On March 13, 2025, Supreme Decree No. 285 of 2024, issued by the Ministry of the Interior and Public Security, was published in the Official Gazette, approving the Regulation on the Qualification Procedure for Operators of Vital Importance under Law No. 21,663.

This regulation establishes the procedure by which the National Cybersecurity Agency ("ANCI") will determine which essential service providers ("PES") qualify as operators of vital importance ("OIV"), setting out applicable criteria, evaluation mechanisms, and administrative procedures.

Key Aspects of the Regulation:

• Qualification Criteria:
  • The provision of the service must depend on networks and information systems.
  • Its disruption, interception, or destruction must significantly impact public security, essential service continuity, or state functions.
• Evaluation of Significant Impact:
  • Number of people affected by a disruption.
  • Availability of alternative providers (service redundancy).
  • Existence of a single service provider (monoprovision).
  • Interdependence between essential services.
  • Relevance of the affected institution.
• Qualification Procedure:
  • ANCI will assess technical reports from sectoral regulatory bodies.
  • Private institutions may voluntarily provide information for evaluation.
  • A preliminary list will be subject to public consultation for comments.
  • The final list will be approved by resolution and published in the Official Gazette or another official dissemination channel.
  • Administrative and judicial appeals may be filed against this resolution.
  • OIV status must be reviewed at least every three years.
• Qualification of Private Entities as OIV:
  • ANCI may designate private institutions as OIVs if, despite not being PES under Article 4 of the law, they meet the requirements in Article 5, paragraph 2, and their designation is essential due to:
    • Their critical role in supply chains, distribution of goods, or production of strategic products.
    • Their exposure to cybersecurity risks, considering incident probability and economic and social consequences.
• Deadlines and Implementation:
  • The first qualification process for OIVs must begin within 90 days of the entry into force of Articles 5, 8, 9, and Title VII of Law No. 21,663.

The full text of the regulation is available in the Official Gazette at the following link.