S.L. 399.48 чл. 30Implementation and enforcement. S.L. 460.35. S.L. 460.35.

(1) In order to ensure compliance with the requirements of this Part, the Authority may issue binding instructions, however so described, which may include such measures as it may consider necessary to remedy a security incident or to prevent one from occurring when a significant threat has been identified, and may include time-limits for implementation of such measures by providers of public electronic communications networks or publicly available electronic communications services, or by gateway operators.

(2) The Authority may require a provider of public electronic communications networks or publicly available electronic communications services, or gateway operators to:

(a) provide information needed to assess the security and integrity of its networks and services, including documented security policies;

(b) submit to a security audit carried out by a qualified independent body or by the Authority, as the Authority may determine, and make the results thereof available to the Authority in order to assess amongst other matters the following:

(i) the level of security, integrity and resiliency of any public electronic communications network and, or service, or of the network elements operated by a gateway operator; and AND SERVICES (GENERAL)

(ii) compliance with any guidelines or binding instructions that the Authority may establish in accordance with the provisions of this Part:

Provided that the cost of any such audit shall be paid by the provider or gateway operator concerned:

(c) establish the necessary contingency plans for the purpose of complying with the requirements under this Part;

(d) submit such contingency plans to the Authority as the Authority may reasonably determine; and

(e) publish information regarding the measures it has in place in order to meet the obligations under this Part.

(3) The Authority shall investigate cases of non-compliance and the effects thereof on the security of the networks and services.

(4) The Authority may, where it considers necessary, require the assistance of the Computer Security Incident Response Team (‘CSIRT’) designated in accordance with the Measures for High

Common Level of Security of Network and Information Systems Order.

(5) The Authority shall, where appropriate and in accordance with national law, consult and cooperate with the relevant national law enforcement authorities, the competent authorities within the meaning of the Measures for High Common Level of Security of Network and

Information Systems Order, and the Information and Data Protection Commissioner.