MexicoCNBV General Provisions for Credit Institutions, Information Security Incident Reporting
Disposiciones de carácter general aplicables a las instituciones de crédito, art. 168 Bis 16
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a credit institution regulated by the Comisión Nacional Bancaria y de Valores (CNBV) general provisions for credit institutions (reached by declaring that you are a bank or supply software to one).
- Make sure the Commission is told immediately of an information security incident, by email to its cybersecurity account or by other means it indicates, generating an electronic receipt and stating at least the start date and time, whether it continues or has ended and its duration, a description and an initial assessment of impact or gravity (article 168 Bis 16, section I).
- Report immediately an incident that causes economic, data or service loss, whose method of operation, including exploited vulnerabilities, can be replicated at other institutions, that can affect clients or the stability of the financial or payment system, or that you consider serious (article 168 Bis 16, section I).
- Within 5 business days of identifying the incident, send the Commission the information in Annexes 64 and 64 Bis (article 168 Bis 16, section I).
- Investigate the causes immediately and send the Commission a work plan to eliminate or mitigate the risks and vulnerabilities behind the incident, naming the responsible staff, deadlines and resources, no later than 15 business days after the incident ends (article 168 Bis 16, section II).
- Where sensitive information in your custody or your service providers' custody was extracted, lost, deleted or altered, or you suspect unauthorized access, notify the affected clients within 48 hours of the incident or of learning of it (article 168 Bis 16, section II).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional Bancaria y de Valores, which imposes an administrative fine for infractions of the Ley de Instituciones de Crédito and of the provisions the Commission issues under it (article 108 of that law).
Settledness
- As of
- Open questions
- Which incident-reporting channel does the Commission currently designate in place of the email account named in article 168 Bis 16?
What this law does
Article 168 Bis 16, section I of the general provisions for credit institutions requires the general director to make arrangements so that the Commission is told of information security incidents immediately, by email to its cybersecurity account with an electronic receipt.
The incidents that must be reported immediately are those that cause economic, data or service loss, whose method of operation can be replicated at other institutions, that can affect clients or the stability of the financial or payment system, or that the institution itself considers serious. Article 168 Bis 16, section I also requires the institution to send the information in Annexes 64 and 64 Bis within 5 business days of identifying the incident.
Article 168 Bis 16, section II requires an immediate investigation of the causes and a work plan sent to the Commission within 15 business days after the incident ends. Where sensitive information in the custody of the institution or its service providers was extracted, lost, deleted or altered, or unauthorized access is suspected, article 168 Bis 16 requires clients to be notified within 48 hours of the incident or of learning of it.
The Commission issued the provisions under articles 52 and 96 Bis of the Ley de Instituciones de Crédito. A breach of the provisions is punishable by an administrative fine the Commission imposes under article 108 of the Ley de Instituciones de Crédito.
When LexLint raises it
When your app profile says your app is a bank.