AzerbaijanRules on Information Security Management in Banks, Information Security Management System
Rules on Information Security Management in Banks approved by Decision No. 20/1 of the Board of the Central Bank of the Republic of Azerbaijan ()
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds banks operating in the Republic of Azerbaijan and the local branches of foreign banks, across all of their business processes and information systems (reached by declaring that you are a bank); the Rules set the minimum information security requirements (clauses 1.1 and 1.2).
- Build an information security management system on the bank's risk management rules, have the Supervisory Board approve an information security policy that covers at least the control objectives of clauses 4 to 15, and review that policy at least once a year (clauses 3.1 to 3.6).
- Meet the Rules' controls on organization of information security, human resources security, asset management, access control, cryptography, physical and perimeter security, operations security, information exchange, system acquisition and support, and relations with counterparties (clauses 4 to 13).
- Keep information security continuous when your information systems are damaged, destroyed or endangered (clause 15.1), and, for your critical information infrastructure, hold an off-site standby center for backup and recovery and approve business continuity and information system recovery plans (clause 15.2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of the Republic of Azerbaijan, whose Board issued the Rules under article 38.3 of the Law on Banks and article 22.0.17 of the Law on the Central Bank.
Settledness
- As of
- Open questions
- Which penalty provisions of the Law on Banks and the Law on the Central Bank apply to a bank that breaches these Rules?
What this law does
Clause 1.1 of the Rules states that they are issued under article 38.3 of the Law on Banks and set minimum information security requirements for banks operating in Azerbaijan and the local branches of foreign banks. Clause 2 of the approving Decision brings the Rules into force on . Clause 3.3 requires the bank's Supervisory Board to approve an information security policy drawn up within the bank's risk management strategy and policy.
Clause 3.6 requires the information security policy to be reviewed at least once a year and amended as required. Clause 15.1 requires every bank to keep information security continuous when its information systems and information technologies are damaged, destroyed or endangered. Clause 15.2.2 requires a bank to hold an off-site standby center for the backup and recovery of its information systems, as a measure for continuity of the security of its critical information infrastructure.
When LexLint raises it
When your app profile says your app is a bank.