Mexico's cybersecurity law: what it asks of your company and how to comply.
iNBest Atlas: Fractional CTO and Virtual CISO
What Mexico's cybersecurity initiative proposes and how to prepare your company without treating a proposal as current law.
Status
Initiative in progress. It is not an enacted law and is not published in Mexico's Official Gazette.
Last reviewed: October 26, 2026
Who it could apply to
Scope depends on the final text. Review the systems, services, data, and vendors relevant to your organization without assuming a category is already covered by this initiative.
Designated cybersecurity lead
The initiative contemplates designated cybersecurity responsibilities. Final requirements would depend on approved text.
Legislative process
- Initiative · In progress
- Review and debate · Subject to the legislative process
- Official publication · Not published in the Official Gazette as of October 26, 2026
Readiness self-check
Ten questions about security practices. The result is guidance and does not determine legal compliance.
- We have a person responsible for coordinating security.
- We know which systems and services are essential to operations.
- We maintain an inventory of technology assets and vendors.
- We review access for people and service accounts.
- We prioritize and apply security updates.
- We have a process to report and handle incidents.
- We test backups and know how to restore them.
- We review risk from critical vendors.
- We document security policies and responsibilities.
- Leadership receives regular reporting on risk and open actions.
This self-check is not legal advice, certification, or a formal compliance assessment.
Readiness checklist
Leave your email to request the checklist when the file is available. The PDF has not been supplied yet.
Work email
Information session
Date to be confirmed
Public sources
Frequently asked questions
Is Mexico's Cybersecurity Law in force?
No. This page describes an initiative in progress, not a law published in the Official Gazette.
Which companies would be required to comply?
Scope depends on final text and the legislative process. Do not use this page as a legal determination of obligations.
Does the initiative ask for a designated security lead?
The proposal contemplates designated cybersecurity responsibilities. Final requirements depend on approved text.
Does the self-check confirm compliance?
No. It is a guidance checklist of security practices, not a legal or technical assessment.
Prepare your team without assuming obligations that do not exist yet.
Review current responsibilities, risks, and a preparation path that can change if the proposal changes.
- Name
- Work email
- Company
- Role
- Country
- Company size
- Primary need