Duty LXD-7946
Is a payment provider, in Argentina
BCRA Minimum Requirements for Technology and Information Security Risk Managementsince 4 lines
Comunicación “A” 7724 del Banco Central de la República Argentina, Requisitos mínimos para la gestión y control de los riesgos de tecnología y seguridad de la información, secciones 1.2, 5.8.2 y 8.1 · Read the law's page
- This binds a financial entity under the Ley de Entidades Financieras (reached by declaring that you hold a financial services license or supply software to a firm that does). Communication "A" 7724 took effect 180 calendar days after its dissemination on , on .
- Ensure effective practices for internal control and risk management of your technology and information security environment, with a risk management framework that fits the complexity of your financial services and the technology that supports them (section 1.2).
- Run a vulnerability management process for all systems and applications, owned or provided by third parties, with contact points to receive vulnerability notifications about your internal and external services, an impact analysis of published or reported vulnerabilities, and a mitigation plan and schedule set by criticality (section 5.8.2).
- Establish norms and procedures to manage, control and document cyber-incident activities, covering escalation and priority criteria, a taxonomy of incidents, forensic analysis and evidence preservation, and internal and external communication circuits (section 8.1).
BCRA Cyber-Incident Notification (Guidelines for Response and Recovery from Cyber-Incidents)since 4 lines
Comunicación “A” 8280 del Banco Central de la República Argentina, Lineamientos para la Respuesta y Recuperación ante Ciberincidentes (RRCI), sección 3 · Read the law's page
- This binds a financial entity, a payment service provider in the BCRA register and a systemically important payment system (reached by declaring that you hold a financial services license or are a payment provider). Section 3 of the guidelines is mandatory and applies from ; a payment service provider that does not offer payment accounts had 60 business days from the communication's dissemination to implement the guidelines.
- Notify the BCRA's external systems audit unit of every critical or important cyber-incident, meaning one that affects the normal provision of services to clients or puts at risk the availability, integrity or confidentiality of information, within the first hour of its occurring or being detected, with all the information then available (sections 3.1 and 3.3.1).
- Keep sending updates on the state of the incident, including remediation tasks and plans, until it is resolved (section 3.3.2).
- After containment, recovery and resolution, and within no more than 5 calendar days, send a final report with the analysis and progress on the root cause (section 3.3.3).