Is a bank, in Costa Rica

Acuerdo CONASSIF 5-24, Reglamento General de Gobierno y Gestión de la Tecnología de Información, arts. 31-33 · Read the law's page

• This binds every entity and company supervised by SUGEF, SUGEVAL, SUGESE or SUPEN, and the controllers and member companies of supervised financial groups and conglomerates (reached by declaring that you provide financial services) (Article 2).
• Design, implement, maintain and monitor an information security management system whose controls take a risk-based approach and are set out in a statement of applicability (Article 31).
• Manage cybersecurity to meet business requirements and to ensure digital operational resilience, and set indicators that measure its effectiveness and efficiency on a recurring basis (Article 32).
• Establish, every year, programmes of vulnerability analysis and testing that cover the information security and cybersecurity controls, with the types and scope of tests matched to your risks (Article 33).
• Savings and credit cooperatives under the SUGEF proportional regulation (Acuerdo SUGEF 25-23) and insurance brokerage companies supervised by SUGESE treat Articles 33, 34 and 35 as good practice they may adopt at their discretion (Article 3).

Acuerdo CONASSIF 5-24, Reglamento General de Gobierno y Gestión de la Tecnología de Información, arts. 38-41 · Read the law's page

• This binds every entity and company supervised by SUGEF, SUGEVAL, SUGESE or SUPEN, and the controllers and member companies of supervised financial groups and conglomerates (reached by declaring that you provide financial services) (Article 2).
• Classify and record each information security and cybersecurity incident by the incident classification and impact levels set in the general guidelines of the Regulation (Article 38).
• Report to your Superintendencia each incident whose impact is classified as moderate or high (Article 39), sending the initial communication without delay and no later than eight natural hours after the incident is identified and its impact is established as moderate or high (general guidelines, Section XI).
• Send the incident handling report and the follow-up reports the Superintendencia asks for, within the time it communicates through its official channels (Article 39 and general guidelines, Section XI).
• Tell the affected customers when an information security or cybersecurity incident affects the confidentiality or integrity of their information, in a timely and clear way, and tell them the measures taken to remediate it within five business days after the incident is closed (Article 40).
• Keep historical information on incidents and make it available to the Superintendencias when they require it for supervision (Article 41).