Corporate Criminal Risk from Cybercrimes

Law 21.595, which modernizes computer crimes, incorporated cybercrimes into the catalog of Law 20.393 on Criminal Liability of Legal Entities. This means that a company can be criminally sanctioned for crimes such as system attacks, espionage, or computer sabotage.

The imputation to the company is not automatic. It requires the prosecution to prove that the crime was a consequence of an "organizational defect", that is, a breach of the company's own management and supervision duties.

The "Organizational Defect" in the Digital Context

In the cybersecurity field, an "organizational defect" manifests through concrete failures in digital risk management. The absence or deficiency of a robust compliance program is the basis for criminal reproach to the corporation.

Indicators of an Organizational Defect:

• Absence of a cybercrime risk matrix: Not identifying and managing specific criminal risks of digital operations.
• Lack of basic technical and organizational controls: Lack of multi-factor authentication (MFA), poor patching policies, or inadequate privileged access management.
• Lack of an incident management plan and breach response.
• Lack of periodic training for personnel on cyber threats and internal policies.

The Crime Prevention Model (CPM) as Corporate Defense

A Crime Prevention Model, designed, implemented and certified, is the company's main defense tool. Its correct application can exempt or mitigate criminal liability. An effective CPM in cybersecurity must be integrated into the company's operations and culture.

Components of an Effective Corporate Defense

To mitigate criminal liability, the Board and management must focus on structuring a proactive defense, whose main components are:

Design and Implementation of a Crime Prevention Model

The development of a CPM specific to cybercrime risks, which integrates with security management systems (such as ISO 27001 or Law 21.663 requirements) and is prepared for formal certification.

Strengthening Criminal Risk Governance

The formal incorporation of cybercrimes into the criminal compliance risk matrix. This involves active supervision by the Board, definition of clear policies, and periodic reporting on control effectiveness.

Preparation for Incident Response under Legal Privilege

The creation of a crisis response protocol that, from the first moment, activates attorney-client privilege to protect communications and internal investigation, preserving the defense strategy against a possible investigation by the Public Prosecutor's Office.