Is an insurer, in Uruguay

Resolución RR-SSF-2021-353 de la Superintendencia de Servicios Financieros, Comunicación de eventos vinculados a Tecnología, Sistemas y Seguridad de la Información · Read the law's page

• This binds financial intermediation institutions and larger credit-administering companies (empresas administradoras de créditos de mayores activos) supervised by the Superintendencia de Servicios Financieros of the Banco Central del Uruguay (reached by declaring that you provide financial services).
• Report to the Superintendencia every event that could affect services or clients and that, by its impact, affects the operational or reputational risk of the institution or the financial system, whether it occurs on your premises or at an outsourced service provider.
• Report as a minimum any event that warrants a communication to clients, to the Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento (AGESIC) or to any other national entity or authority, that applies your business continuity or disaster recovery plan in whole or in part, that interrupts or affects a customer service channel for 30 minutes or more, that affects services to 10% or more of clients, or that exposes sensitive information and personal data of 5% or more of clients.
• Communicate an emerging event as soon as possible after learning of it, even if not all information is available, and complete it in later reports; communicate a scheduled event at least 24 hours before it starts.
• Where the event warrants a communication to clients, AGESIC or another authority, report to the Superintendencia at least at the same time as those communications.

Decreto N° 66/025, arts. 10(g) y 12 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets (article 10(g)).
• Report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets (article 12(a)).
• Make available to CERTuy, and to the sector CSIRT where there is one, all the information they request, within the times they ask (article 12(b)).
• Repair the consequences of incidents that affect critical information assets, in accordance with the recommendations you are given (article 12(c)).

Decreto N° 66/025, arts. 10, 11, 14 a 18 y 21 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Adopt effective security measures to protect your critical information assets, following the guidelines AGESIC sets (article 10(a)).
• Designate an information security officer, who may be internal or external to the entity (article 10(c)).
• Keep centralized audit traces of your information systems for no less than twelve months, or the period CERTuy determines (article 11(a)).
• Adopt the Marco de Ciberseguridad AGESIC developed and meet the minimum maturity level assigned to your profile (article 14).
• Carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines (article 16), send AGESIC an executive summary within 30 calendar days of finishing each audit, and send a compliance action plan within 60 calendar days of finishing the external audit where improvements are needed (article 17).
• Guarantee that the services you outsource to meet your tasks comply with the Marco de Ciberseguridad (article 18).