El SalvadorTechnical Standards for Information Security Management (NRP-23), Security Management Program of Supervised Entities
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the banks established in El Salvador and the branches of foreign banks, the financial conglomerates, pension fund managers, insurers, stock exchanges and brokerage houses, payment and securities-settlement system operators, e-money providers and the other supervised entities listed in article 2 (reached by declaring that you provide financial services). Article 2 was amended with effect from and again from .
- Establish, maintain and document an information security management system that is consistent with your business-continuity management and your operational-risk management (article 10).
- Implement a cybersecurity function that reports to the board, the risk committee and senior management on its results, including cyber threats, the effectiveness of the cybersecurity programs and a summary of the incidents that affected the entity (article 12).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia del Sistema Financiero, which supervises the entities the NRP-23 binds and applies the sanctions of the Ley de Supervisión y Regulación del Sistema Financiero to a breach of the norms (article 32).
Settledness
- As of
- Open questions
- Which sanction tier of the Ley de Supervisión y Regulación del Sistema Financiero applies to a breach of the NRP-23?
What this law does
Article 1 sets the minimum criteria for the management of information security and cybersecurity, in line with each entity's nature, size, risk profile and volume of operations. Article 2 binds the banks established in El Salvador and the branches of foreign banks established in the country. Article 2 binds the insurance companies established in El Salvador and the branches of foreign insurance companies. Article 2 binds the e-money providers.
Article 10 requires each entity to establish, maintain and document an information security management system consistent with its business-continuity management and its operational-risk management. Article 12 requires each entity to implement a cybersecurity function that reports to the board, the risk committee and senior management. Article 32 provides that a breach of the NRP-23 is sanctioned under the Ley de Supervisión y Regulación del Sistema Financiero.
The preamble records that the Ley de Supervisión y Regulación del Sistema Financiero makes the Banco Central de Reserva responsible for approving the technical norms on risk management by supervised entities. The Comité de Normas amended article 2 in a session of , with effect from .
When LexLint raises it
When your app profile says your app provides financial services.