In Chile, cybersecurity compliance is becoming an operational issue, not just a legal one. Under the new Cybersecurity Framework Law, organizations must show they have real capabilities for threat detection, incident analysis, and response. For many teams, that exposes a serious gap between regulatory expectations and day-to-day security operations. <\/p>\n\n\n\n
Chile has taken a decisive step toward strengthening its national cybersecurity posture with the approval of Law No. 21.663<\/strong> \u2013 the Cybersecurity Framework Law. This legislation establishes mandatory cybersecurity obligations for organizations classified as: <\/p>\n\n\n\n Unlike traditional compliance frameworks that focus on policies and documentation, Chile’s approach is outcome-driven and risk-based. Organizations must demonstrate real operational capabilities<\/strong>\u2013 not just checkbox compliance. With enforcement and audits ramping up through 2025-2026, the compliance window is closing fast.<\/p>\n\n\n\n The scope is broad. An estimated 915 organizations<\/strong> across energy, telecommunications, banking and financial services<\/a>, digital infrastructure, healthcare<\/a>, and public institutions must now prove their cybersecurity readiness.<\/p>\n\n\n\n Chile\u2019s Cybersecurity Framework Law does not mandate specific tools, but it does set clear expectations for operational readiness. Regulated organizations are expected to have the following: <\/p>\n\n\n\n \u2705 Effective threat detection:<\/strong> Identify malicious activity before it causes damage Regulated entities must permanently apply technical and organizational measures to prevent, report, and resolve cybersecurity incidents in line with ANCI protocols and sector-specific standards. They must also report significant cyberattacks and incidents to the national CSIRT under a defined timeline. <\/p>\n\n\n\n For operators of vital importance, requirements are stricter. They must run a continuous information security management system, document security actions, and maintain certified cybersecurity and continuity plans, reviewed at least every two years.<\/p>\n\n\n\n They are also expected to conduct regular exercises, implement rapid containment measures, train staff, and appoint an independent cybersecurity delegate with direct access to top management and formal responsibility for coordination with ANCI. <\/p>\n\n\n\n\n\n
\n
\n
What the New Law Requires from Security Teams <\/h2>\n\n\n\n
\u2705 Timely incident analysis and response:<\/strong> Understand what happened, how, and what to do
\u2705 Continuous risk management: <\/strong>Adapt defenses as the threat landscape evolves
\u2705 Evidence-based reporting: <\/strong>Provide detailed, defensible reports to Chile’s national CSIRT and regulatory authorities <\/p>\n\n\n\n