Provides financial services, in Peru

Resolución SBS N.° 504-2021, Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad, art. 15 · Read the law's page

• Report to the Superintendencia, as soon as you become aware of it, a cybersecurity incident with a verified or presumed significant adverse impact: loss or theft of company or client information, internal or external fraud, a negative effect on the company image and reputation, or an interruption of operations (article 15.1).
• Carry out a forensic analysis to determine the causes of the incident and take measures to manage it, and keep the resulting report, in an executive version and a technical version, available to the Superintendencia (article 15.2).
• Follow the minimum content, format and additional protocols the Superintendencia sets by general rule for the report (article 15.3).
• This binds the companies in articles 16 and 17 of the General Law of the Financial System (banks, financial companies, municipal and rural savings and credit banks and others), private pension fund administrators, Banco de la Nación and, as article 1 and article 4 of Resolución SBS 504-2021 set out, the other companies the Resolution lists (reached by declaring that you provide financial services). Article 4 applies the general regime to the companies in article 4.2 and a simplified regime to those in article 4.3. The Resolution took effect on 1 July 2021.

Resolución SBS N.° 504-2021, Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad, arts. 1, 4 to 6 and 16 · Read the law's page

• Have your board approve the policies and guidelines of your information-security and cybersecurity management system (SGSI-C), assign the technical, personnel and financial resources it needs, and approve its organization, roles and responsibilities (article 5).
• Have your general management take the measures needed to implement the SGSI-C (article 6.1).
• Keep the SGSI-C proportionate to the size, nature and complexity of your operations (article 4.1).
• Make the arrangements needed to hold information that lets you act in time against cybersecurity threats and to treat vulnerabilities (article 16.1).
• This binds the companies in articles 16 and 17 of the General Law of the Financial System (banks, financial companies, municipal and rural savings and credit banks and others), private pension fund administrators, Banco de la Nación and, as article 1 and article 4 of Resolución SBS 504-2021 set out, the other companies the Resolution lists (reached by declaring that you provide financial services). Article 4 applies the general regime to the companies in article 4.2 and a simplified regime to those in article 4.3. The Resolution took effect on 1 July 2021.

Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 12, 14 and 18 · Read the law's page

• This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on 4 November 2025, which is 3 February 2026.
• Manage the digital-security risks in your organization so as to set controls that protect the confidentiality, integrity and availability of information (article 14.1).
• Implement security controls and measures in providing your digital services according to your risk assessment, widely recognized practices, the national regulatory framework and international standards (article 18.1(b)).
• Maintain a secure, scalable and interoperable infrastructure that guarantees the confidentiality, availability and integrity of your digital services (article 18.1(f)).
• Test your digital services proactively for vulnerabilities so as to identify digital-security risks (article 18.1(i)).
• If a law or special rule also regulates your service, comply with your sector's rules first; the Regulation applies to what they do not provide (article 18.2).

Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 18.1(a) and 31 to 34 · Read the law's page

• This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on 4 November 2025, which is 3 February 2026.
• Notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of your organization through the protocols and channels it sets (article 18.1(a)).
• Notify an incident classified at critical level to the CNSD within a maximum of forty-eight (48) hours from when you become aware of it (article 32.1).
• Notify an incident of any other classification within the periods the Secretaría de Gobierno y Transformación Digital sets in its classification of digital-security incidents (article 32.2).
• Include in the notification at least a description of the incident, its classification and its impact (article 31.2).
• Make your third-party service providers report to you the incidents under their control, and notify the CNSD yourself (article 34.4).