ColombiaSuperintendencia Financiera de Colombia, Circular Externa 033 de 2020 (External Circular 33 of 2020), taxonomy, protocol and mailbox for reporting cybersecurity incidents and a format for security metrics
Circular Externa 033 de 2020 (Superintendencia Financiera de Colombia)
In force since .
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- If you are an entity subject to the Superintendencia Financiera de Colombia's inspection and supervision, or a PILA information operator, keep reporting security incidents and cybersecurity incidents to riesgooperativo@superfinanciera.gov.co (Circular Externa 033 de 2020, fifth instruction).
- Label each incident report with the Traffic Light Protocol (TLP) and describe the incident using the single taxonomy of cyber incidents, the TUIC, that the circular defines (first and fifth instructions).
- Transmit your information security and cybersecurity metrics on Formato 408 (Proforma F.000-164) (second instruction).
These lines are LexLint's reading of the law's text, as of .
What this law does
Circular Externa 033 de 2020 (External Circular 33 of 2020) of the Superintendencia Financiera de Colombia, the financial regulator, is dated and addressed to the legal representatives and statutory auditors of the entities subject to the Superintendencia's inspection and supervision and to the PILA information operators.
Its first instruction adds numeral 5 to Chapter V of Title IV of Part I of the Circular Básica Jurídica (the Superintendencia's basic legal circular), on the minimum requirements for managing information security and cybersecurity, to define a single taxonomy for reporting cybersecurity incidents and to adopt the Traffic Light Protocol (TLP) for reporting cyber incidents to the Superintendencia.
The second instruction creates Formato 408 (Proforma F.000-164) for reporting information security and cybersecurity metrics, with mandatory transmission tests between 18 and and a first official transmission with data as of . Under the fifth instruction, security and cybersecurity incidents must continue to be reported to the mailbox riesgooperativo@superfinanciera.gov.co, using the labeling protocol and taxonomy the circular defines.
When LexLint raises it
When your app profile says your app provides financial services.