S.L. 399.48 чл. 28Security of networks and services.

(1) Providers of public electronic communications networks or of publicly available electronic communications services, or gateway operators shall take appropriate and proportionate technical and organisational measures to appropriately manage the risks posed to the security of networks and services:

Provided that having regard to the state of the art, such measures shall ensure a level of security appropriate to the risk presented. In particular, measures, including encryption where appropriate, shall be taken to prevent and minimise the impact of security incidents on users and on other networks and services.

(2) Providers of public electronic communications networks or of publicly available electronic communications services, or gateway operators shall notify without undue delay the Authority of:

(a) any security incident that has a significant impact on the operation of networks or services; or

(b) failure or serious degradation of connectivity provided by a gateway operator.

(3) The measures referred to under sub-regulations (1) and (2) shall at least:

(a) ensure that personal data can be accessed only by authorised personnel for legally authorised purposes; AND SERVICES (GENERAL)

(b) protect personal data stored or transmitted against accidental or unlawful destruction, or accidental loss or alteration and unauthorised or unlawful storage, processing, access or disclosure; and

(c) ensure the implementation of a security policy with respect to the processing of personal data:

Provided that the Authority may audit the measures taken by the providers of public electronic communications networks or of publicly available electronic communications services, or gateway operators, and issue recommendations on best practice concerning the level of security which such measures should achieve.

(4) In order to determine the significance of the impact of a security incident, where available the following parameters shall, in particular, be taken into account:

(a) the number of users affected by the security incident;

(b) the duration of the security incident;

(c) the geographical spread of the area affected by the security incident;

(d) the extent to which the functioning of the network or service is affected; and

(e) the extent of the impact on economic and societal activities.

(5) Where appropriate, the Authority shall inform the competent authorities in other Member States and ENISA of any security incidents as may be notified to it in accordance with this regulation. The Authority may also inform the public and, or may require the providers of public electronic communications networks or of publicly available electronic communications services, or gateway operators to inform the public of any such security incident, where it determines that disclosure of the security incident is in the public interest.

(6) Once a year, the Authority shall submit a summary report to the European Commission and to ENISA on the notifications received and the action taken in accordance with this Part.

(7) In the case of a particular and significant threat of a security incident in public electronic communications networks or publicly available electronic communications services, providers of such networks or services and gateway operators shall inform any of their users who may be potentially affected by such a threat of any possible protective measures or remedies which they can take. Where appropriate, such providers and gateway operators shall also inform their users of the threat itself.