El SalvadorCybersecurity and Information Security Law, Security Management Duties of Obligated Entities
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds an entity that administers public resources, carries out acts of public administration or has an incidence on the nation's critical infrastructure, whatever its form, nature or legal status, so it reaches a private owner or operator of a system that supports an essential service to the public (reached by declaring that you operate an essential service). The Agencia de Ciberseguridad del Estado qualifies the operators of critical infrastructure by reasoned resolution ratified by the President of the Republic (articles 2 and 8).
- Implement a permanent cybersecurity and information-security management system that determines and mitigates the risks to your computer systems, equipment, networks, telecommunications infrastructure and the processes run on them (article 6(a)).
- Draw up a cybersecurity and information-security strategy that follows national or international standards or reference frameworks (article 6(b)).
- Draw up and implement operational-continuity and cybersecurity plans, which the competent authority approves and which are reviewed periodically (article 6(d)).
- Run continuous reviews, exercises, drills and analyses of your measures, systems, equipment, networks and processes to detect the elements that put cybersecurity at risk (article 6(e)).
- Create or designate one or more areas responsible for implementing and reviewing these measures, with the independence to act without prior obstacles, in close coordination with the competent authority (article 6(i)).
- Facilitate the management, audit and inspection work of the competent authority, and comply with the standards, protocols and technical criteria the Agencia issues (article 6(k) and (n)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Agencia de Ciberseguridad del Estado, which sanctions an infraction by written warning or fine and may impose coercive fines of one to ten monthly minimum wages of the commerce sector for each working day an order goes unmet (articles 22 to 27).
Settledness
- As of
- Open questions
- Which private entities has the Agencia de Ciberseguridad del Estado qualified as operators of critical infrastructure under article 8(f) of the Law?
What this law does
Article 2 binds the organs of Government, official autonomous institutions and municipal authorities, and any other entity regardless of its form, nature or legal status that administers public resources, carries out acts of public administration or has an incidence on the nation's critical infrastructure.
Article 4 defines critical infrastructure as computer systems, equipment, networks or technological services that support the provision of essential services to the public and whose failure could have an impact on them. Article 8 empowers the Agencia de Ciberseguridad del Estado to qualify the operators of critical infrastructure by reasoned resolution subject to ratification by the President of the Republic.
Article 6 requires each obligated entity to implement a permanent cybersecurity and information-security management system to determine and mitigate the risks to its computer systems and infrastructure. Article 6 requires each obligated entity to draw up and implement operational-continuity and cybersecurity plans that the competent authority approves.
Article 21 classes the failure to implement a permanent cybersecurity and information-security management system, without justified cause, as a very serious infraction. Article 23 sets, for a private-sector infractor of a serious infraction, a fine of eleven to fifty monthly minimum wages of the commerce sector. Article 24 sets, for a private-sector infractor of a very serious infraction, a fine of fifty-one to one hundred monthly minimum wages of the commerce sector.
Article 32 provides that the Law enters into force eight days after its publication in the Diario Oficial. The Law was published in the Diario Oficial of .
When LexLint raises it
When your app profile says your app runs an essential service.