Cybersecurity is an issue that concerns all companies, which must conduct risk audits of their systems and include technical and procedural controls that guarantee the security of their data. 

These were some of the conclusions reached by the panel of four experts who discussed the webinar "Legal Aspects of Cybersecurity in the Face of COVID-19," moderated by Fabiola Medina.

In this space, James Pichardo, Elianna Peña, César Moliné, and Pascal Peña also discussed the need for the Dominican Republic to have a cybersecurity law that would begin to allow for the generic and mandatory implementation of certain measures.

In her welcoming remarks, Legal Committee Chair María Esther Fernández emphasized that the cybersecurity-focused event, which was produced through close collaboration with AMCHAMDR's ICT Committee, seeks to contribute to the legal community and the general public.

The first panelist to present was Pascal Peña, a specialist in international law, competition law, and regulated markets. He, also a partner at Alies Pascal Abogados, stated that the COVID-19 situation has led to a surge in online interactivity, remote work, and demand for telecommunications services, which in turn has raised concerns about cybersecurity.

The expert believes that companies must prioritize self-regulation to ensure the security of their IT systems if they want to succeed in their digital transformation processes.

"If businesses don't take appropriate cybersecurity measures, they will be subject to liability for their noncompliance. That's why it's important for companies to structure appropriate responses to potential cyberattacks." he stated.

The presentation by the Director of Cybersecurity, E-Commerce, and Digital Signatures at the Dominican Telecommunications Institute (INDOTEL) emphasized this. César Moliné stated that efforts have been underway for several years to create a secure internet space in the country, and that part of this vision is centered on the National Cybersecurity Strategy.

He believes that cyber resilience must be promoted in the country, and that critical infrastructure must be designated, which would be subject to audits and cybersecurity exercises to strengthen contingency plans for any cyberattack.

"These critical infrastructures will be required to provide relevant information, report incidents that could affect their computer security, and conduct cybersecurity exercises." said Moliné, who has more than 15 years of experience in legal, technical and administrative matters in competition policy regulation..

A key point for James Pichardo, executive director of the National Cybersecurity Center, is that, in the wake of COVID-19, cyberthreats from hackers using phishing, data theft, and redirecting users to malicious sites have increased in recent months.

In this regard, he said that companies should implement basic cyber hygiene measures in their information systems to reduce the possibility of being attacked.

"Basic recommendations for businesses include using antivirus protection software; browsing secure directory services that don't redirect you to malicious sites; using a secure encrypted VPN connection to the internet; and using multi-factor authentication passwords." suggested the expert who has more than 10 years of experience in Information Security in the commercial, academic, telecommunications and government sectors.

The final presentation was given by Eliana Peña, director of Claro's Legal Department, who emphasized that companies should assume the protection of their systems, IT structures, and third-party information as part of their business activities.

“Not having a program or organizational culture to ensure cybersecurity can pose operational risks for companies,” Peña sentenced.

It recommends that companies have compliance programs that cover security issues and include an assessment of the company's own risks, technological risks, and operational risks, as well as technical, regulatory, and procedural controls.

“Cybersecurity is everyone's concern. The more we can be confident that our internal structure and assets are secure, the stronger our business will become. Self-regulation mechanisms must be in place to prevent cyberattacks.”, he concluded.