CubaResolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad
Resolución 105/2021 of the Ministry of Communications ‘Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad’ (Gaceta Oficial de la República de Cuba, Ordinaria No. 92, GOC-2021-762-O92, 17 de agosto de 2021), arts. 1, 2, 21-23 and resolving clause SEGUNDO
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
What it requires
- This duty binds any natural or legal person in Cuba responsible for information infrastructure, including a government body, a state enterprise, a cooperative, a mixed enterprise or other foreign-investment vehicle, a nonprofit associative form, and the holder of any data network, public or private, in the National Cyberspace.
- Report a cybersecurity incident to your immediate superior and to the Cuban Computer Incident Response Team (CuCERT), inside the Ministry of Communications' Oficina de Seguridad para las Redes Informáticas (OSRI), using the incident-report form the Reglamento's Annex III sets out.NIST CSF 2.0RS.CO-02
- If you hold a private data network, ensure that a cybersecurity event or incident affecting it is recorded, classified and reported to CuCERT.NIST CSF 2.0RS.MA-03NIST CSF 2.0RS.CO-02
- If you are a natural person, or you hold a private network as a natural person, report a cybersecurity incident through the channel the Ministry of Communications publishes on its own website.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Resolución 105/2021 itself sets a reporting and classification duty with no monetary or criminal penalty of its own for failing to report. The administrative sanctions available under Decreto 360/2019, art. 109, are the enforcement mechanism this reporting duty shares with the baseline TIC Security System duty recorded elsewhere in this jurisdiction's filing.
Who enforces it
Enforcement body
The Cuban Computer Incident Response Team (CuCERT), housed within the Ministry of Communications' Oficina de Seguridad para las Redes Informáticas (OSRI), receives and classifies incident reports until a dedicated Cybersecurity entity staffed jointly with the Ministries of the Revolutionary Armed Forces and of the Interior is created (Resolución 105/2021, arts. 22-23, disposición especial TERCERA).
Settledness
- As of
- Open questions
- Resolución 105/2021 assigns incident intake to CuCERT ‘hasta tanto se cree la entidad especializada de Ciberseguridad’ (English: until the specialized Cybersecurity entity is created): has that entity since been created, and if so, does a newer instrument reassign this duty?
- The Reglamento's Annex III incident-report form asks for the reporting entity's own details but names no maximum reporting-time window in the text read: does a separate, unread instrument set a reporting clock?
What this law does
Resolución 105/2021 of the Ministry of Communications approves a Reglamento establishing the National Action Model for responding to cybersecurity incidents within the National Cyberspace, to guarantee an effective response for its protection.
The Reglamento applies to natural and legal persons, naming government bodies, diplomatic missions and Cuba's own commercial and cooperation representations abroad, the state business system, cooperatives, mixed enterprises and other foreign-investment forms, nonprofit associative forms, and the holders of data networks in the National Cyberspace.
A person directly responsible for the computing infrastructure where a cybersecurity incident occurs must report it to their immediate superior and to the Cuban Computer Incident Response Team (CuCERT), housed in the Ministry of Communications' Oficina de Seguridad para las Redes Informáticas (OSRI).
The holder of a private data network is separately responsible for ensuring that a cybersecurity event or incident affecting that network is recorded and classified, and for delivering the information that reporting to CuCERT requires. The holder of a private network belonging to a natural person, and a natural person individually, must also report a cybersecurity incident through the channel the Ministry of Communications publishes on its own website.
CuCERT receives and forwards incident information until a dedicated Cybersecurity entity, to be staffed jointly by the Ministries of Communications, of the Revolutionary Armed Forces and of the Interior, is created to take over that function. Resolución 105/2021 carries no clause stating the day it comes into force.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .