PeruSBS Regulation on Information Security and Cybersecurity Management (Resolution 504-2021), Report of Significant Cybersecurity Incidents
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the companies in articles 16 and 17 of the General Law of the Financial System (banks, financial companies, municipal and rural savings and credit banks and others), private pension fund administrators, Banco de la Nación and, as article 1 and article 4 of Resolución SBS 504-2021 set out, the other companies the Resolution lists (reached by declaring that you provide financial services). Article 4 applies the general regime to the companies in article 4.2 and a simplified regime to those in article 4.3. The Resolution took effect on .
- Report to the Superintendencia, as soon as you become aware of it, a cybersecurity incident with a verified or presumed significant adverse impact: loss or theft of company or client information, internal or external fraud, a negative effect on the company image and reputation, or an interruption of operations (article 15.1).
- Carry out a forensic analysis to determine the causes of the incident and take measures to manage it, and keep the resulting report, in an executive version and a technical version, available to the Superintendencia (article 15.2).
- Follow the minimum content, format and additional protocols the Superintendencia sets by general rule for the report (article 15.3).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia de Banca, Seguros y Administradoras Privadas de Fondos de Pensiones, which issued the Resolution under the powers of numerals 7 and 9 of article 349 of Law 26702.
Settledness
- As of
- Open questions
- Which general rule of the Superintendencia sets the content, format and protocols of the incident report under article 15.3, and does it fix a time limit beyond reporting as soon as the company becomes aware of the incident?
What this law does
Article 15.1 of the Regulation requires a company to report to the Superintendencia, as soon as it becomes aware of it, a cybersecurity incident with a verified or presumed significant adverse impact. Article 15.2 of the Regulation requires the company to carry out a forensic analysis to determine the causes of the incident and take measures to manage it.
Article 15.3 of the Regulation lets the Superintendencia set the minimum content, format and additional protocols of the report by a general rule. Article 1.1 of the Regulation applies it to the companies named in articles 16 and 17 of the General Law of the Financial System and to the private pension fund administrators. The Superintendencia issued the Resolution under the powers conferred by numerals 7 and 9 of article 349 of Law 26702. The Resolution is dated .
The Resolution was published in the official gazette El Peruano on . The Resolution enters into force on , the date on which Circular G 140-2009 is repealed.
When LexLint raises it
When your app profile says your app provides financial services.