Is an insurer, in Tajikistan

Minimum Requirements for the Software and Hardware Support of Credit Financial Organizations, approved by Resolution No. 121 of the Board of the National Bank of Tajikistan of 18 October 2022 (Ministry of Justice registration No. 1203) · Read the law's page

• This binds credit financial organizations supervised by the National Bank of Tajikistan, for the software, hardware and information systems they use (reached by declaring that you provide financial services).
• Have your management approve an information security strategy that covers at least the cyber-threat environment, the approach to managing and monitoring information security risks and cyber threats, and the principles for implementing cyber-security measures, and review it at least once every two years (items 4 and 6).
• Set your information security policy and strategy in internal acts that meet these Requirements (items 7 to 10).
• Hold the special certificate when you take part in processing, storing or transmitting information tied to bank payment cards, electronic wallets, ATMs or POS terminals, and keep your risk management methodology in line with the NIST and ISO international standards (item 3).
• Keep a list of all your information and communication technology assets (item 14).
• Encrypt files that contain confidential information, monitor your information and communication technology systems regularly for suspicious activity or breaches of security policy, and install dedicated network equipment, including IDS and IPS, to protect against attacks by internal and external intruders (items 25, 26 and 41).
• Give remote access to your network and key systems only where needed and at set times, and secure it with strong identification, authentication and encryption (items 42 to 47).
• Provide two-factor authentication (biometric, smart card, token or one-time password) for critical systems, time out an idle session after at most one minute, and give each user a unique, identifiable account with no shared accounts (items 65, 69 and 70).
• Require passwords of at least eight characters that are complex and unique, with at least one character from each of four categories (upper case letters, lower case letters, digits and special characters), and allow no more than five consecutive failed log-ins before the password may be cancelled (items 73, 74 and 77).
• Protect mail servers and e-mail systems with content and spam filtering, a system for detecting, blocking and reporting data breaches, firewalls and antivirus programs (item 57).
• Test the servers and communications equipment connected to the internet, including your mail infrastructure, for fault tolerance and penetration at least once every quarter (item 52).
• Check each remote banking application for cyber and information security before it reaches clients, and record the result in a special act (item 89).
• Build the remote banking application to request only the permissions its functions need, to identify and authenticate its users, and to remind the user before installation what access it takes to the device and its services; do not support devices that lack suitable encryption, such as AES with a key of at least 128 bits and a digital signature (items 87, 90, 95 and 98).
• Have the remote banking application keep confidential data off the device (encrypted with the device's mechanisms where it must be stored), keep history, GPS and other confidential data no longer than it needs to work, delete confidential personal information when the user exits, encrypt and digitally sign data sent to or from it as far as the device allows, and use or transmit only the minimum data it needs (items 91 to 94, 96 and 97).
• See that every employee completes security, confidentiality and information-protection training and signs the information-protection documents (item 99).