Duty LXD-7473
Is a bank, in Panama
Superintendency of Banks Agreement 006-2011, Reporting of Electronic Banking Security Incidentssince 3 lines
Acuerdo No. 006-2011 (Superintendencia de Bancos de Panamá), Banca Electrónica y la Gestión de Riesgos Relacionados, art. 17 · Read the law's page
- This binds official banks, general-licence banks and international-licence banks that provide services or products to their customers through electronic banking (reached by declaring that you are a bank) (Article 1).
- Report to the Superintendencia de Bancos any event or attempted fraud in your electronic banking services, using the form it provides (Article 17).
- Send the report within the period the Superintendencia sets, even if the origin of the event has not yet been determined, giving the date and time, the type, the electronic channel affected, the number of customers affected, the estimated amount and the other items the form asks for (Article 17).
Superintendency of Banks Agreement 006-2011, Electronic Banking Security Controlssince 4 lines
Acuerdo No. 006-2011 (Superintendencia de Bancos de Panamá), Banca Electrónica y la Gestión de Riesgos Relacionados, arts. 10, 11 and 15 · Read the law's page
- This binds official banks, general-licence banks and international-licence banks that provide services or products to their customers through electronic banking (reached by declaring that you are a bank) (Article 1).
- Run intrusion and vulnerability tests carried out by suitable professionals external to the bank, with the external intrusion test at least once a year (Article 10).
- Develop incident response and communication plans to manage, stop and mitigate problems that disrupt electronic banking systems and services, including internal and external attacks (Article 11).
- Ensure the authenticity, integrity, confidentiality and non-repudiation of a valid transaction once accepted, together with segregation of duties and authorization controls, using the security solutions the Acuerdo lists (Article 15).
Superintendency of Banks Agreement 003-2012, Incident Handling and Notification by the Information Security Unitsince 3 lines
Acuerdo No. 003-2012 (Superintendencia de Bancos de Panamá), Gestión del Riesgo de la Tecnología de la Información, art. 11, points 10 and 11 · Read the law's page
- This binds official banks, general-licence banks and international-licence banks for which the Superintendencia de Bancos de Panamá is the home supervisor (reached by declaring that you are a bank) (Article 1).
- Have the information security unit monitor and handle information security incidents (Article 11).
- Notify the Superintendencia de Bancos, using the form it has established, when the bank suffers attacks (Article 11).
Superintendency of Banks Agreement 003-2012, Management of Information Technology Risksince 6 lines
Acuerdo No. 003-2012 (Superintendencia de Bancos de Panamá), Gestión del Riesgo de la Tecnología de la Información, arts. 3, 8, 11 and 12 · Read the law's page
- This binds official banks, general-licence banks and international-licence banks for which the Superintendencia de Bancos de Panamá is the home supervisor (reached by declaring that you are a bank) (Article 1).
- Keep an organizational structure suited to your size, complexity and risk profile to manage information technology and its associated risks, with policies, strategic plans and procedures for it (Article 3).
- Use an information technology risk methodology, including a risk matrix, that guarantees system security through at least logical access controls, physical security and network security measures (Article 3).
- Identify, measure, monitor, control and mitigate the information technology risks to which the bank is exposed, and inform the bank's operational areas of them (Article 8).
- Through the information security unit, keep systems protected against new threats and existing vulnerabilities, coordinate intrusion and vulnerability tests of the technology environment and set the standards that control access to information systems (Article 11).
- Include in the business continuity plan stress tests, alternative processing with backup of information and systems, recovery capacity for critical information technology services and communication processes (Article 12).