ANATEL published the new Act No. 77 on Jan 5^th, 2021. This act approves the Cyber Security Requirements for Telecommunication Equipment.

This new Act will be in force after 180 days of its publication.

The key points are:

• This act is applicable to all terminal devices with connection to internet and telecommunications network infrastructure equipment
• Item 4.1, when request the approval of devices under the scope of this act, ANATEL will request a Declaration Letter from applicant with the following content:

1. 1. 1. 1. Indicating that the product was developed in compliance with the principle of security by design
         2. Relating to which requirements of this document the equipment and its supplier meet at that moment
         3. Recognizing that they are aware that cybersecurity requirements are subject to updates, including regulatory and administrative ones, in line with technological development, with the emergence of new threats or vulnerabilities.

• Item 4.2, when ANATEL implements the Market Surveillance program, they can assess whether the product and its supplier maintain compliance with the requirements of this Act. So far, there is no Market Surveillance procedure.
• Items 5 and 6 of Act No. 77, describe the specific requirements for Cyber Security, such as:

1. 1. 1. 1. 1. Software/Firmware update
            2. Remote management
            3. Installation and Operation
            4. Access to the device configuration
            5. Personal data