MexicoCNBV General Provisions for Credit Institutions, Information Security Controls
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a credit institution regulated by the Comisión Nacional Bancaria y de Valores (CNBV) general provisions for credit institutions (reached by declaring that you are a bank or supply software to one). The text pinned here is the one the CNBV inserted as Section Eight Bis, "De la seguridad de la información".
- Have your general director make sure information security incidents are handled through management processes covering detection, classification, containment, investigation, forensic analysis where applicable, escalation, resolution, follow-up and communication to authorities, clients and counterparties (article 168 Bis 11, section IX).
- Run security reviews of the technological infrastructure at least once a year, or sooner if the infrastructure changes significantly (article 168 Bis 12, section II).
- Keep an annual calendar of vulnerability-scanning tests of the infrastructure components that store, process or transmit information, reviewing some components each quarter so that every component holding critical information is covered within the year (article 168 Bis 12, section III).
- Hire an independent third party with certified technical staff to run penetration tests on your systems and applications (article 168 Bis 12, section IV).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional Bancaria y de Valores, which imposes an administrative fine for infractions of the Ley de Instituciones de Crédito and of the provisions the Commission issues under it (article 108 of that law).
Settledness
- As of
- Open questions
- Do later amendments to the general provisions change the wording of articles 168 Bis 11 and 168 Bis 12 as pinned here?
What this law does
Article 168 Bis 11, section IX of the Comisión Nacional Bancaria y de Valores general provisions for credit institutions requires that information security incidents be handled through management processes covering detection, classification, containment, investigation, reporting, resolution, follow-up and communication to authorities, clients and counterparties.
Article 168 Bis 12, section II of those provisions requires security reviews of the technological infrastructure at least once a year, or sooner if the infrastructure changes significantly. Article 168 Bis 12, section III of those provisions requires an annual calendar of vulnerability-scanning tests, with quarterly review of some components so that every component holding critical information is covered within the year.
Article 168 Bis 12, section IV of those provisions requires the institution to hire an independent third party with certified technical staff to run penetration tests on its systems and applications. The Commission issued the provisions under articles 52 and 96 Bis of the Ley de Instituciones de Crédito. A breach of the provisions is punishable by an administrative fine the Commission imposes under article 108 of the Ley de Instituciones de Crédito.
When LexLint raises it
When your app profile says your app is a bank.