M67 (Traficom Regulation 67)

Mon, 01 Jan 0001 00:00:00 +0000

M67 (Määräys teletoiminnan tietoturvasta — Regulation on information security in telecommunications operations) is Finland’s binding technical regulation for the information security of public telecommunications. It is issued by Traficom (Finnish Transport and Communications Agency) under the Act on Electronic Communications Services (917/2014), sections 244, 247 and 272, and implements obligations stemming from the European Electronic Communications Code (Directive (EU) 2018/1972, Article 40) and the ePrivacy Directive (2002/58/EC, Article 4). The familiar “M67” label dates from FICORA’s Regulation 67 A/2015 M (4 March 2015). Traficom issued a full rewrite on 16 February 2024; it entered into force on 1 September 2024 (with cryptography, testing/assessment, and 3GPP standards obligations applying from 1 December 2024) and repealed the 2015 text. Unlike voluntary frameworks (ISO 27001) or product certification schemes (EUCC, NESAS), M67 is mandatory for in-scope operators, supervised by Traficom / NCSC-FI, with sanctions under AECS sections 330–332, 340 and 349. There is no separate “M67 certificate”: operators must implement, document, and continuously maintain compliance.

Traficom on François Duthilleul

M67 (Traficom Regulation 67)