Provides telecom services, in Cuba

Decreto No. 42 Reglamento General de Telecomunicaciones y las Tecnologías de la Información y la Comunicación, 2021, art. 53(c) · Read the law's page

• This binds the operators and providers of public telecommunications/ICT services in Cuba, whether state or non-state, which the Ministry of Communications authorizes (reached by declaring that you provide telecommunications services).
• Notify the Ministry of Communications of the security breaches or losses of integrity of your networks or services that have had an impact on their operation, as the legislation in force establishes (article 53(c)).

Decreto-Ley No. 35 De las Telecomunicaciones, las Tecnologías de la Información y la Comunicación y el Uso del Espectro Radioeléctrico, 2021, arts. 68 y 71, y Decreto No. 42 Reglamento General de Telecomunicaciones, art. 53(a), (d) y (e) · Read the law's page

• This binds the operators and providers of public telecommunications/ICT services in Cuba, whether state or non-state, which the Ministry of Communications authorizes (reached by declaring that you provide telecommunications services).
• Apply the measures that guarantee the security of your infrastructure and services against attacks, and implement technological supervision and control measures that detect and manage security incidents (Decreto-Ley 35, article 68(a) and (b)).
• Identify your vulnerabilities and risks and develop and comply with security plans that reduce to a minimum the impact of incidents on your network and services (Decreto 42, article 53(a)).
• Apply the measures needed to counter any incident that affects your services and eliminate the vulnerabilities detected, whether by you or by the Ministry of Communications (Decreto 42, article 53(d)).
• When the Ministry of Communications requires it, give it the information needed to assess the security and integrity of your networks and services, including your internal security policy documents, and accept a security audit by a competent body (Decreto 42, article 53(e)).
• Meet the normative provisions the Ministry of Communications establishes for the security of networks and services (Decreto-Ley 35, article 71).

Resolución 58/2022, Ministerio de Comunicaciones, "Reglamento para la Seguridad y Protección de los Datos Personales en Soporte Electrónico" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-833-O90, 25 de agosto de 2022) · Read the law's page

• Host or replicate any registry, file, archive, or database containing personal data in electronic form only on servers located within Cuba's national territory, absent a case the law provides for.
• Guarantee the security of personal data in electronic form and adopt the necessary technical and administrative measures for its processing.
• Notify the competent authorities of cybersecurity incidents affecting personal data in electronic form under your custody.
• Let a telecommunications, application, or internet-service user access, update, and cancel their personal data on request, and disclose the purpose of data collection, privacy configuration options, and any tracking elements such as cookies.

Decreto No. 360/2019 ‘Sobre la Seguridad de las Tecnologías de la Información y la Comunicación y la Defensa del Ciberespacio Nacional’ (Gaceta Oficial de la República de Cuba, Ordinaria No. 45, GOC-2019-549-O45, 4 de julio de 2019), arts. 10, 12, 17-20, 41, 56, 89, 109; and its implementing Reglamento de Seguridad de las Tecnologías de la Información y la Comunicación, approved by Resolución 128/2019 of the Ministry of Communications (GOC-2019-555-O45), arts. 2, 4-8, 50 · Read the law's page

• Design, implement, manage and keep updated a TIC Security System proportionate to the assets it protects and the risks it faces, and adopt a written TIC Security Plan describing the policies, measures and procedures that follow from it.
• If you provide Internet access service, additionally draft internal security-operation procedures, name the person responsible for network security, and adopt technical and organizational measures against malware contamination and network attacks and intrusions.
• If you produce equipment or provide network, program, application or IT services, whether from inside or outside Cuba, implement the requirements that guarantee the secure operation of the equipment and services you supply; obtain a Ministry of Communications operating license before offering TIC security services to a third party, a license reserved to a state entity whose staff reside permanently in the country.
• This duty binds any entity or natural person in Cuba that owns or uses information and communication technologies, government bodies and state enterprises as well as cooperatives, mixed enterprises, nonprofit associative forms and non-state forms of ownership and management (the self-employed, private cooperatives, and, since Decreto-Ley 46/2021, micro, small and medium private enterprises), and it applies to a non-state actor or a natural person even where they have no specialized security staff.

Resolución 105/2021 of the Ministry of Communications, ‘Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad’ (Gaceta Oficial de la República de Cuba, Ordinaria No. 92, GOC-2021-762-O92, 17 de agosto de 2021), arts. 1, 2, 21-23 and resolving clause SEGUNDO · Read the law's page

• Report a cybersecurity incident to your immediate superior and to the Cuban Computer Incident Response Team (CuCERT), inside the Ministry of Communications' Oficina de Seguridad para las Redes Informáticas (OSRI), using the incident-report form the Reglamento's Annex III sets out.
• If you hold a private data network, ensure that a cybersecurity event or incident affecting it is recorded, classified and reported to CuCERT.
• If you are a natural person, or you hold a private network as a natural person, report a cybersecurity incident through the channel the Ministry of Communications publishes on its own website.
• This duty binds any natural or legal person in Cuba responsible for information infrastructure, including a government body, a state enterprise, a cooperative, a mixed enterprise or other foreign-investment vehicle, a nonprofit associative form, and the holder of any data network, public or private, in the National Cyberspace.