Runs an essential service, in Uruguay

Ley N° 20.212, arts. 78 y 79 · Read the law's page

• This binds public entities and private entities linked to services or sectors critical to the country, as article 78 refers to them through article 149 of Ley N° 18.719 (reached by declaring that you operate an essential service).
• Adopt effective security measures to protect your critical information assets, following the guidelines the Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y del Conocimiento (AGESIC) indicates (article 78(A)).
• Designate an information security officer and communicate the designation to AGESIC (article 78(B)).
• Plan the measures needed to mitigate and improve your existing controls, and adopt the prevention measures the regulations determine (article 78(C)).
• Incorporate, according to your level of maturity, the cybersecurity framework AGESIC developed (article 78(E)).
• Comply with other measures the Executive Power determines to protect information assets, following national and international standards (article 78(F)).

Ley N° 20.212, arts. 78(D) y 80 · Read the law's page

• This binds public entities and private entities linked to services or sectors critical to the country, as article 78 refers to them through article 149 of Ley N° 18.719 (reached by declaring that you operate an essential service).
• Report the existence of a potential cybersecurity incident fully and immediately, under the criteria the Centro Nacional de Respuesta a Incidentes de Seguridad Informática (CERTuy) sets, and make available all the information it requires (article 78(D)).
• Communicate the occurrence of a cybersecurity incident to AGESIC within twenty-four hours of becoming aware of it, and complete the information needed for the National Cybersecurity Incident Registry as soon as possible (article 80).

Decreto N° 66/025, arts. 10(g) y 12 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets (article 10(g)).
• Report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets (article 12(a)).
• Make available to CERTuy, and to the sector CSIRT where there is one, all the information they request, within the times they ask (article 12(b)).
• Repair the consequences of incidents that affect critical information assets, in accordance with the recommendations you are given (article 12(c)).

Decreto N° 66/025, arts. 10, 11, 14 a 18 y 21 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Adopt effective security measures to protect your critical information assets, following the guidelines AGESIC sets (article 10(a)).
• Designate an information security officer, who may be internal or external to the entity (article 10(c)).
• Keep centralized audit traces of your information systems for no less than twelve months, or the period CERTuy determines (article 11(a)).
• Adopt the Marco de Ciberseguridad AGESIC developed and meet the minimum maturity level assigned to your profile (article 14).
• Carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines (article 16), send AGESIC an executive summary within 30 calendar days of finishing each audit, and send a compliance action plan within 60 calendar days of finishing the external audit where improvements are needed (article 17).
• Guarantee that the services you outsource to meet your tasks comply with the Marco de Ciberseguridad (article 18).