Is an insurer, in the Philippines

Manual of Regulations for Banks, Section 148 (Information Technology Risk Management), IT governance, information security and annual IT profile · Read the law's page

• This binds a Bangko Sentral-supervised financial institution (BSFI), which the guidelines define to include banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision or regulation, and also a BSFI with offshore data processing as may be appropriate to its situation (reached by declaring that you provide financial services).
• Establish an effective IT governance framework, with the board of directors ultimately responsible for understanding and managing your IT risks and senior management accountable for designing and implementing the board-approved IT risk management system (Section 148, IT governance).
• Put in place a robust, enterprise-wide framework for information security risk management, with information security governance and oversight, and maintain an information security program that matches your operational and IT profile (Section 148, IT controls implementation, information security).
• Have the board and senior management appoint a chief information security officer, a senior executive with enough authority to be responsible and accountable for the organization-wide information security program (Section 148, IT controls implementation, information security).
• Submit an Annual IT Profile electronically to the appropriate supervising department of the Bangko Sentral within twenty-five days from the end of the reference year (Section 148, reporting and notification standards, item a(1)).
• Make your IT policies, procedures and related documents available during on-site examination and give the Bangko Sentral copies on written request (Section 148, sanctions and penalties).

Manual of Regulations for Banks, Section 148 (Information Technology Risk Management), reporting and notification standards · Read the law's page

• This binds a Bangko Sentral-supervised financial institution (BSFI), which the guidelines define to include banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision or regulation, and also a BSFI with offshore data processing as may be appropriate to its situation (reached by declaring that you provide financial services).
• Notify the appropriate supervising department of the Bangko Sentral, through your Compliance Officer or a designated officer, within two hours from discovery of a reportable major cyber-related incident or of a disruption of financial services and operations (Section 148, reporting and notification standards, item b(1)).
• Treat as a reportable major cyber-related incident any event that may seriously jeopardize the confidentiality, integrity or availability of critical information, data or systems of the institution, its customers and other stakeholders and that meets the criteria in item a(2)(a), such as unauthorized access into your internal network, a system-level compromise, significant data loss or a massive data breach, or an unavailability of critical systems.
• Treat as a reportable disruption any disruption of critical operations that lasts for more than two hours, whether it comes from internal or external threats and whether natural, man-made or technical in origin (item a(2)(b)).
• Disclose in the first notice at least the nature of the incident and the specific system or business function involved (item b(2)).
• Send a follow-up report by e-mail to the same department within twenty-four hours from the time of discovery, covering the nature of the incident, how and when you first detected it, its initial impact, your initial response, and whether the business continuity or crisis management plan was activated (item b(3)).
• Provide the additional information or updates the Bangko Sentral requests until the matter is satisfactorily resolved, and expect a special examination or inspection to verify the root cause (item c).

Republic Act No. 12010 (2024), Anti-Financial Account Scamming Act, Section 6 · Read the law's page

• This binds a bank, non-bank, other financial institution, or payments and financial services provider under the jurisdiction of the Bangko Sentral ng Pilipinas (reached by declaring that you provide financial services) (sections 3(f) and 6).
• Ensure that access to your clients' Financial Accounts is protected by adequate risk management systems and controls such as multi-factor authentication, fraud management systems, and other Account Owner enrollment and verification processes (section 6).
• Make those systems and controls proportionate and commensurate to the nature, size and complexity of your operations (section 6).