HondurasCNBS Norms on Information Technology, Information Security and Cybersecurity Management (Circular CNBS 025/2022), Incident Notification
Normas para la Gestión de Tecnologías de Información Continuidad del Negocio, Seguridad de la Información y Ciberseguridad (Circular CNBS No.025/2022, Resolución GRD No.793/16-12-2022), arts. 21 and 37
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the institutions supervised by the Comisión Nacional de Bancos y Seguros and the financial groups they form, in proportion to their size, nature, complexity of operations and risk profile (reached by declaring that you provide financial services) (Articles 1 and 2).
- Notify the Comisión Nacional de Bancos y Seguros of information security and cybersecurity incidents that significantly affect the confidentiality, integrity or availability of the institution's information, in three stages (Article 21).
- Make the first communication within two hours after the incident is identified, with general data and a contact in the institution (Article 21).
- Send a preliminary report within two business days after the incident is identified, with detailed data, the nature of the incident, its preliminary impact and the measures taken, and update it every five business days while the incident is unresolved (Article 21).
- Send a final report within fifteen business days after the final resolution of the incident, with the root cause, the vulnerabilities exploited where they apply, the action plan carried out and the preventive controls to be implemented (Article 21).
- Notify the Comisión within two business days after identifying an incident that significantly affects business continuity, describing it and the measures taken to manage it (Article 37).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional de Bancos y Seguros, which supervises the institutions the Norms bind.
What this law does
Article 2 applies the Norms to the institutions supervised by the Comisión Nacional de Bancos y Seguros and to the financial groups they form. Article 21 requires supervised institutions to notify the Comisión of incidents that significantly affect the confidentiality, integrity or availability of their information. Article 21 sets a first communication within two hours after the incident is identified.
Article 21 sets a preliminary report within two business days after the incident is identified, updated every five business days while the incident is unresolved. Article 21 sets a final report within fifteen business days after the final resolution of the incident. Article 37 requires institutions to notify the Comisión within two business days of identifying an incident that significantly affects business continuity. The Norms apply from their publication in the Diario Oficial La Gaceta, which the gazette dates .
When LexLint raises it
When your app profile says your app provides financial services.