ParaguayMandatory Cyber Incident Reporting by State Bodies to CERT-PY
Resolución MITIC N° 346/2020 Reporte obligatorio de incidentes cibernéticos por parte de los Organismos y Entidades del Estado (OEE) al… MITIC, reglamentaria del art. 44 del Decreto N° 2274/2019
In force.
A vulnerability and incident reporting rule binding government bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the organismos y entidades del Estado (OEE) within the scope of Decreto N° 2274/2019, which is to say state bodies and not private businesses.
- Have every public servant report any possible cyber security incident to the institution's information security officer (Responsable de Seguridad de la Información) or, failing one, to the director of its information and communication technology unit (UETIC).
- Have that officer or director report every cyber security incident to CERT-PY by email to abuse@cert.gov.py, with a description of the incident and any data that helps investigate it, such as logs, screenshots, traffic captures and files.
- Treat as a cyber security incident an imminent threat to the institution's information security policies, or any event that compromises the confidentiality, integrity or availability of an information system.
- Coordinate any public communication about a cyber incident between the affected institution, its technical and communications areas, and the Ministerio de Tecnologías de la Información y Comunicación (MITIC).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministerio de Tecnologías de la Información y Comunicación (MITIC), through the Centro de Respuestas a Incidentes Cibernéticos (CERT-PY) under its Dirección General de Ciberseguridad y Protección a la Información, to which state bodies report.
Settledness
- As of
- Open questions
- What clock does the regulation set for the report to CERT-PY?
What this law does
Resolución MITIC N° 346/2020 approves and implements the regulation on mandatory reporting of cyber security incidents by state bodies to the Ministerio de Tecnologías de la Información y Comunicación through CERT-PY, regulating Article 44 of Decreto N° 2274/2019. The regulation requires every public servant to report any possible cyber security incident to the information security officer of the institution or, failing one, to the director of its UETIC.
The regulation makes it the duty of that officer or director to report every cyber security incident to CERT-PY by email, with a description and any data that helps investigate it. The regulation defines a cyber security incident as an imminent threat to the information security policies of an institution, or any event that compromises the security of an information system. The regulation provides that MITIC keeps the details of reported cyber incidents confidential.