This analysis challenges a common assumption in cybersecurity policy debates in Latin America and the Caribbean: that the primary problem is the absence of law. The authors argue instead that the core issue is the lack of a coherent legal architecture capable of enabling preventive, risk-based cybersecurity governance. While most countries rely on fragmented criminal, administrative or sector-specific rules, only a handful have adopted dedicated cybersecurity legislation – resulting in conceptual ambiguity, coordination gaps and uneven operational capacity.  

Using a comparative legal analysis benchmarked against international standards such as NIS2, DORA and NIST/ISO, the analysis identifies three systemic gaps:  

• conceptual confusion between cybersecurity and cybercrime,  

• the absence of a preventive normative framework and  

• uneven capabilities for incident reporting and response.  

The key contribution is a practical, minimum viable legislative archetype built around ten pillars, designed to reduce regulatory uncertainty, support public-private cooperation and establish a common compliance baseline.  

Importantly, the article is intended as an applied policy tool. It serves as the conceptual foundation for a cyber policy training programme, translating legal analysis into a structured agenda that can be taught, tested and implemented in practice. 

About the authors 

Jersain Zadamig Llamas Covarrubias is a Mexican lawyer and technology strategist who combines law, politics, and engineering to address contemporary cyber risks. He holds a Master of Laws degree, a PhD in Data Science, and professional certifications such as CISO, CEH (EC-Council), and CIPP/E (IAPP). He is a research professor at the University of Guadalajara, founder and CEO of OBEX Cybersecurity and a member of the EU’s CyberNet Expert Pool. 

César Moliné Rodríguez is the regional manager of LAC4 Centre. He is a lawyer specializing in commercial law and new technologies with over 20 years of experience in e-commerce and digital signatures, privacy and cybersecurity. 

Reviewer Juan Pablo González Gutiérrez is a lawyer from Alberto Hurtado University. He holds a Master’s degree in Law and New Technologies from the University of Chile. He has several certifications, including ISO 27.701, 37.301, and DPO, among others. Since November 2023, he has been a member of the EU CyberNet Expert Pool.