PanamaSuperintendency of Banks Agreement 003-2012, Management of Information Technology Risk
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds official banks, general-licence banks and international-licence banks for which the Superintendencia de Bancos de Panamá is the home supervisor (reached by declaring that you are a bank) (Article 1).
- Keep an organizational structure suited to your size, complexity and risk profile to manage information technology and its associated risks, with policies, strategic plans and procedures for it (Article 3).
- Use an information technology risk methodology, including a risk matrix, that guarantees system security through at least logical access controls, physical security and network security measures (Article 3).
- Identify, measure, monitor, control, mitigate and report the information technology risks to which the bank is exposed (Article 8).
- Through the information security unit, keep systems protected against new threats and existing vulnerabilities, coordinate intrusion and vulnerability tests of the technology environment and set the standards that control access to information systems (Article 11).
- Include in the business continuity plan stress tests, alternative processing with backup of information and systems, recovery capacity for critical information technology services and communication processes (Article 12).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendent of Banks, who sanctions a breach of the Acuerdo under Title IV of the Banking Law.
What this law does
Article 1 applies the Acuerdo to official banks, general-licence banks and international-licence banks for which the Superintendencia is the home supervisor. Article 3 requires a bank to keep an organizational structure suited to its size, complexity and risk profile to manage information technology and its associated risks.
Article 3 requires an information technology risk methodology that guarantees system security through at least logical access, physical security and network security controls. Article 8 requires banks to identify, measure, monitor, control, mitigate and report the information technology risks to which they are exposed. Article 11 gives the information security unit of a bank, as a minimum, the function of keeping systems protected against new threats and existing vulnerabilities.
Article 11 also gives the information security unit the function of coordinating intrusion and vulnerability tests of the bank technology environment. Article 12 requires the business continuity plan of a bank to include stress tests, alternative processing with backup of information and systems, recovery capacity for critical services and communication processes. Article 15 provides that the Superintendent sanctions a breach of the Acuerdo under Title IV of the Banking Law. Article 16 provides that the Acuerdo applies from .
When LexLint raises it
When your app profile says your app is a bank.