Brazil ANATEL has published new Act No. 2436, which includes requirements for assessing the cybersecurity of customer premises equipment. The new act takes effect on 10 March 2024.
The act establishes a set of mandatory cybersecurity requirements for customer premises equipment used to connect to internet service provider networks:
Cable modems
xDSL modems
ONU and ONT
Routers or modems for fixed wireless access (FWA)
Routers or modems for fixed broadband access via satellite
Wireless routers or access points

The main requirements cover the following:
Password requirements
Requirements to protect against unauthorized access
Requirements on suppliers, such as having a coordinated vulnerability disclosure policy and a policy for releasing software and firmware updates to fix security vulnerabilities
All these requirements are consistent with
ANATEL Resolution No. 740
ANATEL Act No. 77
NIST Special Publication 800-63B
Broadband Forum TR-181 Issue 2
ISO/IEC 29147:2018
ISO/IEC 30111:2019
and other cybersecurity standards.