooperation group would include representatives of the National Cybersecurity Authority, the Ministry of Foreign Affairs, the Ministry of the Interior, the State Intelligence Service (SHISH), the General Staff of the Armed Forces and the Defence Intelligence and Security Agency.
The National Cybersecurity Authority would chair the group. Its duties would include sharing early warnings about potential cyber threats, assessing their impact on national security, the economy and public services, and making recommendations to improve national cybersecurity strategies and policies.
The group would hold regular or extraordinary meetings at the Authority’s request, depending on what is needed to identify and address threats. The prime minister would issue an order setting out how the group is organised and operates, along with procedures for sharing information and coordinating among institutions.
The draft law would also require operators of critical and important information infrastructure to submit a self-declaration to the Authority detailing their technical, organisational and operational cybersecurity measures. The information must be accurate, complete and up to date.
Operators would also have to declare how their systems, networks and information infrastructure are hosted and managed. The declaration must identify the entity that provides hosting or manages the technology infrastructure, specify the type and location of that infrastructure, and describe the technical and organisational measures in place.
The draft law provides for administrative penalties for breaching these requirements. Operators that miss the deadline for submitting their self-declaration or fail to declare how their systems are hosted and managed would face fines ranging from 500,000 to 2 million lek. Submitting inaccurate, incomplete or outdated information in a self-declaration would carry a fine of 200,000 to 1 million lek.
Failure to implement measures required by the Authority to identify, filter, restrict, block or neutralise indicators of compromise and cyberattacks would carry fines ranging from 500,000 to 1 million lek.
The amendments would also require certain operators to use information and communications technology products, services and processes certified for cybersecurity. The requirement would apply to operators on a list approved by the Council of Ministers on the basis of an assessment of impact and risk level.
The National Cybersecurity Authority would also assume the powers of the national cybersecurity certification body and authorise organisations to conduct conformity assessments under the national certification scheme.
The draft law also provides for the Authority and the government operator responsible for managing government infrastructure to establish sector-specific cybersecurity incident response teams. Operators would have to report incidents to the relevant teams and cooperate in sharing information, coordinating their response and implementing prevention and recovery measures.
The Council of Ministers has proposed the amendments to Law No. 25/2024 on Cybersecurity for parliamentary consideration and approval. If approved, the amendments would enter into force 15 days after publication in the Official Gazette.