NicaraguaTechnology Risk Management Norm, Information to the Superintendent on Security Incidents
Norma sobre Gestión de Riesgo Tecnológico, Resolución CD-SIBOIF-500-1-SEP19-2007, art. 42
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the banks and the non-bank financial institutions subject to the authorization, supervision and oversight of the Superintendencia de Bancos y de Otras Instituciones Financieras, to the extent that the norm applies to them (reached by declaring that you provide financial services).
- Inform the Superintendent formally and immediately of a successful external attack on, or penetration of, your systems through network and communication services, and within the following 24 hours send the detail of the result and the actions taken to correct it (article 42(a)).
- Inform the Superintendent immediately of the activation of your information technology contingency plans or recovery strategies, and of an interruption of your main operating systems and application software that affects service to clients, and within the following 24 hours send the result and the corrective actions (article 42(b) and (c)).
- Inform the Superintendent immediately of a formal decision to change your central operating platform or the technology platform you use to provide financial services by electronic means (article 42(d) and (e)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia de Bancos y de Otras Instituciones Financieras, to which the institution reports the events listed in article 42.
Settledness
- As of
- Open questions
- Which penalty applies to an institution that fails to inform the Superintendent of an event listed in article 42?
What this law does
Article 42, as reformed on , requires the institution to inform the Superintendent formally and immediately of a successful external attack on or penetration of its systems through network and communication services. Article 42 requires the institution to send the Superintendent, within the following twenty-four hours, the detail of the result and of the actions taken to correct the event.
Article 42 also requires immediate notice of the activation of information technology contingency plans and of an interruption of the main operating systems that affects service to clients. Article 3 applies the norm to all the financial institutions subject to the authorization, supervision and oversight of the Superintendencia de Bancos.
When LexLint raises it
When your app profile says your app provides financial services.