Costa RicaGeneral Regulation on Information Technology Governance and Management (CONASSIF Agreement 5-24), Incident Classification and Reporting
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every entity and company supervised by SUGEF, SUGEVAL, SUGESE or SUPEN, and the controllers and member companies of supervised financial groups and conglomerates (reached by declaring that you provide financial services) (Article 2).
- Classify and record each information security and cybersecurity incident by the incident classification and impact levels set in the general guidelines of the Regulation (Article 38).
- Report to your Superintendencia each incident whose impact is classified as moderate or high (Article 39), sending the initial communication without delay and no later than eight natural hours after the incident is identified and its impact is established as moderate or high (general guidelines, Section XI).
- Send the incident handling report and the follow-up reports the Superintendencia asks for, within the time it communicates through its official channels (Article 39 and general guidelines, Section XI).
- Tell the affected customers when an information security or cybersecurity incident affects the confidentiality or integrity of their information, in a timely and clear way, and tell them the measures taken to remediate it within five business days after the incident is closed (Article 40).
- Keep historical information on incidents and make it available to the Superintendencias when they require it for supervision (Article 41).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia that supervises the entity (SUGEF, SUGEVAL, SUGESE or SUPEN), which receives the incident communications and may ask for incident reports.
What this law does
Article 2 applies the Regulation to entities supervised by SUGEF, SUGEVAL, SUGESE and SUPEN. Article 39 requires supervised entities and companies to report to their Superintendencia each incident classified as moderate or high. Section XI of the general guidelines sets the initial communication at no later than eight natural hours after the incident is identified and its impact established.
Article 40 requires supervised entities and companies to tell affected customers when an information security incident affects the confidentiality or integrity of their information. Article 40 also requires the measures taken to remediate the incident to be communicated to customers within five business days after the incident is closed.
Article 41 requires supervised entities and companies to keep historical information on incidents available to the Superintendencias when they require it for supervision. The Regulation was approved on and applies from its publication in Alcance 130 to La Gaceta 134 of .
When LexLint raises it
When your app profile says your app provides financial services.