Cumplimiento y regulación — Blog T.I. RESCUE

Octubre 2, 2026

Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet

A mid-sized technology company in Cali had spent years selling to private clients without much fuss about security requirements. When it entered its first bid with a public entity, it found a list of requirements in the bidding document it had never needed before: a current ISO 27001 certification, evidence of a business continuity plan, and a signed declaration of Law 1581 compliance. It had to w

Octubre 1, 2026

Compliance Audit vs. Cybersecurity Audit: Key Differences

"We already had the audit done, so why do you keep finding vulnerabilities?" It's a question we hear more often than you'd expect, and it almost always reveals the same underlying confusion: the business hired a compliance audit, expecting it to also function as a technical cybersecurity audit. They're two different exercises, answering two different questions, and mixing them up can leave a busin

Septiembre 30, 2026

Is Your Company Legally Required to Report a Cyberattack in Colombia?

It's three in the morning, the IT team just confirmed there's active ransomware on the network, and in the middle of the technical chaos someone asks: "who do we actually have to tell?" It's one of the most anxiety-inducing questions during an incident, and the honest answer is: it depends. Colombia doesn't have a single law saying "every cyberattack must be reported here within 72 hours," the way

Septiembre 29, 2026

ISO 27001 Compliance Checklist for Colombian Companies in 2026

"We need ISO 27001 certification for the next contract" is a sentence we hear constantly from Colombian businesses that, until that moment, had never given the topic much thought. It usually arrives in the worst possible way: a large client, often in the financial or government sector, lists it as a requirement in a bid, and suddenly there are three months to get something that normally takes six

Septiembre 28, 2026

SIC Fines for Data Protection Violations: Real Cases in Colombia

Two thousand monthly minimum wages. That's the ceiling Law 1581 gives Colombia's Superintendency of Industry and Commerce (SIC) to fine a business that violates its personal data protection obligations. In today's pesos, that easily tops COP 2.6 billion for a single infraction. And contrary to what many businesses assume, the SIC doesn't reserve these penalties for massive breach scandals — most o

Septiembre 25, 2026

CONPES 3995 Explained: Colombia's National Digital Trust Policy

Most of Colombia's cybersecurity laws — Law 1581, Law 1273, the sector circulars from the SFC and Supersalud — were born either before or after a document few businesses know about, but which largely explains why all those other rules ended up existing: CONPES 3995 of 2020, the National Digital Trust and Security Policy. It's not a law that directly fines your business. It's something different, a

Septiembre 24, 2026

Supersalud Resolution 2654: Cybersecurity Requirements for Colombian Healthcare Providers

A patient's medical record is probably the single most sensitive piece of personal data that exists. It reveals what illnesses someone has, what medication they take, whether they've been in psychiatric treatment, whether they carry a genetic condition. That's why Colombia's healthcare sector isn't governed only by the general Habeas Data Law like any other business — the Superintendencia Nacional

Septiembre 23, 2026

SFC Circular 007: Cybersecurity Requirements for Colombia's Financial Sector

No Colombian bank signs a contract with a technology vendor without first asking about Circular 007. In the day-to-day reality of the financial sector, it's the exam any vendor has to pass before getting near sensitive data. If your business is an entity supervised by the Superintendencia Financiera (SFC) — a bank, fintech, financial cooperative, investment fund, or insurer — this circular isn't a

Septiembre 22, 2026

Colombia's Cybercrime Law (Law 1273): What It Says and How It Protects You

What crime does someone actually commit by breaking into your company's server without permission? Before 2009, the answer in Colombia was awkward: probably none, specifically. Prosecutors had to force the facts into generic categories — theft, property damage — that didn't really describe what had happened. Law 1273 of 2009 closed that gap by amending the Criminal Code to create its own protected