On September 16, 2025, the National Cybersecurity Agency (ANCI) approved the preliminary list of Operators of Vital Importance ("OIV") of the first qualification process under Law No. 21,663, Cybersecurity Framework.
This resolution constitutes a milestone in the implementation of the new regulatory framework, by identifying the entities obliged to comply with reinforced requirements for the protection of essential services.
The qualification process covers State Administration agencies (147); public companies (21); and private companies that provide services in critical sectors: energy (307), telecommunications (52), digital infrastructure and IT services (748), banking, financial services and payment systems (111), and health institutions (326).
The list was submitted to public consultation regarding the preliminarily qualified private institutions, which will be available until Thursday, October 16, 2025 on the ANCI electronic platform. Interested entities may submit observations and supporting information within this process, in accordance with the Regulations.
The next step is the approval of the final OIV payroll, where the included entities will be subject to the obligations and reinforced cybersecurity standards provided for in Law No. 21,663 and its complementary regulations.
The full text of the payroll is available in the Official Gazette at the following link.
