ArgentinaBCRA Cyber-Incident Notification (Guidelines for Response and Recovery from Cyber-Incidents)
Comunicación “A” 8280 del Banco Central de la República Argentina Lineamientos para la Respuesta y Recuperación ante Ciberincidentes (RRCI), sección 3
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a financial entity, a payment service provider in the BCRA register and a systemically important payment system (reached by declaring that you hold a financial services license or are a payment provider). Section 3 of the guidelines is mandatory and applies from ; a payment service provider that does not offer payment accounts had 60 business days from the communication's dissemination to implement the guidelines.
- Notify the BCRA's external systems audit unit of every critical or important cyber-incident, meaning one that affects the normal provision of services to clients or puts at risk the availability, integrity or confidentiality of information, within the first hour of its occurring or being detected, with all the information then available (sections 3.1 and 3.3.1).
- Keep sending updates on the state of the incident, including remediation tasks and plans, until it is resolved (section 3.3.2).
- After containment, recovery and resolution, and within no more than 5 calendar days, send a final report with the analysis and progress on the root cause (section 3.3.3).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banco Central de la República Argentina, which sanctions infractions of the Ley de Entidades Financieras, its regulatory norms and the resolutions the Bank issues (article 41 of that law).
Settledness
- As of
- Open questions
- Which sanction regime applies to a payment service provider that is not a financial entity when it breaches section 3?
What this law does
The guidelines apply to financial entities, to payment service providers in the BCRA register and to systemically important payment systems. Section 3 of the guidelines is mandatory. Section 3.1 requires the covered entities to notify cyber-incidents that affect the normal provision of services to clients or put at risk the availability, integrity or confidentiality of information.
Section 3.3.1 requires an initial notification within the first hour of the incident occurring or being detected, with all the information available. Section 3.3.2 requires updates on the incident's status from the initial notification until its resolution. Section 3.3.3 requires a final report within no more than 5 calendar days after containment, recovery and resolution.
Payment service providers in the register, other than those offering payment accounts, have 60 business days from the communication's dissemination to implement the guidelines. Infractions of the Ley de Entidades Financieras, its regulatory norms and the resolutions the Bank issues are subject to sanction by the Bank under article 41 of that law.
When LexLint raises it
When your app profile says your app provides financial services.