UruguayDecreto 66/025, Cybersecurity Incident Reporting to CERTuy
Decreto N° 66/025, arts. 10(g) y 12
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds all public entities and private entities linked to services or sectors critical to the country, which the decree lists as health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
- Communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets (article 10(g)).
- Report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets (article 12(a)).
- Make available to CERTuy, and to the sector CSIRT where there is one, all the information they request, within the times they ask (article 12(b)).
- Repair the consequences of incidents that affect critical information assets, in accordance with the recommendations you are given (article 12(c)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y del Conocimiento (AGESIC), which may issue a warning (apercibir) directly to an entity that fails to meet the decree.
Settledness
- As of
- Open questions
- Is the 24-hour notice to CERTuy under article 10(g) of the decree one notification or two alongside the 24-hour notice to AGESIC under article 80 of Ley N° 20.212?
What this law does
Article 10(g) of the decree requires the entities it binds to communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets. Article 12(a) and (b) of the decree require those entities to report a potential cybersecurity incident fully and immediately under CERTuy criteria and to make available the information CERTuy or the sector CSIRT requires, within the times requested.
Article 12(c) of the decree requires those entities to repair the consequences of incidents that affect critical information assets in accordance with the recommendations informed. Article 21 of the decree lets AGESIC warn directly an entity that fails to meet the decree. The decree was promulgated on and published on .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.