§ Compliance · Updated 2026-10-20
AGESIC Cybersecurity Framework: what it requires and from whom.
Since Law 20,212 and Decree 66/025, public entities and private entities linked to critical services or sectors in Uruguay have concrete cybersecurity obligations: a security officer, incident reporting within 24 hours and adoption of the Cybersecurity Framework 5.0.
At a glance
- Main law
- Law 20,212, arts. 78–84 (2023)
- Regulation
- Decree 66/025 (2025)
- Technical framework
- Cybersecurity Framework 5.0, aligned with NIST CSF 2.0
- Incident reporting
- 24 hours to CERTuy
- Authority
- AGESIC
Who it applies to
All public entities and private entities linked to critical services or sectors (Decree 66/025, art. 2). The decree defines 13 critical sectors, including health, energy, telecommunications, transport, water, banking and finance, industry and public services (art. 3).
If your organization provides services to an entity in these sectors, these requirements will very likely reach you through contracts even if the rule does not apply to you directly.
What it requires
- Protect critical information assets and plan mitigation measures (Law 20,212, art. 78).
- Appoint an information security officer, internal or external, with technical independence (Decree 66/025, art. 10).
- Report incidents to CERTuy within 24 hours of becoming aware of them (Decree 66/025, art. 10; Law 20,212, art. 80).
- Keep centralized logs for at least 12 months (Decree 66/025, art. 11).
- Adopt the Cybersecurity Framework and reach the minimum maturity level of the profile assigned by AGESIC (arts. 14 and 15).
- Run audits based on the Framework, with an executive summary within 30 days and an action plan within 60 days (arts. 16 and 17).
Decree 66/025 repealed Decrees 451/009 and 452/009, which for years were the information security reference for the public sector.
The Cybersecurity Framework 5.0
It is the current version of AGESIC's framework, aligned with the NIST Cybersecurity Framework 2.0. It organizes 72 requirements into 6 functions (Govern, Identify, Protect, Detect, Respond and Recover) and 21 categories.
It defines three profiles (Basic, Standard and Advanced), each with a baseline and three-year targets, and includes a maturity model, profile templates, an implementation guide and an audit guide.
Public bodies: mandatory MFA
Decree 275/025 requires the public administration to enforce multi-factor authentication (MFA) on all systems within 120 days, and within 30 days for internet-exposed systems (or VPN access with MFA). It also requires an annual inventory of exposed systems, closing unused ports and systems, and monthly reporting to AGESIC.
⏱ Deadlines and frequencies
| Deadline | What | Rule |
|---|---|---|
| 24 hours | Report an incident to CERTuy | Decree 66/025, art. 10 |
| 12 months | Minimum retention of centralized logs | Decree 66/025, art. 11 |
| 30 days | Audit executive summary | Decree 66/025, art. 17 |
| 60 days | Post-audit action plan | Decree 66/025, art. 17 |
| 30 / 120 days | MFA on exposed systems / on all systems (public sector) | Decree 275/025 |
→ How I help
- Gap assessment against Framework 5.0 and the profile that applies to you.
- External security officer role (vCISO) with the technical independence the decree requires.
- Incident response and reporting procedure to meet the 24-hour deadline.
- Audit preparation and support for the follow-up action plan.
? FAQ
Is the Cybersecurity Framework mandatory for private companies?
It is mandatory for private entities linked to critical services or sectors (Decree 66/025, arts. 2 and 14). For others it is voluntary, although more and more clients and tenders ask for it.
How quickly must an incident be reported?
Covered entities must notify CERTuy within 24 hours of becoming aware of it. If personal data is affected, the 72-hour deadline before the data protection authority (URCDP) runs in parallel.
Can the security officer be external?
Yes. Decree 66/025 allows an internal or external officer, as long as they have technical independence.
Official sources
- Law 20,212, arts. 78–84 (IMPO) ↗
- Decree 66/025 (IMPO) ↗
- Decree 275/025 (IMPO) ↗
- Cybersecurity Framework 5.0 (AGESIC) ↗
- Report an incident (CERTuy) ↗
General information, verified against official sources on the date shown. It does not replace legal advice for your case.
Other regulations