Costa RicaGeneral Regulation on Information Technology Governance and Management (CONASSIF Agreement 5-24), Information Security and Cybersecurity Programme
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds every entity and company supervised by SUGEF, SUGEVAL, SUGESE or SUPEN, and the controllers and member companies of supervised financial groups and conglomerates (reached by declaring that you provide financial services) (Article 2).
- Design, implement, maintain and monitor an information security management system whose controls take a risk-based approach and are set out in a statement of applicability (Article 31).
- Manage cybersecurity to meet business requirements and to ensure digital operational resilience, and set indicators that measure its effectiveness and efficiency on a recurring basis (Article 32).
- Establish, every year, programmes of vulnerability analysis and testing that cover the information security and cybersecurity controls, with the types and scope of tests matched to your risks (Article 33).
- Savings and credit cooperatives under the SUGEF proportional regulation (Acuerdo SUGEF 25-23) and insurance brokerage companies supervised by SUGESE treat Articles 33, 34 and 35 as good practice they may adopt at their discretion (Article 3).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencias (SUGEF, SUGEVAL, SUGESE and SUPEN), which may require additional information security and cybersecurity practices and controls inside the information security management system.
What this law does
Article 2 applies the Regulation to entities supervised by SUGEF, SUGEVAL, SUGESE and SUPEN. Article 31 requires supervised entities and companies to design, implement, maintain and monitor an information security management system. Article 32 requires supervised entities and companies to manage cybersecurity to meet business requirements and to ensure digital operational resilience.
Article 33 requires supervised entities and companies to establish, every year, programmes of vulnerability analysis and testing that cover the information security and cybersecurity controls. For savings and credit cooperatives under the SUGEF proportional regulation and for insurance brokerage companies, Articles 33, 34 and 35 are good-practice references they may adopt at their discretion.
The Regulation was approved on and applies from its publication in Alcance 130 to La Gaceta 134 of .
When LexLint raises it
When your app profile says your app provides financial services.