The National Cybersecurity Agency (ANCI) has issued, on June 4th of this year, General Instruction No. 1 requiring mandatory registration of institutions qualified as essential service providers on the incident reporting platform. In this analysis, we examine the main developments of this regulation and their practical implications.
Regulatory Context
This Instruction complements what was already established by Law No. 21,663 on Cybersecurity. This law establishes that institutions providing services qualified as essential must adopt protection measures and coordinate with the regulatory entity.
In particular, these institutions have the obligation to report to the National CSIRT (Computer Security Incident Response Team) all cyberattacks and cybersecurity incidents that may have significant effects under the terms of article 27° of said Law.
Main Developments
1. Registration obligation
It is established that all public and private institutions qualified as essential service providers, in accordance with article 4° of the Cybersecurity Law, must register on ANCI's cybersecurity incident reporting platform to comply with their reporting obligation.
The possibility of registering more than one person in charge of cybersecurity reporting is also contemplated, and the same person may perform this function for two or more institutions.
2. Registration instructions
To properly register on the platform, the person in charge must verify their designation with a document electronically signed by the legal representative of their institution and designate an email address, which will be the official communication channel with the regulatory entity.
Additionally, they must register on the platform with Unique Key, completing two-factor authentication.
3. Profile of the person in charge of reports
The obligation is established for regulated institutions to ensure that the person designated as responsible for cybersecurity reporting has technical or professional training or experience in cybersecurity.
4. Penalty for non-compliance
Non-compliance with this Instruction will be considered a minor infraction, in accordance with the provisions of article 38 No. 2 of the Cybersecurity Law.
Practical Implications
This new instruction has important implications for affected organizations:
- Public Institutions: Must designate specialized personnel and establish internal procedures for timely incident reporting.
- Private Essential Service Companies: Will need to evaluate their internal cybersecurity capabilities and possibly contract specialized services.
- Organizations with Multiple Subsidiaries: May optimize resources by designating shared responsible parties among related entities.
General Recommendation
Affected institutions must act promptly to comply with the new requirements. We recommend conducting a comprehensive evaluation of current cybersecurity capabilities and establishing the necessary procedures to ensure regulatory compliance.
Effective Date
This Instruction will come into effect from the fifth business day of its publication in the Official Gazette, which took place on June 4th of this year.
Next Steps
At COVEL we have extensive experience in cybersecurity law and are prepared to advise our clients on compliance with these new obligations. If your institution requires support in implementing incident reporting procedures, please do not hesitate to contact us.
This analysis represents the author's professional opinion based on the text of the Instruction and the Cybersecurity Law, and does not constitute specific legal advice. For particular cases, we recommend consulting directly with our legal team.