ChileLey Marco de Ciberseguridad, Duties of Operators of Vital Importance
Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 5 y 8
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Licensing
As of .
What it requires
- This binds an operator of vital importance, meaning a provider of essential services, or a private institution that is not one but whose designation is indispensable because of its critical role or its exposure to cybersecurity risks, that the Agency qualifies as such by resolution because its service depends on computer networks and systems and its interruption would significantly affect public security and order, the continuous provision of essential services or the functions of the State (article 5) (reached by declaring that you operate an essential service). These duties apply from .
- Implement a continuous information security management system to determine the risks that can affect the security of your networks, computer systems and data and the operational continuity of the service (article 8, letter a).
- Draft and implement operational continuity and cybersecurity plans, certify them under article 28, and review them at least every two years (article 8, letter c).
- Continuously run review operations, exercises, drills and analyses of your networks and systems to detect harmful programs or actions, and communicate the information to the CSIRT Nacional as the regulation determines (article 8, letter d).
- Take prompt measures to reduce the impact and spread of a cybersecurity incident, including restricting the use of or access to computer systems if necessary (article 8, letter e).
- Inform potentially affected persons, as far as they can be identified and when the Agency requires it, of incidents or cyberattacks that could seriously compromise their information or computer networks and systems (article 8, letter g).
- Designate a cybersecurity delegate who acts as the Agency's counterpart (article 8, letter i).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Fines for infractions of the Act, classed minor, serious or very serious, of up to 5,000, 10,000 and 20,000 monthly tax units, and up to 10,000, 20,000 and 40,000 monthly tax units for an operator of vital importance (article 40).
Settledness
- As of
- Open questions
- Which institutions has the Agency qualified as operators of vital importance by final resolution under articles 5 and 6?
What this law does
Article 5 of Ley N° 21.663 lets the Agency qualify as an operator of vital importance a provider of essential services whose service depends on computer networks and systems and whose interruption would significantly affect public security and order, the continuous provision of essential services or the functions of the State. Article 8, letter a) requires an operator of vital importance to implement a continuous information security management system.
Article 8, letter c) requires operational continuity and cybersecurity plans that are certified under article 28 and reviewed at least every two years. Article 8, letter d) requires continuous review operations, exercises, drills and analyses of networks and systems, and communication of the information on harmful programs or actions to the CSIRT Nacional.
Article 8, letter e) requires prompt measures to reduce the impact and spread of a cybersecurity incident, including restricting the use of or access to computer systems if necessary. Article 8, letter g) requires informing potentially affected persons, when the Agency requires it, of incidents or cyberattacks that could seriously compromise their information or computer networks and systems.
Article 8, letter i) requires an operator of vital importance to designate a cybersecurity delegate who acts as the Agency's counterpart. Articles 5 and 8 apply from . The fines of article 40 reach up to 10,000, 20,000 or 40,000 monthly tax units for an operator of vital importance.
When LexLint raises it
When your app profile says your app runs an essential service.