Bill 629.

Summary.

The bill establishes continuous training in cybersecurity best practices and culture for public servants in the Republic of Panama. Training would reflect the criticality of their duties, the information they handle, the infrastructure they work with, and the security objectives set by the Executive Branch. It covers personnel of the Central Government; decentralized, autonomous, and semiautonomous institutions; municipalities and community boards; companies in which the State holds at least 51% of the shares; and the diplomatic service. It also covers entities that manage public funds, state databases, public digital assets, or critical digital infrastructure, as well as those designated by the Executive Branch.

The text defines public digital assets as systems and other resources created or acquired with public funds. It defines critical digital infrastructure by the serious effects that its interruption, failure, loss of control, or destruction would have. It also defines cybersecurity, protected information, and training differentiated by criticality, with its intensity, frequency, and complexity depending on the risks of each position.

The bill establishes a mandatory annual basic certification program. The Executive Branch, through the Ministry of the Presidency (Ministerio de la Presidencia) and the National Authority for Government Innovation (Autoridad Nacional para la Innovación Gubernamental, AIG), in collaboration with the Information Security Incident Response Team (Equipo de Respuesta a Incidentes de Seguridad de la Información, CSIRT), would determine each institution’s requirements, the training format and content, and competency standards. Training would have to adapt to emerging risks identified in the cybersecurity strategy. Those who operate or administer critical digital infrastructure, or have privileged access to it, would receive advanced training at intervals varying according to the assets and information they manage and their positions.

The program would be governed by shared responsibility, an environment of trust for reporting errors or alerts, continuing education, and prevention. Institutional human resources offices would incorporate certification into job manuals and induction, ensure periodic updates, and include compliance in performance evaluations. AIG would annually award a seal to institutions that certify that 100% of their workforce has completed the basic program. To prepare the training, it could seek support from the Ministry of Public Security (Ministerio de Seguridad Pública), state universities, and other public and private entities.

The bill classifies sharing access credentials, unjustifiably refusing to undertake or pass certification within the prescribed deadlines, and deliberately bypassing security controls on state equipment as serious disciplinary offenses. It makes these offenses subject to the Administrative Career Law or the applicable internal regulations. It gives public entities 12 months from the law’s entry into force to make administrative adjustments and complete the first cycle; requires the Executive Branch to issue implementing regulations within 90 days; and provides for the law to take effect the day after its promulgation. Its provisions concern public entities, the diplomatic service, state universities, and the covered state-owned companies.