BrazilCMN Resolution 4,893 of 2021, Cybersecurity Policy of Financial Institutions
Resolução CMN nº 4.893, de 26 de fevereiro de 2021, arts. 2º, 3º, 6º, 7º e 8º
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an institution authorized to operate by the Banco Central do Brasil, other than a consortium administrator, a payment institution, a securities broker or dealer, or a foreign-exchange broker, which follow the Banco Central do Brasil's own regulation (reached by declaring that you provide financial services). It has applied since .
- Implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of your data and information systems, compatible with your size, risk profile, business model, the nature and complexity of your operations and the sensitivity of the data you hold (articles 2 and 3).
- In the policy, set your cybersecurity objectives, the procedures and controls that reduce your vulnerability to incidents, controls that secure sensitive information, and the recording, root-cause and impact analysis and control of relevant incidents (article 3).
- Establish a plan of action and incident response that implements the policy, and designate a director responsible for the policy and for executing the plan (articles 6 and 7).
- Prepare an annual report on the implementation of the plan, with a base date of 31 December (article 8).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banco Central do Brasil, which applies the administrative penalties of Lei nº 13.506/2017 (public admonition, fine, bans on services or activities, disqualification of managers, and withdrawal of authorization) to a breach of its rules.
Settledness
- As of
- Open questions
- Which institutions the Banco Central do Brasil's own regulation, rather than this Resolution, now governs after the exclusion in article 1 as redrafted from ?
What this law does
Article 1 of Resolução CMN nº 4.893 applies the Resolution to the institutions authorized to operate by the Banco Central do Brasil, and its sole paragraph, as redrafted from , excludes consortium administrators, payment institutions, securities brokers and dealers, and foreign-exchange brokers.
Article 2 of the Resolution requires the institutions to implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of the data and information systems used. Article 3 of the Resolution requires the cybersecurity policy to contemplate, at a minimum, the institution's cybersecurity objectives and the procedures and controls adopted to reduce the institution's vulnerability to incidents.
Article 6 of the Resolution requires the institutions to establish a plan of action and incident response aimed at implementing the cybersecurity policy. Article 7 of the Resolution requires the institutions to designate a director responsible for the cybersecurity policy and for executing the plan of action and incident response.
Article 8 of the Resolution requires the institutions to prepare an annual report on the implementation of the plan of action and incident response, with a base date of 31 December. Article 28 provides that the Resolution enters into force on .
Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.
When LexLint raises it
When your app profile says your app provides financial services.