Is a securities firm, in El Salvador

Ley de Regulación de los Servicios de Información sobre el Historial de Crédito de las Personas (Decreto Legislativo No. 695 of 2011), arts. 4(a), 19(h), 20-25 and 28-30 · Read the law's page

• If you hold credit-history data on consumers or clients, tell a consumer or client who proves their identity whether you are processing their credit-history information, and give them a copy when they ask.
• Rectify or delete a credit-history record that is unlawful, erroneous, unjustified or inaccurate when the consumer or client asks, and answer a request for access, rectification, modification or cancellation within five business days.
• Do not use, transfer, share or market the credit-history information in your database without the express consent of the person it concerns.

Normas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, art. 13 · Read the law's page

• This binds the banks established in El Salvador and the branches of foreign banks, the financial conglomerates, pension fund managers, insurers, stock exchanges and brokerage houses, payment and securities-settlement system operators, e-money providers and the other supervised entities listed in article 2 (reached by declaring that you provide financial services). Article 2 was amended with effect from 4 April 2025 and again from 15 October 2025.
• Establish notification procedures under which your senior management and the Superintendencia are told as soon as you know of a materialized information-security or cybersecurity incident that exceeds the risk limits your board has approved, by the means available, with a brief description that covers the possible cause, the impact and the actions taken (article 13(a)).
• Within seven working days after reporting the incident, send the Superintendencia the complete documentation: start and end date and time, description, causes of the failure, technical diagnosis, channels affected, time out of service, impact, and the corrective actions or action plan (article 13(a)).
• Inform in a timely way, under your policies, the clients and users of financial products and services affected by a cybersecurity incident that compromised the confidentiality or integrity of their information, and tell them the measures taken to mitigate it (article 13(b)).
• If you outsource information-technology activities, set up transparent response procedures to share information with the Superintendencia seventy-two hours after an information-security incident occurs (annex 1, section C, point 1, which article 26 makes a condition of outsourcing).

Normas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, arts. 1, 2, 10, 12 y 32 · Read the law's page

• This binds the banks established in El Salvador and the branches of foreign banks, the financial conglomerates, pension fund managers, insurers, stock exchanges and brokerage houses, payment and securities-settlement system operators, e-money providers and the other supervised entities listed in article 2 (reached by declaring that you provide financial services). Article 2 was amended with effect from 4 April 2025 and again from 15 October 2025.
• Establish, maintain and document an information security management system that is consistent with your business-continuity management and your operational-risk management (article 10).
• Implement a cybersecurity function that reports to the board, the risk committee and senior management on its results at least every six months, including cyber threats, the effectiveness of the cybersecurity programs and a summary of the incidents that affected the entity (article 12).
• Review at least every six months the rights granted to users and how they are actually used, giving priority to critical infrastructure, systems and services, record each review and the actions taken in a log, and keep an inventory of profiles and accounts that covers user, administrator and vendor accounts (article 11(c) and (j)).
• Run a continuous, documented and periodically reviewed cybersecurity risk-management process with four stages: prevention, protection and detection, response, and recovery and learning. It includes tools that log and correlate events, continuous monitoring of the infrastructure, preservation of digital evidence, and continuity-plan tests that simulate cyberattacks (article 16).
• Test your technology infrastructure for vulnerabilities and intrusion at least once a year and whenever the infrastructure changes, send the Superintendencia a summary of the results within ten working days of receiving the provider's report, and send a remediation plan within thirty working days after that summary (article 20(i)).
• Apply security controls to the acquisition, development and maintenance of your systems, in so far as each applies: control access to source code, keep formal change and version control, check applications before they go into production, analyze and correct vulnerabilities during development and in production, and install software updates in a secure and controlled way (article 21).
• Before you replace or make a major change to a main system, or acquire infrastructure or systems for a new product or service, put a feasibility study and risk analysis to your board and send the same information to the Superintendencia fifteen working days before the system goes into production; give clients 24 hours' notice through the digital channel before planned maintenance takes it down (article 22).
• Before you outsource information-technology activities or operations, check that the service meets sections A, B and C of Annex 1 (risk assessment, provider due diligence, unrestricted access to the data for the Superintendencia and auditors, proof of the provider's security program and continuity plans, and exit plans), document that in a report to the Superintendencia fifteen working days before the activity goes into production, and attach a schedule of activities (article 26).
• Put in the outsourcing contract that you own your data and the provider acquires no rights to it, the service levels and contingency plans, prompt correction of vulnerabilities, end-to-end encrypted channels, isolation of your data from the provider's other clients, and return or secure deletion of the data on request or at termination; the provider's security may never be lower than yours (article 14; article 26 and Annex 1, section B).
• Tell the Superintendencia thirty working days before operations begin where your main and alternate data centers are or are being moved, with the work plan and the board minute, and show compliance with Annex 1 before you place a data center outside the country through outsourcing (article 25); tell it where backups are stored or processed within ten working days after operations start or the location changes (article 23).
• Within 120 calendar days after each financial year ends, send the Superintendencia a report on your level of compliance with the information security management system requirements, and send it your information security program every year and whenever it changes (article 29); send it the updated inventory and classification of information assets by 31 January each year (article 19).