The government has approved amendments to Albania’s cybersecurity law. The changes expand obligations for public institutions and operators of critical and important information infrastructure. They also strengthen protection against cyberattacks and introduce new administrative penalties.

Operators must submit self-declarations to the National Cyber Security Authority (AKSK). These must detail the technical, organisational and operational security measures they have implemented. Operators must also declare how they host and manage their systems, networks and information infrastructure.

Failure to submit declarations on time or disclose hosting arrangements carries fines of ALL 500,000 to ALL 2 million. Incorrect, incomplete or outdated information carries fines of ALL 200,000 to ALL 1 million. Failure to implement security measures required by the AKSK carries fines of ALL 500,000 to ALL 1 million. Other violations can attract fines of up to ALL 10 million.

The amendments also strengthen cooperation between the AKSK, public institutions and cybersecurity structures. They require operators to report incidents to national and sectoral cybersecurity incident response teams (CSIRTs).

In addition, the AKSK may simulate attacks on critical infrastructure systems by exploiting vulnerabilities identified through proactive scans. The law also establishes a Cyber Intelligence Cooperation Group to assess threats and exchange information.

Certain operators must use cybersecurity-certified information and communications technology products, services and processes. Local self-government bodies will also fall within the public administration infrastructure classified as highly critical.

/a.p./