Duty LXD-7994
Is a payment provider, in Honduras
CNBS Norms on Information Technology, Information Security and Cybersecurity Management (Circular CNBS 025/2022)since 4 lines
Normas para la Gestión de Tecnologías de Información, Continuidad del Negocio, Seguridad de la Información y Ciberseguridad (Circular CNBS No.025/2022, Resolución GRD No.793/16-12-2022), arts. 18-20 · Read the law's page
- This binds the institutions supervised by the Comisión Nacional de Bancos y Seguros and the financial groups they form, in proportion to their size, nature, complexity of operations and risk profile (reached by declaring that you provide financial services) (Articles 1 and 2).
- Design, implement, document, monitor and update an information security and cybersecurity management framework that includes security policies, procedures and controls, a risk-management methodology, a designated function and a review process (Article 18).
- Manage cybersecurity on international best practices and standards so as to identify, protect, detect, respond and recover (Article 19).
- Keep an information security and cybersecurity function with functional and operational independence from the information technology area and the user areas, headed by an executive with specialized training and proven experience (Article 20).
CNBS Norms on Information Technology, Information Security and Cybersecurity Management (Circular CNBS 025/2022), Incident Notificationsince 6 lines
Normas para la Gestión de Tecnologías de Información, Continuidad del Negocio, Seguridad de la Información y Ciberseguridad (Circular CNBS No.025/2022, Resolución GRD No.793/16-12-2022), arts. 21 and 37 · Read the law's page
- This binds the institutions supervised by the Comisión Nacional de Bancos y Seguros and the financial groups they form, in proportion to their size, nature, complexity of operations and risk profile (reached by declaring that you provide financial services) (Articles 1 and 2).
- Notify the Comisión Nacional de Bancos y Seguros of information security and cybersecurity incidents that significantly affect the confidentiality, integrity or availability of the institution's information, in three stages (Article 21).
- Make the first communication within two hours after the incident is identified, with general data and a contact in the institution (Article 21).
- Send a preliminary report within two business days after the incident is identified, with detailed data, the nature of the incident, its preliminary impact and the measures taken, and update it every five business days while the incident is unresolved (Article 21).
- Send a final report within fifteen business days after the final resolution of the incident, with the root cause, the vulnerabilities exploited where they apply, the action plan carried out and the preventive controls to be implemented (Article 21).
- Notify the Comisión within two business days after identifying an incident that significantly affects business continuity, describing it and the measures taken to manage it (Article 37).
CNBS Minimum Guidelines to Prevent and Mitigate Cyber Fraud and Scams Against Financial Users, Incident Reportingsince 2 lines
Lineamientos mínimos para prevenir y mitigar la ocurrencia de fraudes y estafas cibernéticas en contra del usuario financiero (Circular CNBS No.008/2023, Resolución GRD No.365/26-05-2023), art. 17 · Read the law's page
- This binds the institutions supervised by the Comisión Nacional de Bancos y Seguros, for transactions and procedures carried out through the digital channels they offer to financial users (reached by declaring that you provide financial services) (Article 2).
- Report to the Comisión the cyber fraud incidents against financial users on the business day after the incident is identified, giving the data of the users affected and general information describing the incident and the contact in the institution (Article 17).