Bill 627.

Summary.

The bill establishes principles, institutions, and obligations to coordinate cybersecurity across the state administration and its dealings with private parties. It covers ministries, local authorities, public security forces, state enterprises, and companies in which the state holds shares. It defines IT assets, cyberattacks, incidents, risks, vulnerabilities, and response teams. Its principles include cooperation and coordination, response without offensive operations, the right to adopt security measures such as encryption, damage control, proportionality, privacy by design, international cooperation, training, risk management, and data sovereignty.

The framework would apply to public and private entities providing essential services, concessionaires, strategic operators, and other persons subject to cybersecurity obligations. It identifies services related to health, water, electricity, telecommunications, public security, and transportation; describes critical infrastructure; and lists, among other examples, power plants, ports, airports, financial systems, and government data centers. It also lists activities involving fuel, sanitation, digital services, banking, social security, courier services, and pharmaceuticals. The National Cybersecurity Regulatory Authority would designate operators of vital importance through reasoned decisions, based on their reliance on digital systems and the potential impact of a disruption. It would request sectoral reports and have 180 calendar days to approve a catalog, which could be updated every 3 years. Operators would obtain certifications issued by entities entered in a registry; the authority could also recognize foreign certifications.

The institutions subject to the bill would adopt ongoing measures to prevent, report, and manage incidents under general and sectoral protocols and standards. Operators of vital importance would implement continuous security management systems, records, certified continuity and cybersecurity plans, reviews at least every 2 years, exercises, and vulnerability analyses. They would also adopt containment measures, inform potentially affected parties when required by the authority, train their staff, and appoint a representative. Public and private institutions would report incidents with a significant impact to the National Computer Security Incident Response Team: an alert within 3 hours, an update within 72 hours, or within 24 hours if essential services provided by an operator of vital importance are affected, and a report within 15 consecutive days. These operators would also communicate their action plan, which would have to be adopted within 7 consecutive days. State bodies would require their technology suppliers to share relevant information about vulnerabilities and incidents.

The bill creates the National Cybersecurity Regulatory Authority as a technical entity with legal personality, its own assets, and technical autonomy. It assigns the authority responsibility for designating essential services, identifying critical infrastructure and essential functions, issuing instructions, supervising and overseeing compliance, issuing state certifications, and administering an incident registry. The authority could request information and activity logs needed to prevent or manage incidents, require information for potentially affected parties, and cooperate internationally in coordination with the Ministry of Foreign Affairs (Ministerio de Relaciones Exteriores). The bill also creates the Multisectoral Cybersecurity Council, comprising the authority’s leadership and representatives of the private sector, academia, and civil society; it regulates the council’s meetings, recommendations, exceptional confidentiality, and grounds for removal. It establishes the State Secure Connectivity Network to interconnect public bodies.

The text creates the National Computer Security Incident Response Team within the National Cybersecurity Agency (Agencia Nacional de Ciberseguridad), with responsibilities for incident response, coordination, alerts, risk analysis, and technical support. It also creates the Interministerial Cybersecurity Committee to advise on the National Cybersecurity Policy. Its members include the Ministry of Public Security (Ministerio de Seguridad Pública), the Ministry of the Presidency (Ministerio de la Presidencia), the Ministry of Economy and Finance (Ministerio de Economía y Finanzas), the Ministry of Foreign Affairs, the Ministry of Commerce and Industries (Ministerio de Comercio e Industrias), the National Authority for Government Innovation (Autoridad Nacional para la Innovación Gubernamental), the National Public Services Authority (Autoridad Nacional de los Servicios Públicos), and the National Authority for Transparency and Access to Information (Autoridad Nacional para la Transparencia y el Acceso a la Información). It provides grounds for ending members’ terms.

The regulatory authority and sectoral authorities would exchange reports before issuing general provisions affecting their respective areas of authority, subject to a 30-consecutive-day period and a procedure for urgent cases. Equivalent sectoral rules would prevail according to jointly established criteria. The bill defines incidents with a significant impact, requires support for restoring services, and regulates the omission of personal data from reports. It makes background information, records, risk matrices, and continuity or mitigation plans confidential; extends that duty to officials and others who learn of certain procedures; and permits disclosure of confidential information to manage, prevent, or contain incidents. The Executive Branch would issue implementing regulations within 6 months of the law’s promulgation; the law would take effect 6 months after its promulgation. Its provisions could be relevant to public entities, technology suppliers, and the health, energy, water, transportation, telecommunications, finance, and digital services sectors.