ArgentinaBCRA Minimum Requirements for Technology and Information Security Risk Management
Comunicación “A” 7724 del Banco Central de la República Argentina Requisitos mínimos para la gestión y control de los riesgos de tecnología y seguridad de la información, secciones 1.2, 5.8.2 y 8.1
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a financial entity under the Ley de Entidades Financieras (reached by declaring that you hold a financial services license or supply software to a firm that does). Communication "A" 7724 took effect 180 calendar days after its dissemination on , on .
- Ensure effective practices for internal control and risk management of your technology and information security environment, with a risk management framework that fits the complexity of your financial services and the technology that supports them (section 1.2).
- Run a vulnerability management process for all systems and applications, owned or provided by third parties, with contact points to receive vulnerability notifications about your internal and external services, an impact analysis of published or reported vulnerabilities, and a mitigation plan and schedule set by criticality (section 5.8.2).
- Establish norms and procedures to manage, control and document cyber-incident activities, covering escalation and priority criteria, a taxonomy of incidents, forensic analysis and evidence preservation, and internal and external communication circuits (section 8.1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banco Central de la República Argentina, which sanctions infractions of the Ley de Entidades Financieras, its regulatory norms and the resolutions the Bank issues (article 41 of that law).
Settledness
- As of
- Open questions
- Do later BCRA communications amend the annex text of sections 1.2, 5.8.2 and 8.1 as pinned here?
What this law does
Communication "A" 7724 of the Banco Central de la República Argentina is addressed to financial entities. Section 1.2 of the rules requires the covered entity to ensure effective practices for internal control and risk management of its technology and information security environment. Section 5.8.2 of the rules requires a vulnerability management process for all systems and applications, whether owned or provided by third parties.
That process must include contact points for notifying vulnerabilities in the entity's internal and external services. Section 8.1 of the rules requires the entity to establish norms and procedures to manage, control and document cyber-incident activities. The Communication takes effect 180 calendar days after its dissemination.
Infractions of the Ley de Entidades Financieras, its regulatory norms and the resolutions the Bank issues are subject to sanction by the Bank under article 41 of that law.
When LexLint raises it
When your app profile says your app provides financial services.