El SalvadorTechnical Standards for Information Security Management (NRP-23), Incident Communication
Normas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, art. 13
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the banks established in El Salvador and the branches of foreign banks, the financial conglomerates, pension fund managers, insurers, stock exchanges and brokerage houses, payment and securities-settlement system operators, e-money providers and the other supervised entities listed in article 2 (reached by declaring that you provide financial services). Article 2 was amended with effect from and again from .
- Establish notification procedures under which your senior management and the Superintendencia are told as soon as you know of a materialized information-security or cybersecurity incident that exceeds the risk limits your board has approved, by the means available, with a brief description that covers the possible cause, the impact and the actions taken (article 13(a)).
- Within seven working days after reporting the incident, send the Superintendencia the complete documentation: start and end date and time, description, causes of the failure, technical diagnosis, channels affected, time out of service, impact, and the corrective actions or action plan (article 13(a)).
- Inform in a timely way, under your policies, the clients and users of financial products and services affected by a cybersecurity incident that compromised the confidentiality or integrity of their information, and tell them the measures taken to mitigate it (article 13(b)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia del Sistema Financiero, which receives the incident reports and applies the sanctions of the Ley de Supervisión y Regulación del Sistema Financiero to a breach of the norms (articles 13 and 32).
Settledness
- As of
- Open questions
- Which sanction tier of the Ley de Supervisión y Regulación del Sistema Financiero applies to a missed incident report under article 13?
What this law does
Article 13 requires an entity to establish notification procedures under which senior management and the Superintendencia are told, when the entity becomes aware of a materialized information-security or cybersecurity incident that exceeds the risk limits the board has approved, with a brief description of the incident. Article 13 requires the entity to send the complete documentation on the incident within seven working days after reporting it.
Article 13 requires the entity to inform in a timely way the clients and users of financial services affected by a cybersecurity incident that compromised the confidentiality or integrity of their information. Article 32 provides that a breach of the NRP-23 is sanctioned under the Ley de Supervisión y Regulación del Sistema Financiero. Article 37 sets as the day the NRP-23 enters into force.
When LexLint raises it
When your app profile says your app provides financial services.