Industrial Cyber Summit Chile 2026<\/a> with a direct and unadulterated overview of this new regulatory landscape: what the law requires, who has to report, and what comes next.<\/p>\n\n\n\nBordachar started with the why. If Chile wants to consolidate itself as a medium power \u2014that is, to weigh in on international decisions without the size of the country being a limiting factor\u2014, it needs a cybersecure and more resilient ecosystem. That idea is not just rhetoric: the international relations the agency is building give Chile access to strategic information and technical capabilities that it would otherwise not have, and they put it on the table where global cybersecurity rules are decided. A country absent from that table, he warned, risks leaving its autonomy at risk from cyberspace.<\/p>\n\n\n\n
<\/p>\n\n\n\n
What the ANCI does (and what it doesn\u2019t)<\/h2>\n\n\n\n The agency's role, summarized by its own director, has three legs: preventing, containing, and managing cybersecurity incidents; promoting the development of culture and capabilities within the country; and providing a secure interconnection network for state agencies. To fulfill that role, the ANCI has regulatory, fiscal, and sanctioning powers over both the public and private sectors.<\/p>\n\n\n\n
One of the points that Bordachar insisted on clarifying, because it continues to generate confusion, is who is required to report. It is not just the Operators of Vital Importance (OIV): any public or private institution that provides services within any of the regulated sectors is an essential service and, therefore, an obligated entity, regardless of its size. A two-person company that provides digital services in a regulated sector has the same reporting obligation as a company with thousands of employees.<\/p>\n\n\n\n
What needs to be reported, and how soon<\/h2>\n\n\n\n The law has not yet issued specific mandatory standards for all sectors: the agency\u2019s first year was focused on establishing itself, from renting offices to setting up the incident reporting platform. To advance in regulations, the ANCI must conduct public consultations before setting standards, and it already did so this year. Meanwhile, what already exists is the general cybersecurity duty and, above all, the duty to report any incident with significant impact.<\/p>\n\n\n\n
Bordachar was frank about the broadness of these concepts: \u00abinterrupt\u00bb and \u00abaffect\u00bb are weak verbs, and \u00abintegrity\u00bb is such a broad concept that practically any system with personal data falls within it. Her recommendation, in the event of doubt, is to report: if the agency determines that it was not a significant incident, they simply report it and the institution continues on its way; if it was, ANCI helps manage it with guidelines and recommendations, although it may not always send people to the scene.<\/p>\n\n\n\n
The deadlines, on the other hand, are specific and it\u2019s worth having them on hand.<\/p>\n\n\n\nTime limit<\/th> What needs to be delivered<\/th><\/tr><\/thead> 3 hours from the time it is known<\/td> The observable effects of the incident<\/td><\/tr> 72 hours later<\/td> Update of the initial assessment and indicators of commitment<\/td><\/tr> 15 days from when the incident stops being ongoing<\/td> Final report<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nSource: Michelle Bordachar Benoit (ANCI), opening keynote at the Industrial Cyber Summit Chile 2026.<\/em><\/p>\n\n\n\nThe taxonomy that defined these deadlines was deliberately designed to be simple, something that at the time earned it criticism from experts for being \u00abnot very sophisticated.\u00bb It was a deliberate decision: it has to be able to report on the same level as a large institution with dedicated security teams as well as a small business without any cybersecurity experts.<\/p>\n\n\n\n
Reports like radar: the Rutifay case<\/h2>\n\n\n\n The value of this system, Bordachar explained, lies in the fact that the reports feed into threat research and proactive warnings before vulnerabilities are exploited. The Rutifay case is the most concrete example: when the leak came to light, the ANCI had already been monitoring dark web chats and was able to determine that much of the information being sold corresponded to previous vulnerabilities, some even dating back to the cybersecurity framework itself, recombined in a more attractive way for sale. That joint investigation with the affected institutions contributed to the arrest of one of the involved individuals.<\/p>\n\n\n\n
The agency is equally strict on the other side: it systematically refuses to hand over, in the face of requests for transparency, which institutions reported or suffered incidents. For Bordachar, that confidentiality is the basis of the trust that underpins the entire system; the day that that information is revealed, the regulated parties stop reporting honestly.<\/p>\n\n\n\n
This same logic of aggregated data led to another concrete result: by analyzing five cybersecurity incidents in state agencies, the agency detected a pattern of behavior from an attacker group and was able to issue secret instructions to vulnerable institutions. Thanks to this, at least 21 institutions avoided becoming victims of the same ransomware, with an estimated savings of more than 1 billion pesos for the public sector, counting only direct costs for specialized support.<\/p>\n\n\n\n
Why the ANCI does not require ISO 27001<\/h2>\n\n\n\n One of the questions that the agency receives most often is why it does not directly impose a standard like ISO 27001. Bordachar\u2019s answer ties into the same principle of simple taxonomy: the ANCI regulates enormously diverse institutions, from microenterprises to corporate giants, spread across 15 different sectors, and requiring such a sophisticated standard would leave out a large portion of them from compliance. There is also an uncomfortable fact behind that decision: the majority of the serious incidents and cyberattacks that the agency has seen occurred in institutions that were indeed ISO 27001 certified. They performed very well on paper, but in practice people were not complying.<\/p>\n\n\n\n
From there they emerged the \u00abNine basic things\u00bb<\/a>, Published on the agency\u2019s website: nine measures that, according to their own data, could prevent 80% of incidents and cyberattacks. Bordachar was clear that imposing them is not enough: you have to explain to the teams why each one is necessary. The double authentication factor, for example, is not \u00abjust another annoying step,\u00bb but the most effective way to prevent the compromise of accounts, which in 2025 was the main cause of incidents in Chile, followed by exploiting vulnerabilities and operational causes. Today, the list repeats itself with a variant that worries more and more: phishing, increasingly sophisticated, no longer appeals to the typical \u00abprince who promises an inheritance\u00bb but to real data from the victim \u2014travels, miles, passport number\u2014 stolen from airlines and other platforms, to offer credible promotions.<\/p>\n\n\n\nWhat's coming: a citizen report and \u00abPuerto Seguro\u00bb<\/h2>\n\n\n\n Bordachar concluded with a first: in the coming days the agency will launch a citizen reporting portal, distinct from the incident reporting portal that already exists. It will include two programs. One is a \u00abbug bounty\u00bb program for state institutions and private companies that want to join. The other is \u00abPuerto Seguro,\u00bb protected by Article 19 of the law, which obliges the agency to maintain strict secrecy about what it receives through ethical hacking. Thanks to this measure, the ANCI has already been able to alert institutions about vulnerabilities before they were discovered and exploited by criminals.<\/p>\n\n\n\n
The underlying message, with which Bordachar closed his presentation, was to return to the basics: normative sophistication is useless if the nine basic measures are not understood and not applied every day. That is, today, the real map of the Cybersecurity in critical infrastructures<\/a> in Chile: a young agency, still in its infancy, that is already using its data to prevent attacks before they happen, while it is finishing building the regulatory framework that will be required tomorrow. Those who want to delve into how this connects to the Convergence of IT and OT in the Chilean energy sector<\/a> or with the rest of the scientific agenda of the event they can review the Panel on quantum computing and AI<\/a> from the same Cyber Summit Chile 2026.<\/p>","protected":false},"excerpt":{"rendered":"La Ley 21.663 dej\u00f3 de ser una promesa regulatoria para convertirse en el mapa real que hoy ordena la ciberseguridad en Chile, y nadie lo explica mejor que quien la…<\/p>","protected":false},"author":6,"featured_media":22805,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-22804","post","type-post","status-publish","format-standard","has-post-thumbnail","category-compliance-estrategia-y-ciberresiliencia"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t