Industry

Reporting incidents with significant impact on the provision of electronic communications networks and services pursuant to ANCOM President’s Decision no. 512/2013

The providers of public electronic communications networks or of publicly available electronic communications services have the obligation to submit to ANCOM a notification on the existence of an incident with significant impact on the security and integrity of electronic communications networks and services.

 

The security and integrity of electronic communications networks and services is the ability of an electronic communications network or service to resist to accidental events or malicious actions which can compromise or affect the continuity of the provision of networks and services at a performance level equivalent to that ensured before the occurrence of the event.

 

The incident is an event which can directly or indirectly affect or pose threats to the security and integrity of electronic communications networks and services; the effects caused by network maintenance works, scheduled and notified in due time to the users, are not deemed incidents.
The incident with significant impact is an incident which affects more than 5,000 connections for at least 60 minutes.
 
The initial notification
The providers of public electronic communications networks or of publicly available electronic communications services have the obligation to submit to ANCOM an initial notification on the existence of an incident with significant impact on the security and integrity of electronic communications networks and services, no later than 1 p.m. of the working day following the day when the incident with significant impact was detected.
The initial notification is transmitted electronically to the e-mail address incidente(at)ancom.org.ro and will briefly include the elements related to the incidents with significant impact. The elements which the initial notification must comprise are detailed in art.4 para.(3) of the ANCOM President’s Decision no.512/2013.
 
 
The final notification
The providers of public electronic communications networks or of publicly available electronic communications services have the obligation to submit to ANCOM a final notification on the existence of an incident with significant impact on the security and integrity of electronic communications networks and services, within two weeks from its detection, by completing the standard reporting form under annex no.2 to Decision no.512/2013, in compliance with the filling out instructions specified in annex no.3to Decision no.512/2013.
Where, at the time of transmission of the final notification, the providers do not have available all the information requested in the standard reporting form, they have the obligation to send ANCOM an additional notification with the respective information, as soon as this information is available, but no later than 3 weeks from detecting the incident with significant impact.
The final notification and the additional notification are to be transmitted to the ANCOM exclusively through the significant impact incident reporting form, available on ANCOM’s website, as an electronic form to which an extended electronic signature has been incorporated, attached or logically associated, based on a qualified certificate not suspended or not revoked at that time and generated by means of a secure electronic signature device.
 
Additional information:
  • The form for reporting incidents that affected the security and integrity of electronic communications networks and services (annex no.2 to Decision no.512/2013) is available here.
     
  • The instructions for completing the form for reporting incidents that affected the security and integrity of electronic communications networks and services (annex no.3 to Decision no.512/2013) are available here.