technical report
The annual state cybersecurity report
Uruguay’s 2025 Budget Review Act created a new obligation: from 2027, every public entity must put the state of its cybersecurity in writing once a year — and that document reaches the head of the entity and Agesic. This 7-page note explains what article 23 requires, how it fits with the rules already in force and what should be resolved before 1 March 2027.
- Pages
- 7
- Format
- Language
- Español
- Cost
- Free
What it covers
- The enacted text of article 23, explained: what is reported, to whom and on what deadlines.
- The full regulatory chain in one table: Law 20.212 (arts. 78 and 79), Decree 66/025, MCU 5.0, Decree 275/025 and Decree 168/026.
- Why it was proposed: the 42,768 incidents of 2025, the 0.17 % of high severity and the investment culture Agesic wants to install.
- What the law leaves open: the format, the period covered, spending and the absence of external validation.
- The starting point: of 244 bodies covered by Decree 275/025, only 10 reported full compliance.
- The first cycle’s calendar and the seven steps worth starting before March, without waiting for Agesic’s format.
- What it means for state suppliers and for private companies in critical sectors.
Who it is for
- Heads and boards of public entities who will sign the report and need to understand what they are signing.
- State information security and IT leads, with less than five months to get the assessment done.
- Technology suppliers to the state and critical-sector companies, who will feel the requirement through their contracts.