ChileCybersecurity Incident Reporting Regulation under the Ley Marco de Ciberseguridad
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a public or private institution that provides a service qualified as essential and an institution qualified as an operator of vital importance (reached by declaring that you operate an essential service). The regulation details the reporting duty of article 9 of the Act, which applies from .
- Report to the CSIRT Nacional every cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, affect the integrity or confidentiality of computer assets or the availability of a network or system, involve unauthorized use of or entry into networks or systems, or affect systems holding personal data (articles 2 and 3).
- Make every report through the notification platform the Agency provides, and leave all personal data out of it (articles 6 and 8).
- Send an early warning within a maximum of three hours from becoming aware of the incident, with at least the identification of the institution, its cybersecurity delegate, the date and time you learned of it, the signs of the incident and the assets affected (articles 5 and 9).
- Send a second report after seventy-two hours from becoming aware of the incident, or within twenty-four hours if you are an operator of vital importance whose essential service is affected, updating all the information with an initial assessment of severity and impact and any indicators of compromise (article 10).
- If you are an operator of vital importance, implement and report your action plan within no more than seven calendar days from becoming aware of the incident, including a data recovery programme, technical and administrative responsibilities and an estimate of the time to restore services (article 11).
- Within a maximum of fifteen calendar days from sending the early warning, and once the incident has been managed, send a final report; while it is not managed, send a partial report updated every fifteen days (articles 12 and 13).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Fines for infractions of the Act, classed minor, serious or very serious, of up to 5,000, 10,000 and 20,000 monthly tax units, and up to 10,000, 20,000 and 40,000 monthly tax units for an operator of vital importance (article 40).
Settledness
- As of
- Open questions
- Which exemptions from the duty to report has the Director of the Agency granted under article 3 of the regulation?
What this law does
Article 9 of Ley N° 21.663 provides that the content of the reports it describes is to be regulated by a regulation issued by the ministry in charge of public security. Article 2 of the regulation requires public and private institutions that provide services qualified as essential, and those qualified as operators of vital importance, to report to the CSIRT Nacional cyberattacks and cybersecurity incidents that may have significant effects.
Article 3 treats an incident as having a significant effect if it can interrupt an essential service, affect the physical integrity or health of persons, affect the integrity or confidentiality of computer assets or the availability of a network or system, involve unauthorized use of or entry into networks or systems, or affect systems holding personal data.
Article 5 sets the minimum content of a report, including the identification of the institution, its cybersecurity delegate, the date and time of awareness, any evidence of a crime, the signs of the incident, the assets affected and the indicators of compromise. Article 6 requires the report to omit all personal data, and an IP address is not treated as personal data for that purpose.
Article 8 requires reports to be made through the notification platform the Agency provides, which operates every hour of every day of the year. Article 9 requires an early warning within a maximum of three hours from the institution becoming aware of the incident. Article 12 requires a final report within a maximum of fifteen calendar days from sending the early warning, provided the incident has been managed.
Article 13 requires a partial report on the state of an incident not yet managed, updated every fifteen days from the last submission. Article 11 requires an operator of vital importance to implement and report its action plan within no more than seven calendar days from becoming aware of the incident. Failing to meet the reporting duty of article 9 of the Act is a serious infraction under article 38 of the Act.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.