HondurasCNBS Norms on Information Technology, Information Security and Cybersecurity Management (Circular CNBS 025/2022)
Normas para la Gestión de Tecnologías de Información Continuidad del Negocio, Seguridad de la Información y Ciberseguridad (Circular CNBS No.025/2022, Resolución GRD No.793/16-12-2022), arts. 18-20
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the institutions supervised by the Comisión Nacional de Bancos y Seguros and the financial groups they form, in proportion to their size, nature, complexity of operations and risk profile (reached by declaring that you provide financial services) (Articles 1 and 2).
- Design, implement, document, monitor and update an information security and cybersecurity management framework that includes security policies, procedures and controls, a risk-management methodology, a designated function and a review process (Article 18).
- Manage cybersecurity on international best practices and standards so as to identify, protect, detect, respond and recover (Article 19).
- Keep an information security and cybersecurity function with functional and operational independence from the information technology area and the user areas, headed by an executive with specialized training and proven experience (Article 20).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional de Bancos y Seguros, which supervises the institutions the Norms bind.
What this law does
Article 2 applies the Norms to the institutions supervised by the Comisión Nacional de Bancos y Seguros and to the financial groups they form. Article 18 requires supervised institutions to design, implement, document, monitor and update an information security and cybersecurity management framework. Article 19 requires supervised institutions to manage cybersecurity on international best practices and standards.
Article 20 requires supervised institutions to keep an information security and cybersecurity function with functional and operational independence from the information technology area. The Norms apply from their publication in the Diario Oficial La Gaceta, which the gazette dates .
When LexLint raises it
When your app profile says your app provides financial services.