ChileLey Marco de Ciberseguridad, Reporting of Cybersecurity Incidents
Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 9 y 27
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every public and private institution named in article 4, that is an institution that provides a service qualified as essential or is qualified as an operator of vital importance (reached by declaring that you operate an essential service). These duties apply from .
- Report to the CSIRT Nacional, as soon as possible, any cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, or affect systems holding personal data (articles 9 and 27).
- Send an early warning within a maximum of three hours from becoming aware of the incident (article 9, letter a).
- Within a maximum of seventy-two hours, send an update with an initial assessment of the incident, its severity and impact, and indicators of compromise if available; if you are an operator of vital importance whose essential service is affected, send it within a maximum of twenty-four hours (article 9, letter b).
- Within a maximum of fifteen calendar days from the early warning, send a final report with a detailed description of the incident, the type of threat or main cause, the mitigation measures applied and under way, and any cross-border repercussions (article 9, letter c).
- If you are an operator of vital importance, also report your action plan to the CSIRT Nacional as soon as you adopt it, no later than seven calendar days after becoming aware of the incident (article 9).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Fines for infractions of the Act, classed minor, serious or very serious, of up to 5,000, 10,000 and 20,000 monthly tax units, and up to 10,000, 20,000 and 40,000 monthly tax units for an operator of vital importance (article 40).
Settledness
- As of
- Open questions
- What procedure, form and anonymity conditions does the regulation implementing the incident-reporting duty set?
What this law does
Article 9 of Ley N° 21.663 requires every public and private institution named in article 4 to report to the CSIRT Nacional cyberattacks and cybersecurity incidents that may have significant effects, as soon as possible. Article 9, letter a) requires an early warning within a maximum of three hours from becoming aware of the incident.
Article 9, letter b) requires an update within seventy-two hours, or within twenty-four hours where the incident affects the essential service of an operator of vital importance. Article 9, letter c) requires a final report within a maximum of fifteen calendar days from sending the early warning.
Article 9 requires an operator of vital importance also to report its action plan to the CSIRT Nacional as soon as it is adopted, within no more than seven calendar days of becoming aware of the incident. Article 27 treats an incident as having a significant effect if it can interrupt the continuity of an essential service, affect the physical integrity or health of persons, or affect computer systems holding personal data. Article 9 applies from . Failing to meet the reporting duty of article 9 is a serious infraction under article 38 of the Act.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.