BoliviaAnnual Vulnerability Analysis Report to the Financial System Supervisor
Reglamento para la Gestión de Seguridad de la Información Recopilación de Normas para Servicios Financieros, Libro 3, Título VII, Capítulo II, Sección 12, Artículo Único, inciso b
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://servdmzw.asfi.gob.bo/circular/Textos/L03T07.pdfIn force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an entidad de intermediación financiera (EIF), an empresa de servicios financieros complementarios (ESFC) other than a currency exchange house (casa de cambio), and a sociedad controladora de grupos financieros (SCGF) that holds an operating license from the Autoridad de Supervisión del Sistema Financiero (ASFI), reached by declaring that you provide financial services.
- Assess your technical vulnerabilities at least once a year and after a change in your technological infrastructure, using controlled intrusion tests where your risk analysis calls for them (Section 3, Article 8, item a).
- Have your internal audit function report on the execution of the intrusion tests and send ASFI the result of the vulnerability analysis by 15 November each year, attaching a copy of the evaluator's executive report and the action plan that corrects the weaknesses found (Section 12, item b).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Autoridad de Supervisión del Sistema Financiero (ASFI), which evaluates the information security of each supervised entity and may use computer tools for its information security evaluations and systems audits of supervised entities.
Settledness
- As of
- Open questions
- Does the Regulation itself require a supervised entity to notify the Autoridad de Supervisión del Sistema Financiero of a security incident as it occurs, beyond the annual vulnerability analysis report?
What this law does
Section 12 requires the internal audit function of a supervised entity to report on the intrusion tests and to send the Autoridad de Supervisión del Sistema Financiero the result of the vulnerability analysis by 15 November each year, with the evaluator's executive report and an action plan. Section 3, Article 8 requires a supervised entity to assess its technical vulnerabilities at least once a year and after a change in its technological infrastructure.
Section 13, Article 4 provides that non-observance of the Regulation gives rise to the start of an administrative sanctioning process.
When LexLint raises it
When your app profile says your app provides financial services.