Within the Cybersecurity Framework Law (Law No. 21,663), the National Cybersecurity Agency (ANCI, for its initials in Spanish) published Exempt Resolution No. 85 in the Official Gazette, approving the preliminary list of institutions classified as Vital Importance Operators (OIV, for its initials in Spanish) corresponding to the second stage of the first classification process, thereby initiating the respective public consultation.

This stage covers essential service providers from both the public and private sectors, whose activities are related to the transportation, storage or distribution of fuel; the supply of drinking water or sanitation services; land, air, rail, or maritime transportation and the operation of their respective infrastructure; the administration of social security benefits; postal and courier services; production and/or research of pharmaceutical products; as well as services provided under public service concessions. Likewise, the resolution incorporates entities belonging to sectors considered in the first stage that had not been included in the previous preliminary list.

For the preparation of the list, ANCI requested substantiated technical reports from various sectoral authorities, including the Superintendency of Electricity and Fuels (SEC, for its initials in Spanish), the Public Health Institute (ISP, for its initials in Spanish), and the Undersecretariat of Transport, among others. The analysis considered, inter alia, the potential impact of service disruption, the dependence on information systems for service provision, and the existence or absence of alternative providers, in accordance with the applicable regulatory framework.

As a result of the process, 372 institutions were preliminarily classified as OIVs in this second stage, distributed as follows:

• Fuel transportation, storage and distribution: 27

• Drinking water supply or sanitation services: 29

• Land, air, rail or maritime transportation, as well as the operation of their respective infrastructure: 62

• Administration of social security benefits: 26

• Postal and courier services: 37

• Production and/or research of pharmaceutical products: 43

• Other public service concessionaires: 56

Additionally, the resolution incorporates 92 entities corresponding to sectors included in the first stage that had not been part of the previous preliminary list.

Criteria for classification as Vital Importance Operators

The Cybersecurity Framework Law provides that ANCI may classify as OIVs those essential service providers whose provision depends on computer networks and information systems, and whose impairment, interruption or destruction may generate a significant impact on public security and order, the continuity of essential services, or the performance of State functions.

Furthermore, pursuant to the Regulation on the Procedure for the Classification of Vital Importance Operators, ANCI must consider criteria such as the number of potentially affected persons, service redundancy or single-provider conditions, interdependence with other essential services, and the relevance of the institution involved.

Public consultation

With the publication of this resolution, a period of 30 consecutive days begins, during which individuals and legal entities may submit observations regarding the preliminary list. This process will be carried out exclusively through the ANCI Portal.

Once this period ends, ANCI will review the submitted information and will publish an executive summary prior to issuing the resolution that establishes the final list of Vital Importance Operators for the sectors covered in this second stage.