Cybersecurity regulation in Costa Rica (2026)

A Costa Rican tribunal issued a second ruling affirming the validity of Decree 44196-MSP-MICITT's 5G cybersecurity requirements, rejecting legal challenges mounted by equipment vendors including Huawei. The rulings cement the government's authority to impose supply-chain security conditions on critical telecom infrastructure providers.

MICITT published the successor National Cybersecurity Strategy built on five pillars — governance, legal framework, critical infrastructure protection, capacity-building, and international cooperation — directly incorporating lessons from the 2022 ransomware crisis. The strategy mandates creation of a national Security Operations Centre (SOC-CR) and assigns MICITT as the permanent lead-coordinating authority.

Executive Decree 44196-MSP-MICITT established mandatory cybersecurity requirements for providers of 5G and next-generation telecommunications services, including supply-chain risk controls and equipment-trustworthiness assessments. This is Costa Rica's first sector-specific cybersecurity regulation and triggered extended litigation by affected vendors.

The Legislative Assembly approved Expediente 23292 for full plenary debate; the bill would create a National Cybersecurity Agency within MICITT, establish a critical information infrastructure (CII) protection regime, and impose mandatory incident-reporting obligations across public and private sectors. As of 2025 the bill had not yet been finally enacted.

The Hive ransomware group attacked the Costa Rican Social Security Fund (CCSS), taking down the national digital health-record system and hospital payroll across the country; more than 800 servers and 9,000 end-user computers were affected. Occurring just weeks after the Conti crisis, the attack demonstrated that the cyber emergency extended far beyond the initial wave.

Newly inaugurated President Rodrigo Chaves signed Executive Decree 43542-MP-MICITT, declaring a national state of emergency across the entire public sector due to the Conti ransomware attacks — the first cyber-emergency declaration in Costa Rican history and among the first in Latin America. The decree unlocked emergency procurement authority and mandatory inter-agency coordination under MICITT.

Issued four days after the Conti attack began, Directive 133-MP-MICITT obligated all central public administration entities to report cybersecurity incidents affecting service confidentiality, integrity, availability, or institutional identity to CSIRT-CR — even incidents considered internally under control. It established [email protected] as the mandatory reporting channel and required preservation of incident evidence.

The Russia-linked Conti group breached the Ministry of Finance, MICITT, the Tax Administration, Customs, RACSA, and approximately 27 other government entities, encrypting systems and exfiltrating taxpayer data; Conti demanded a $10 million ransom and ultimately published 97% of stolen data after Costa Rica refused to pay. The attack paralysed tax and customs services for weeks and catalysed a complete overhaul of Costa Rica's cybersecurity governance.

President Laura Chinchilla signed Law 9048, amending the Penal Code to criminalise hacking, unauthorised access to computer systems, data interception, and electronic fraud in alignment with the UN Convention on Cybercrime framework. Law 9135 (2013) followed with additional cybercrime provisions, completing the first generation of substantive cyber-criminal law.

Decree 37052-MICIT created the Computer Security Incident Response Team of Costa Rica (CSIRT-CR) within MICITT with authority to coordinate incident response across the three branches of government, autonomous institutions, and state-owned banks. CSIRT-CR became Costa Rica's first dedicated national cyber-defence body and the primary point of contact for international incident coordination.

Law 8968 (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales) established Costa Rica's foundational personal-data protection regime, created the enforcement agency PRODHAB, and enshrined informational self-determination as a constitutional right under Article 24. The law imposes data-security obligations on all public and private data controllers and remains the primary privacy-security baseline.