PhilippinesManual of Regulations for Banks, Information Technology Risk Management and Information Security
Manual of Regulations for Banks Section 148 (Information Technology Risk Management), IT governance, information security and annual IT profile
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://morb.bsp.gov.ph/148-information-technology-risk-management/In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds a Bangko Sentral-supervised financial institution (BSFI), which the guidelines define to include banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision or regulation, and also a BSFI with offshore data processing as may be appropriate to its situation (reached by declaring that you provide financial services).
- Establish an effective IT governance framework, with the board of directors ultimately responsible for understanding and managing your IT risks and senior management accountable for designing and implementing the board-approved IT risk management system (Section 148, IT governance).
- Put in place a robust, enterprise-wide framework for information security risk management, with information security governance and oversight, and maintain an information security program that matches your operational and IT profile (Section 148, IT controls implementation, information security).
- Have the board and senior management appoint a chief information security officer, a senior executive with enough authority to be responsible and accountable for the organization-wide information security program (Section 148, IT controls implementation, information security).
- Submit an Annual IT Profile electronically to the appropriate supervising department of the Bangko Sentral within twenty-five days from the end of the reference year (Section 148, reporting and notification standards, item a(1)).
- Make your IT policies, procedures and related documents available during on-site examination and give the Bangko Sentral copies on written request (Section 148, sanctions and penalties).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bangko Sentral ng Pilipinas, which may deploy applicable enforcement actions on the institution and its directors, officers and employees for violations of the requirement.
Settledness
- As of
- Open questions
- Which parts of the framework bind every institution, given that the guidelines say they are not one-size-fits-all and are applied on a risk basis?
What this law does
Section 148 sets out guidelines on information technology risk management that serve as the Bangko Sentral's baseline requirement for all Bangko Sentral-supervised financial institutions. Section 148 applies its guidelines to banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision or regulation. Section 148 provides that these institutions must establish an effective IT governance framework.
Section 148 provides that the board and senior management should appoint a chief information security officer responsible and accountable for the organization-wide information security program. Section 148 requires these institutions to submit an Annual IT Profile to the supervising department of the Bangko Sentral within twenty-five days from the end of the reference year.
Section 148 provides that the Bangko Sentral may deploy applicable enforcement actions on the institution and its directors, officers and employees for violations of its reporting requirement.
When LexLint raises it
When your app profile says your app provides financial services.