UruguayDecreto 66/025, Cybersecurity Framework Duties of Public and Critical-Sector Entities
Decreto N° 66/025, arts. 10, 11, 14 a 18 y 21
In force since .
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds all public entities and private entities linked to services or sectors critical to the country, which the decree lists as health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
- Adopt effective security measures to protect your critical information assets, following the guidelines AGESIC sets (article 10(a)).
- Designate an information security officer, who may be internal or external to the entity (article 10(c)).
- Keep centralized audit traces of your information systems for no less than twelve months, or the period CERTuy determines (article 11(a)).
- Adopt the Marco de Ciberseguridad AGESIC developed and meet the minimum maturity level assigned to your profile (article 14).
- Carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines (article 16), send AGESIC an executive summary within 30 calendar days of finishing each audit, and send a compliance action plan within 60 calendar days of finishing the external audit where improvements are needed (article 17).
- Guarantee that the services you outsource to meet your tasks comply with the Marco de Ciberseguridad (article 18).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y del Conocimiento (AGESIC), which may issue a warning (apercibir) directly to an entity that fails to meet the decree.
Settledness
- As of
- Open questions
- Which maturity level and implementation deadline has AGESIC assigned to each entity profile under articles 14 and 15 of the decree?
What this law does
Article 2 of the decree applies it to all public entities and to private entities linked to services or sectors critical to the country. Article 3(j) of the decree defines the critical sectors as health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services and defense, and other sectors the Executive Power determines.
Article 10(a) of the decree requires those entities to adopt effective security measures to protect their critical information assets, following the guidelines of AGESIC. Article 14 of the decree requires the entities it binds to adopt the Marco de Ciberseguridad developed by AGESIC and to meet the minimum maturity level assigned to their profile. Article 16 of the decree requires those entities to carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines.
Article 21 of the decree lets AGESIC warn directly an entity that fails to meet the decree. Article 22 of the decree repeals Decrees 451/009 and 452/009 of .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.