Chilean Cybersecurity Framework imposes strict reporting mandates

Chile's Framework Law on Cybersecurity, which established the National Cybersecurity Agency (ANCI) in early 2025, has introduced rigorous reporting requirements for organizations. Under Law 21.663, essential services and Operators of Vital Importance (OIV) must provide early alerts within three hours of an incident. A second report is required within 72 hours, with a final report due after 15 days.

Experts note that meeting these three-hour windows presents a significant operational challenge, particularly when security alerts are managed in isolation without advanced analytics. The difficulty is compounded by evolving attacker tactics, such as the use of legitimate system tools and cloud services rather than traditional malicious files.

As of 2025, Chile and Colombia remain among the top four countries in Latin America for cyberattack attempts. In Chile, the law empowers ANCI to oversee compliance, issue fines, and mandate formal security management systems for over 1,154 critical operators. Maximum fines for serious infractions can reach approximately USD 3 million.