Provides financial services, in Haiti

Banque de la République d'Haïti, Circulaire 126, Sur les règles en matière de sécurité informatique, 13 janvier 2022, arts. 1-5 · Read the law's page

• Have a written information-security policy, updated annually and approved by your board of directors.for a financial business
• Maintain an information-security committee (or, for a non-bank financial institution, have your board of directors perform this function) to validate and approve the security measures your policy adopts.for a financial business
• Designate an information-security officer independent of the IT department, reporting to risk management or directly to general management, with the data and access needed to do the job.for a financial business
• Keep your security committee systematically informed of incidents capable of compromising information security and of the measures taken to address them.when it serves a financial business
• Develop, test and maintain a risk-based contingency plan, including an offsite recovery center kept separate from your main site, and a regularly checked backup system.when it serves a financial business
• Have your information system's security audited at least once every three years, and attach a copy of the audit report to your annual internal-control report.for a financial business
• A failure to complete the three-year audit draws a penalty of HTG 200,000; a failure to remedy a violation BRH identifies draws HTG 100,000 per day of continuing infraction, plus HTG 2,500 per day for late payment of any fine.for a financial business
• This binds every institution financière (bank and other financial institution) that Banque de la République d'Haïti supervises under the 14 May 2012 law on banks and other financial institutions.