Argentina mandates 180-day cybersecurity overhaul for state agencies

Argentina's government has set a hard deadline: six months for every state agency to overhaul how it protects digital systems from cyberattacks, system failures, and disasters. The order came from the National Cybersecurity Center in its first official directive, published in the government gazette in May. It is not a suggestion. It is a regulation with teeth, spelling out exactly what each agency must do, how to test it, and what happens if they fail.

The mandate rests on a simple principle: critical government services cannot simply vanish when something goes wrong. When a hospital's patient records system fails, or a tax agency's database is encrypted by ransomware, or a power grid control center loses connectivity, people suffer. The regulation forces agencies to think through what happens next—and to prove they have a plan that actually works.

Every affected organization must now classify its systems by how essential they are. High-criticality systems—the ones that keep the lights on, figuratively and literally—must be back online within four hours of a failure, with no more than one hour of data lost. Medium-criticality systems get a full day to recover, with up to four hours of acceptable data loss. Low-criticality systems can take between one and five days, as long as backups have been verified. These are not arbitrary numbers. They reflect the real cost of downtime measured in hours, in lost transactions, in public trust.

To meet these targets, agencies must build redundancy into everything. Each organization needs a backup data center—not in the same city, not in the same region, but at least 1,500 kilometers away from the main facility. The distance matters. A single flood, earthquake, or fire cannot take out both sites simultaneously. The backup center must be hardened: redundant power supplies, duplicate cooling systems, fire suppression, physical security, and the ability to keep running while maintenance happens. The two sites must be connected by at least two independent network links, preferably fiber optic cables running through different physical routes and contracted from different providers. A third link—satellite or radio—is recommended for extreme scenarios when everything else fails.

But having a backup center means nothing if no one has tested whether it actually works. The regulation transforms disaster recovery from a document that sits in a filing cabinet into an operational discipline. High-criticality systems must run a full recovery test every year, tabletop exercises twice a year, offline backup recovery tests, and network failover drills. Medium-criticality systems need annual full tests, quarterly tabletop exercises, and offline backup checks. Low-criticality systems must at least verify their backups through sampling. After each test, agencies must write a report documenting what worked, what failed, and how they will fix it. The process becomes continuous improvement, not a checkbox.

The regulation also demands that each agency maintain a detailed inventory of every system, application, dataset, piece of infrastructure, and external vendor it depends on. This inventory must be updated at least once a year, or sooner if the technology architecture changes significantly. Agencies must write formal contingency policies that define roles, responsibilities, procedures, and who has final authority when a crisis hits. They must develop playbooks for different types of incidents—ransomware attacks, physical destruction, data corruption—because not every crisis demands the same response.

The 180-day clock started ticking when the directive was published. That first deadline is when agencies must submit compliance reports showing they have a disaster recovery plan in place, including the location and technical specifications of their backup center and evidence of at least one successful failover test. But the real finish line comes at twenty months, when agencies must achieve Tier 3 certification—a higher standard of readiness and resilience.

Implementing this will not be cheap or easy. Agencies will need to budget for backup infrastructure, negotiate contracts with data center operators, hire or train staff in disaster recovery procedures, and coordinate across technical teams that may have never worked together before. Some agencies may lack the resources to build a backup center 1,500 kilometers away. Others may struggle to find qualified personnel to design and test these systems. The regulation assumes a level of technical sophistication and financial capacity that not all government organizations possess. Yet the mandate is clear: adapt or face non-compliance. The next six months will reveal which agencies are ready to build resilience and which are still hoping nothing bad happens.