Runs an essential service, in Chile

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 4 y 7 · Read the law's page

• This binds an institution that provides a service qualified as essential under article 4 (a State body, a public-service concessionaire, or a private institution in electricity, fuels, water, telecommunications, digital infrastructure, digital and managed information technology services, transport, banking, financial services and payment means, social-security administration, postal and courier services, institutional health care, or pharmaceutical production or research), and an institution the Agency designates an operator of vital importance (reached by declaring that you operate an essential service). The Agency identifies the specific infrastructure, processes or functions so qualified by exempt resolution. These duties apply from 1 January 2025.
• Apply permanently measures to prevent, report and resolve cybersecurity incidents, which may be technological, organizational, physical or informational (article 7).
• Implement the protocols and standards the Agencia Nacional de Ciberseguridad sets, and the particular cybersecurity standards issued under the sectoral regulation that applies to you (article 7).

Decreto N° 295, Reglamento de Reporte de Incidentes de Ciberseguridad de la Ley N° 21.663, arts. 2, 3, 5, 6 y 8 a 13 · Read the law's page

• This binds a public or private institution that provides a service qualified as essential and an institution qualified as an operator of vital importance (reached by declaring that you operate an essential service). The regulation details the reporting duty of article 9 of the Act, which applies from 1 March 2025.
• Report to the CSIRT Nacional every cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, affect the integrity or confidentiality of computer assets or the availability of a network or system, involve unauthorized use of or entry into networks or systems, or affect systems holding personal data (articles 2 and 3).
• Make every report through the notification platform the Agency provides, and leave all personal data out of it (articles 6 and 8).
• Send an early warning within a maximum of three hours from becoming aware of the incident, with at least the identification of the institution, its cybersecurity delegate, the date and time you learned of it, the signs of the incident and the assets affected (articles 5 and 9).
• Send a second report after seventy-two hours from becoming aware of the incident, or within twenty-four hours if you are an operator of vital importance whose essential service is affected, updating all the information with an initial assessment of severity and impact and any indicators of compromise (article 10).
• If you are an operator of vital importance, implement and report your action plan within no more than seven calendar days from becoming aware of the incident, including a data recovery programme, technical and administrative responsibilities and an estimate of the time to restore services (article 11).
• Within a maximum of fifteen calendar days from sending the early warning, and once the incident has been managed, send a final report; while it is not managed, send a partial report updated every fifteen days (articles 12 and 13).

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 5 y 8 · Read the law's page

• This binds an operator of vital importance, meaning a provider of essential services, or a private institution that is not one but whose designation is indispensable because of its critical role or its exposure to cybersecurity risks, that the Agency qualifies as such by resolution because its service depends on computer networks and systems and its interruption would significantly affect public security and order, the continuous provision of essential services or the functions of the State (article 5). It also binds an institution for the specific infrastructure, processes or functions the Agency identifies by exempt resolution as essential (article 4, last paragraph) (reached by declaring that you operate an essential service). These duties apply from 1 March 2025.
• Implement a continuous information security management system to determine the risks that can affect the security of your networks, computer systems and data and the operational continuity of the service (article 8, letter a).
• Draft and implement operational continuity and cybersecurity plans, certify them under article 28, and review them at least every two years (article 8, letter c).
• Continuously run review operations, exercises, drills and analyses of your networks and systems to detect harmful programs or actions, and communicate the information to the CSIRT Nacional as the regulation determines (article 8, letter d).
• Take prompt measures to reduce the impact and spread of a cybersecurity incident, including restricting the use of or access to computer systems if necessary (article 8, letter e).
• Inform potentially affected persons, as far as they can be identified and when the Agency requires it, of incidents or cyberattacks that could seriously compromise their information or computer networks and systems (article 8, letter g).
• Designate a cybersecurity delegate who acts as the Agency's counterpart (article 8, letter i).

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 9 y 27 · Read the law's page

• This binds every public and private institution named in article 4, that is an institution that provides a service qualified as essential or is qualified as an operator of vital importance (reached by declaring that you operate an essential service). These duties apply from 1 March 2025.
• Report to the CSIRT Nacional, as soon as possible, any cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, or affect systems holding personal data (articles 9 and 27).
• Send an early warning within a maximum of three hours from becoming aware of the incident (article 9, letter a).
• Within a maximum of seventy-two hours, send an update with an initial assessment of the incident, its severity and impact, and indicators of compromise if available; if you are an operator of vital importance whose essential service is affected, send it within a maximum of twenty-four hours (article 9, letter b).
• Within a maximum of fifteen calendar days from the early warning, send a final report with a detailed description of the incident, the type of threat or main cause, the mitigation measures applied and under way, and any cross-border repercussions (article 9, letter c).
• If you are an operator of vital importance, also report your action plan to the CSIRT Nacional as soon as you adopt it, no later than seven calendar days after becoming aware of the incident (article 9).