Is a bank, in Saint Vincent and the Grenadines

Technology Risk Standard, cyber governance, Prudential Standard on Technology Risk Management, paras. 5.2.4 and Board and Senior Management roles · Read the law's page

• This binds an institution licensed under the Banking Act, 2015 of Saint Vincent and the Grenadines: the Prudential Standard on Technology Risk Management says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates unless IT is not a significant function or equally effective alternative measures have been taken, and it came into effect on 3 January 2023 (reached by declaring that you are a bank).
• Have your Board keep ultimate responsibility for effective oversight of all IT and cybersecurity risks, systems and processes, and approve the technology policies, standards and procedures that govern the management of technology risks and safeguard information system assets (Information Technology Governance and Board roles).
• Have Senior Management implement the Board-approved cyber security strategies, policies and framework, which the standard lists among Senior Management's responsibilities (Senior Management roles, item a).
• If you rely heavily on IT systems for daily operations, you should establish a cybersecurity policy based on your risk assessment that mitigates the identified cyber risk threats in line with your risk appetite (paragraph 5.2.4).
• You should maintain a cybersecurity program, based on your assessment of technology risk, that identifies and assesses technology risks, protects your information systems, detects, responds to and recovers from cybersecurity events and fulfills applicable regulatory reporting obligations; revise it annually where you have found areas needing material improvement, and keep the documentation of the remedial efforts available for inspection by the ECCB (paragraphs 6.3.4 and 8.6.13).
• You should conduct vulnerability assessments at least annually, penetration tests of internet-facing systems at least annually or whenever they undergo major changes, full scope penetration tests at least once every two years, and penetration testing before commissioning a new system that offers internet accessibility and open network interfaces (paragraphs 9.4.1, 9.4.4 and 7.3.4).
• You should implement multi-factor authentication at login for all types of online financial systems, and transaction-signing for authorizing transactions (paragraph 10.1.7).
• You should require any IT service provider to implement security policies, procedures and controls at least as stringent as you would expect for your own operations, and, for cloud services, ensure the provider can identify and segregate customer data using strong physical or logical controls and has robust access controls protecting customer information (Management of IT Outsourcing Risks, item a, and paragraph 13.1.3).
• Explain any deviation from the standard in a separate document and make it promptly available to the ECCB on request (Scope of Application, item c).

Technology Risk Standard, cyber incidents, Prudential Standard on Technology Risk Management, para. 12.8.1 and Appendix I · Read the law's page

• This binds an institution licensed under the Banking Act, 2015 of Saint Vincent and the Grenadines: the Prudential Standard on Technology Risk Management says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates unless IT is not a significant function or equally effective alternative measures have been taken, and it came into effect on 3 January 2023 (reached by declaring that you are a bank).
• Within 24 hours of becoming aware of a cyber-incident, alert the ECCB and the Information Security User Group of licensed financial institutions that a cyber-incident occurred (paragraph 12.8.1).
• Complete the incident report in Appendix I of the standard and submit it to the ECCB within 48 hours of the incident; paragraph 12.8.1 words this as 'should', and the Appendix I instructions say to complete the form and submit it within 48 hours of a suspected or confirmed cyber-incident (paragraph 12.8.1 and Appendix I).
• You should notify the ECCB as promptly as possible when a security breach or major incident has occurred, and also report cybersecurity events that have a reasonable likelihood of materially harming any material part of your normal operations (paragraphs 8.6.12 and 8.6.13).
• Notify directly the customers whose accounts were potentially or actually compromised within seventy-two hours of the discovery of the incident (Senior Management roles, item g).
• Provide updates on the incident to the ECCB at the frequency the ECCB determines, until the ECCB deems the incident resolved, and after resolution conduct a post-incident review and submit it to the ECCB (paragraphs 12.8.4 and 12.8.5).
• You should share information with the banking community through the Information Security User Group and the ECCU Bankers Association after a security breach, including the threat actors, vulnerabilities exploited and root cause analysis as soon as they are available; you are required to establish the Information Security User Group (paragraphs 12.7.3 and 12.8.2).
• Notify the general public about a cybersecurity incident only after notifying the ECCB (Senior Management roles, item f).
• Develop and implement a cybersecurity incident response plan that details the steps to be taken in the event of a security breach (Senior Management roles, item e).

Electronic Banking Standard, incident reporting, Banking Prudential Standard No. 3 of 2022, paras. 5.2.7, 5.11 and 6.4 · Read the law's page

• This binds an institution licensed under the Banking Act, 2015 of Saint Vincent and the Grenadines: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on 1 February 2023 (reached by declaring that you are a bank).
• Send all incident reports and your response to the Central Bank within 3 days of the occurrence, and report any further update on the incident to the Central Bank (paragraph 6.4).
• Implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of your e-banking services (paragraph 5.2.7).
• Report to the Central Bank incidents deemed significant that may compromise your operations or pose a threat to financial stability; the standard words this as 'should' (paragraph 5.2.7).
• Build into your incident response plan a clear process for alerting the appropriate regulatory authorities when security breaches or disruptive incidents occur, and a process to inform the ECCB, customers, counterparties and the media in a timely and appropriate manner of material e-banking disruptions and business resumption developments (paragraph 5.11.2(d) and (g)).

Electronic Banking Standard, security controls, Banking Prudential Standard No. 3 of 2022, paras. 5.2 and 6.4 · Read the law's page

• This binds an institution licensed under the Banking Act, 2015 of Saint Vincent and the Grenadines: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on 1 February 2023 (reached by declaring that you are a bank). The standard says institutions must apply it based on the scope and level of sophistication of their e-banking operations and functions (paragraph 3.0).
• Make sure the security control infrastructure is in place to secure e-banking systems and data from internal and external threats, including appropriate authorisation, logical and physical access controls and adequate security infrastructure (paragraph 5.2.1).
• If e-banking services are outsourced, assess that the necessary controls are in place (paragraph 5.2.1).
• Implement a comprehensive security process with policies and procedures that address internal and external security threats in terms of incident prevention and the appropriate response, including physical controls, specialised security staff, logical controls with ongoing monitoring of network intrusion attempts, and ongoing review and testing of security measures (paragraph 5.2.2).
• Reinforce information security controls to preserve the confidentiality and integrity of customer data, and protect sensitive and high-risk e-banking systems with mechanisms such as encryption, firewalls, access control and data recovery plans (paragraph 5.2.4).
• Implement multifactor authentication to validate the identity and authorisation of your new and existing customers seeking to conduct electronic transactions, based on your assessment of the risk the e-banking system poses (paragraphs 5.5.2 and 5.5.3).
• Keep logs for all e-banking transactions, and the audit trails they generate, for a minimum of five years, including at least the user name, receiver information, IP address, date and time of the transaction and transaction amount (paragraphs 5.2.4 and 5.8.3(b)).
• Employ systems to reduce external threats to e-banking systems, including intrusion detection software and other security assessment tools to review networks, servers and firewalls for weaknesses, and penetration testing of internal and external networks (paragraph 5.2.8(b) and (c)).
• Obtain the Central Bank's prior approval before contracting to outsource an e-banking service and submit every outsourcing agreement to it for approval; the contract should protect the privacy and security of your data and state your right to audit security and controls, and it must set materiality thresholds for the provider to notify you of security breaches and other events that are a material risk to you (paragraphs 5.4.3, 5.4.7 and 6.2).
• Submit the security process you implement to the Central Bank (paragraph 6.4).