MINTEL mandates public entities to designate an Information Security Officer

The Ministry of Telecommunications and the Information Society (MINTEL) reformed the Governmental Information Security Framework (EGSI) and redefined the role of the Information Security Officer (OSI), whose appointment is mandatory in every public entity and in public service concessionaires. The decision is contained in Ministerial Agreement No. MINTEL-MINTEL-2026-0008, published in the Official Registry, Seventh Supplement No. 399 of Wednesday, October 28, 2026, and entered into force on that same day, according to its final provision.

The agreement replaces Article 8 of Ministerial Agreement No. MINTEL-MINTEL-2024-0003, dated February 8, 2024, which issued the EGSI, and also replaces its annexes A, B, and C with version 3.0 of the framework. The instrument was signed on July 31, 2026, by Mr. Mgs. Ricardo Xavier Gutiérrez Cevallos, Minister of Telecommunications and the Information Society (E), appointed by Executive Decree No. 438 on July 1, 2026.

The EGSI is of mandatory implementation for public sector institutions included in Article 225 of the Constitution and for third parties providing public services through concessions or other legally recognized figures. The reform is based on Articles 19 and 20 of the Organic Law for Digital and Audiovisual Transformation and Article 38 of the Organic Law on the Protection of Personal Data. The process originated in Memorandum No. MINTEL-SGERC-2026-0106-M, dated July 31, 2026, from the Undersecretariat of Electronic Government and Civil Registry, which submitted technical report SGERC-DIISIRC-0004-2026.

Requirements and incompatibilities of the new profile

The reformed Article 8 establishes that the highest authority of each institution shall appoint an OSI with training and at least two years of experience in information security and cybersecurity areas. The previous text required the person to be a career official, preferably of a superior hierarchical level; this condition no longer appears in the current regulation.

The central conditions are:

• The OSI may be the head of the Information Security area, if such a unit exists.
• They must not belong to the processes, risks, administrative, financial, or information technology areas.
• The appointment must be communicated immediately to the Undersecretariat of Electronic Government and Civil Registry of MINTEL, through the tools provided for this purpose.
• The OSI acts as the institution’s point of contact with MINTEL.

Security Committee and institutional architecture

Annex A of version 3.0 details the structure that each entity must establish. The highest authority appoints the Information Security Committee (CSI) and the OSI, and must allocate the necessary resources.

The CSI is presided over by Planning and includes those responsible for Human Talent, Administration, Social Communication, Information Technologies, Legal, and the Data Protection Officer; the OSI and the delegate attend with a voice but without a vote. Institutions that do not fit this model must form a committee of at least three members. The committee meets ordinarily every two months and reports semi-annually to the highest authority on the progress of the EGSI.

Technical guides and functions of the officer

The EGSI v3.0 is structured into three guides: scheme implementation, based on NTE INEN ISO/IEC 27001:2022; risk management, based on NTE INEN ISO/IEC 27005:2022 and the MAGERIT methodology; and controls implementation, based on NTE INEN ISO/IEC 27002:2023.

Among the responsibilities assigned to the OSI are implementing and updating the EGSI, preparing the essential documentation of the system, coordinating the risk assessment and the selection of controls, executing the awareness plan, preparing the disaster recovery plan and the incident response procedure, and coordinating high-impact incidents that cannot be resolved internally with the sectoral or national Computer Security Incident Response Team (CSIRT). They must also carry out the handover of documentation to their successor before leaving the position.

The reform focuses on an obligation that already existed and makes it enforceable in verifiable terms: each entity must accredit a responsible person with proven technical training and separated from the areas that operate and finance the technology, so that security supervision no longer falls on those who administer the systems. The deadline runs from the date of publication, with no transition period in the official text.

Source: Official Registry, Seventh Supplement No. 399, October 28, 2026, section I (Ministry of Telecommunications and Information Society), p. 1 (official reference: Agreement No. MINTEL-MINTEL-2026-0008).