1 PLANNING Legal Framework Finally, it is extremely important to define the legal authority under which the National CSIRT will be established. This must conform to the legal standards of the country concerned, and it must ensure implementation. If not adopted correctly, a faulty legal framework can lead to lawsuits or complications in responding to cyber incidents. This is why it is so important that mission, vision, and the institutional framework are assessed by legal experts, either from government or academia or both, specifically to answer the following questions. The following are examples of different legal frameworks that institutionalize CSIRTs in the region: CSIRT | Panama Executive Decree No. 709 of September 26, 2011 ColCERT | Colombia CONPES Document 3701 • Is the CSIRT acceptable from a legal standpoint? Does it contradict any laws, or allow for any loopholes whose exploitation may have a negative effect on the response team and its duties? • What instrument will be used for the institutional framework? Legislation, decrees, or resolutions? • Can the CSIRT employ any legal measures to guarantee funding? • How will human resources be contracted? CERTuy | Uruguay Law 18.719 year 2008. Executive Decree 451, year 2009 The conclusions of the legal analysis should appear as an appendix or addendum to the CSIRT’s document of establishment. ICIC CERT | Argentina Resolution Chief of the Cabinet of Ministers 580/2011 36 A B C D Establishment 37