PanamaSuperintendency of Banks Agreement 006-2011, Electronic Banking Security Controls
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds official banks, general-licence banks and international-licence banks that provide services or products to their customers through electronic banking (reached by declaring that you are a bank) (Article 1).
- Run intrusion and vulnerability tests carried out by suitable professionals external to the bank, with the external intrusion test at least once a year (Article 10).
- Develop incident response and communication plans to manage, stop and mitigate problems that disrupt electronic banking systems and services, including internal and external attacks (Article 11).
- Ensure the authenticity, integrity, confidentiality and non-repudiation of a valid transaction once accepted, together with segregation of duties and authorization controls, using the security solutions the Acuerdo lists (Article 15).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendent of Banks, who sanctions a breach of the Acuerdo under Title IV of the Banking Law.
What this law does
Article 1 applies the Acuerdo to official banks, general-licence banks and international-licence banks that provide services or products to their customers through electronic banking. Article 10 requires every bank to run intrusion and vulnerability tests carried out by suitable professionals external to the bank. Article 10 sets the external intrusion test at a minimum of once a year.
Article 11 requires a bank to develop incident response and communication plans to manage, stop and mitigate problems that disrupt its electronic banking systems and services. Article 15 requires a bank to ensure the authenticity, integrity, confidentiality and non-repudiation of a valid transaction once accepted, together with segregation of duties and authorization controls. Article 22 provides that the Superintendent sanctions a breach of the Acuerdo under Title IV of the Banking Law. Article 24 provides that the Acuerdo applies from .
When LexLint raises it
When your app profile says your app is a bank.