BoliviaInformation Security Management Regulation for Supervised Financial Entities
Reglamento para la Gestión de Seguridad de la Información Recopilación de Normas para Servicios Financieros, Libro 3, Título VII, Capítulo II, Secciones 1, 3, 9, 12 y 13
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://servdmzw.asfi.gob.bo/circular/Textos/L03T07.pdfIn force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an entidad de intermediación financiera (EIF), an empresa de servicios financieros complementarios (ESFC) other than a currency exchange house (casa de cambio), and a sociedad controladora de grupos financieros (SCGF) that holds an operating license from the Autoridad de Supervisión del Sistema Financiero (ASFI), reached by declaring that you provide financial services.
- Meet the minimum directives and requirements the Regulation sets for information security management, according to your nature, size and structure and the complexity of your processes and operations (Section 1, Article 1).
- Analyze and evaluate your information security risks under formally established procedures that match your nature, size and operational complexity (Section 3, Article 1).
- Run a technical vulnerability management program with formal policies and procedures, assess technical vulnerabilities at least once a year and after a change in your technological infrastructure, and include controlled intrusion tests where your risk analysis calls for them (Section 3, Article 8).
- Have a formalized, updated and implemented procedure for managing information security incidents, approved by your board or equivalent body, that fixes responsibilities and procedures for a rapid, effective and orderly response (Section 9).
- Keep a database that records each information security incident under a classification that covers at least the sixteen categories Section 9 lists, from loss of service to repeated attempts at unauthorized access (Section 9, items c and d).
- Have your internal audit function verify compliance with the Regulation for the preceding twelve months, and send ASFI the resulting report by 15 January each year (Section 12, item a).
- Make your board or equivalent body and your general management responsible for compliance with, implementation of and internal dissemination of the Regulation (Section 13, Article 1).
- Apply international information technology and information security standards to any situation the Regulation does not foresee, and name the standards you use in your policies (Section 13, Article 2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Autoridad de Supervisión del Sistema Financiero (ASFI), which evaluates the information security of each supervised entity and may use computer tools for its information security evaluations and systems audits of supervised entities.
Settledness
- As of
- Open questions
- Which later circulars of the Autoridad de Supervisión del Sistema Financiero have amended the Regulation since the Circular ASFI/660/2020 text this row reads?
What this law does
The Reglamento para la Gestión de Seguridad de la Información, contained in Libro 3, Título VII, Capítulo II of the Recopilación de Normas para Servicios Financieros of the Autoridad de Supervisión del Sistema Financiero, sets minimum directives and requirements for information security management.
Section 1, Article 2 applies the Regulation to the entidades de intermediación financiera, the empresas de servicios financieros complementarios other than currency exchange houses, and the sociedades controladoras de grupos financieros that hold an operating license from the Autoridad de Supervisión del Sistema Financiero. Section 3, Article 8 requires a supervised entity to assess its technical vulnerabilities at least once a year and after a change in its technological infrastructure.
Section 9 requires a supervised entity to have a formalized, updated and implemented procedure for managing information security incidents, approved by its board or equivalent body. Section 9 requires a supervised entity to keep a database of its information security incidents that follows the classification the same Article sets out.
Section 12 requires a supervised entity to send the Autoridad de Supervisión del Sistema Financiero, by 15 January each year, its report on verification of compliance with the Regulation over the preceding twelve months. Section 13, Article 4 provides that non-observance of the Regulation gives rise to the start of an administrative sanctioning process.
When LexLint raises it
When your app profile says your app provides financial services.