Duty LXD-7376
Is a bank, in Azerbaijan
Rules on Information Security Management in Banks, Information Security Management Systemsince 4 lines
Rules on Information Security Management in Banks, approved by Decision No. 20/1 of the Board of the Central Bank of the Republic of Azerbaijan () · Read the law's page
- This binds banks operating in the Republic of Azerbaijan and the local branches of foreign banks, across all of their business processes and information systems (reached by declaring that you are a bank); the Rules set the minimum information security requirements (clauses 1.1 and 1.2).
- Build an information security management system on the bank's risk management rules, have the Supervisory Board approve an information security policy that covers at least the control objectives of clauses 4 to 15, and review that policy at least once a year (clauses 3.1 to 3.6).
- Meet the Rules' controls on organization of information security, human resources security, asset management, access control, cryptography, physical and perimeter security, operations security, information exchange, system acquisition and support, and relations with counterparties (clauses 4 to 13).
- Keep information security continuous when your information systems are damaged, destroyed or endangered (clause 15.1), and, for your critical information infrastructure, hold an off-site standby center for backup and recovery and approve business continuity and information system recovery plans (clause 15.2).
Rules on Information Security Management in Banks, High-Category Incident Report to the Central Banksince 3 lines
Rules on Information Security Management in Banks, approved by Decision No. 20/1 of the Board of the Central Bank of the Republic of Azerbaijan (), cl. 14 · Read the law's page
- This binds banks operating in the Republic of Azerbaijan and the local branches of foreign banks (reached by declaring that you are a bank).
- Submit information on a high-category information security incident to the Central Bank within 5 working days, in the form set out in Annex 1 to the Rules, confirmed by the Chairman of your Management Board with an enhanced electronic signature and sent through the special-purpose information exchange system (clause 14.2); an incident is high-category where, as a result, the bank cannot carry out any business process (clause 14.1.6.4.3).
- Register each information security incident and see that it is communicated, using the notification channels you have defined and recorded (clauses 14.1.6.2 and 14.1.6.7).