Runs an essential service, in El Salvador

Ley de Ciberseguridad y Seguridad de la Información, Decreto Legislativo No. 143, 12 de noviembre de 2024, arts. 2, 4, 6, 8 y 21-24 · Read the law's page

• Apply a security-by-design approach in the development, purchase, provisioning, implementation and management of computer systems and technology equipment, so that cybersecurity and information security is the original, cross-cutting and permanent objective of how they operate (article 3(a)).
• Implement a permanent cybersecurity and information-security management system that determines and mitigates the risks to your computer systems, equipment, networks, telecommunications infrastructure and the processes run on them (article 6(a)).
• Draw up a cybersecurity and information-security strategy that follows national or international standards or reference frameworks (article 6(b)).
• Keep an up-to-date record of every action that makes up the cybersecurity and information-security management system (article 6(c)); not having one is a serious infraction (article 20(a)).
• Draw up and implement operational-continuity and cybersecurity plans, which the competent authority approves and which are reviewed periodically (article 6(d)).
• Run continuous reviews, exercises, drills and analyses of your measures, systems, equipment, networks and processes to detect the elements that put cybersecurity at risk (article 6(e)).
• Create or designate one or more areas responsible for implementing and reviewing these measures, with the independence to act without prior obstacles, in close coordination with the competent authority (article 6(i)).
• Comply with the information requests and instructions of the competent authority, in the time, form and specifics it sets (article 6(j)), including an order to stop using a computer system or any part of it (article 21(i)).
• Facilitate the management, audit and inspection work of the competent authority, and comply with the standards, protocols and technical criteria the Agencia issues (article 6(k) and (n)).
• This binds an entity that administers public resources, carries out acts of public administration or has an incidence on the nation's critical infrastructure, whatever its form, nature or legal status, so it reaches a private owner or operator of a system that supports an essential service to the public (reached by declaring that you operate an essential service). The Agencia de Ciberseguridad del Estado qualifies the operators of critical infrastructure by reasoned resolution ratified by the President of the Republic (articles 2 and 8).

Ley de Ciberseguridad y Seguridad de la Información, Decreto Legislativo No. 143, 12 de noviembre de 2024, arts. 6(f), 6(h), 6(l), 8(h) y 21(a) · Read the law's page

• Apply immediately and effectively the measures needed to prevent, report and resolve cybersecurity and information-security threats (article 6(f)).
• Take timely, expeditious and efficient action to reduce the impact and stop the spread of a cybersecurity or information-security incident (article 6(g)); failing to is a very serious infraction (article 21(e)).
• Send the competent authority, in the time, form and specificity it sets, the cybersecurity and information-security reports it requires (article 6(h)).
• When the Agencia determines it, inform the people who may be affected, as far as they can be identified, about an incident that could seriously compromise their information and about the measures they can take, through the means the Agencia sets (article 6(l)).
• After an incident, deliver to the potentially affected persons or to the investigating authorities truthful, sufficient and timely information about it when the Agencia requires you to (article 8(h)).
• This binds an entity that administers public resources, carries out acts of public administration or has an incidence on the nation's critical infrastructure, whatever its form, nature or legal status, so it reaches a private owner or operator of a system that supports an essential service to the public (reached by declaring that you operate an essential service). The Agencia de Ciberseguridad del Estado qualifies the operators of critical infrastructure by reasoned resolution ratified by the President of the Republic (articles 2 and 8).