Cybersecurity law & regulation in Cuba (2026)
Cybersecurity in Cuba: sectoral rules.
Cuba's cybersecurity regime is built on a state-centric, sector-focused architecture anchored in Decreto 360/2019 and Decreto-Ley 35/2021, which together regulate ICT security, national cyberspace defence, and critical infrastructure protection. The Ministry of Communications (MINCOM) and its subordinate Office of Computer Network Security (OSRI) serve as primary authorities, with mandatory incident-reporting obligations for legal persons. No comprehensive horizontal law comparable to NIS2 is in force; the framework prioritises national security and state information control alongside technical cybersecurity obligations.
Legal framework
Decreto 360/2019 (ICT Security and Defense of National Cyberspace); Decreto-Ley 35/2021 (Telecommunications, ICT and Radio-Electric Spectrum); Resolution 105/2021 (National Action Model for Cybersecurity Incident Response); overseen by MINCOM and OSRI (Oficina de Seguridad para las Redes Informáticas)
Key points: cybersecurity in Cuba
Decreto 360/2019, Core Cyberspace Defence Law
Enacted 31 March 2019 by the Council of Ministers, Decreto 360 establishes the legal basis for securing ICT systems, protecting Critical ICT Infrastructure, and defending the national cyberspace. It tasks MINCOM, in coordination with the Ministries of Interior and the Revolutionary Armed Forces, with maintaining a National Catalogue of Critical ICT Infrastructure and a corresponding protection plan.
Decreto-Ley 35/2021, Telecoms and Cybersecurity Update
Published in Official Gazette No. 92 on 17 August 2021, Decreto-Ley 35 is the first superior-rank legislative instrument to expressly address cybersecurity. It obliges telecommunications and internet service providers to investigate and shut down malicious activity, restricts the import and sale of networking devices without MINCOM authorisation, and authorises internet and mobile-data service suspensions for security or public-order grounds.
Resolution 105/2021, Incident Classification and Mandatory Reporting
Resolution 105 (complementing Decreto-Ley 35) defines the National Action Model for Cybersecurity Incident Response. It classifies incidents on a four-tier danger scale (low, medium, high, very high) and requires all legal persons to notify OSRI of cybersecurity incidents regardless of whether the entity can resolve the incident internally. Reports are submitted via www.osri.gob.cu or the dedicated hotline/email.
Critical Infrastructure Scope
Critical ICT Infrastructure is defined to cover systems underpinning strategic economic sectors, national security and defence, and public administration services, including industry, health, energy, and transportation. MINCOM maintains and updates the National Catalogue of Critical ICT Infrastructure in coordination with security and defence ministries.
OSRI and CuCERT, National Authorities
OSRI (Oficina de Seguridad para las Redes Informáticas), a body within MINCOM, is Cuba's primary cybersecurity authority. Within OSRI, the CuCERT functions as the national Computer Emergency Response Team, receiving and analysing incident reports and developing threat intelligence, though Cuba's exclusion from certain international CERT cooperation frameworks limits cross-border information sharing.
International Cyber Law Position (2024)
Cuba submitted a formal National Position on the application of international law in cyberspace to the UN Open-Ended Working Group on ICT security on 28 June 2024, reaffirming state sovereignty over national cyberspace and support for a binding UN cyber convention, consistent with the domestic regulatory emphasis on state control.
Timeline of decisions
- EnforcementCuba Declares Unauthorized Starlink Use Illegal; Customs Seizes 27+ Terminals
The government warned that operating Starlink terminals without MINCOM authorization violates Resolution 272/2015, with penalties including fines, equipment confiscation, and criminal proceedings; Cuban Customs seized over 27 terminals between April and May 2025, some hidden inside televisions. The action reinforces state monopoly over satellite spectrum and blocks unfiltered internet access for citizens.
CiberCuba
- Decision · officialCuba Submits National Position on International Cyber Law to UN OEWG
Cuba submitted its formal position to the UN Open-Ended Working Group on ICT security, arguing existing international law can only be applied to cyberspace 'by analogy' and calling for a dedicated binding international cyber treaty under UN auspices. It is Cuba's first structured multilateral engagement on cyber governance norms.
CCDCOE Cyber Law Toolkit
- Law · officialDecree-Law 35/2021 and Resolution 105/2021 Create Broad Internet-Control and Cybersecurity Framework
Published in Official Gazette Extraordinary No. 92, Decree-Law 35/2021 on Telecommunications, ICTs, and Radio Spectrum Use — together with companion Decrees 42 and 43 and MINCOM Resolution 105/2021 on Cybersecurity Incident Response — authorized suspension or termination of internet services for content deemed 'false,' threatening 'public order,' or harmful to 'morality,' and legally codified blanket internet shutdowns. Human-rights organizations condemned the package as institutionalising censorship and mass digital surveillance.
Gaceta Oficial de la República de Cuba, No. 92/2021
- Law · officialDecree-Law 35 Package: Cuba's First Comprehensive Cybersecurity Legal Framework
Gaceta Oficial No. 92/2021 published Decree-Law 35 on Telecommunications, ICT and the Radio Spectrum, plus Decrees 42-43 and Resolutions 105, 107, and 108; for the first time Cuban law formally typified cybersecurity incidents in legal categories and empowered ETECSA to suspend service to any user transmitting 'false,' destabilizing, or morally offensive content. Resolution 105 established the national model for cybersecurity incident response across all sectors.
Ministerio de Relaciones Exteriores de Cuba (MINREX)
- Law · officialDecreto 360/2019: ICT Security and Defense of National Cyberspace
Signed 31 March 2019 and published in Gaceta Oficial No. 31, Decreto 360 established the overarching legal framework requiring all state bodies, enterprises, cooperatives, and natural persons to meet defined ICT security levels and mandated protection of Critical ICT Infrastructures; it designated MINCOM as principal regulatory authority. The decree is the structural backbone on which all subsequent cybersecurity norms were built.
Gaceta Oficial de Cuba
- GuidanceMINCOM Resolution 57/2003 — Cuba's First Dedicated IT-Security Norms for Computing Systems
Cuba's Ministry of Communications issued Resolution 57/2003, establishing the first sector-specific norms governing information security and confidentiality for computing systems operated by state entities. It set baseline standards for protecting electronically stored data and assigned MINCOM responsibility for their enforcement, representing the earliest building block of Cuba's eventual data-governance architecture.
EUMED — Cuban IT-Security Legislation Survey
- Decision · officialMinistry of Information and Communications (MIC/MINCOM) Established as Cyber Regulator
Cuba created the Ministerio de la Informática y las Comunicaciones, later reorganized as MINCOM, as the sole regulatory authority over internet and telecommunications, and launched the Programa Rector para la Informatización de la Sociedad. MINCOM has served as the apex cybersecurity regulator for all subsequent legislation and enforcement.
Ministerio de Comunicaciones de Cuba (MINCOM)
- LawDecree-Law 199: Security and Protection of Official Information
The Council of State promulgated Decree-Law 199 in November 1999, regulating the protection of official information for all state organs, entities, and persons in Cuban territory and establishing Cuba's first systemic legal protections for government-held data. It formed the pre-internet-era pillar of information security on which later ICT legislation was layered.
Informática Jurídica
Sources
- gacetaoficial.gob.cu/es/decreto-360-de-2019-de-consejo-de-ministros
- mincom.gob.cu/sites/default/files/marcoregulatorio/d_360-2019_seguridad_tic_y_ciber
- granma.cu/cuba/2021-08-17/dispone-cuba-de-nuevas-normas-juridicas-sobre-telecom
- en.granma.cu/cuba/2021-09-03/how-are-cyber-security-incidents-handled-in-cuba
- misiones.cubaminrex.cu/en/articulo/cuba-updates-legal-framework-telecommunications-and-typif
- therecord.media/cuba-passes-internet-censorship-and-cybersecurity-law
- cyberlaw.ccdcoe.org/wiki/National_position_of_Cuba_(2024)
Next for Cuba: Starting a BusinessRestricted
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026