El SalvadorTechnical Standards on Cybersecurity Measures in Digital Channels (NRP-32), Cybersecurity Controls of Banks
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds the banks established in El Salvador, the branches of foreign banks, the savings and credit societies, the cooperative banks and their federations, and the investment banks that article 2 lists, for the information they handle in digital channels (reached by declaring that you are a bank).
- Monitor your networks and technology infrastructure to detect security events and unusual activity in time, and include threat intelligence (article 4).
- Run vulnerability-management processes with penetration tests and vulnerability scans, and remediate or mitigate every security gap, not only the critical and high-risk ones (article 5).
- Keep a quick process to acquire, test and install patches, and stop using applications, operating systems and database managers that the vendor no longer supports with security updates (article 6).
- Use multi-factor authentication on every user account that accesses through the Internet and on privileged accounts (article 7).
- Encrypt critical information at rest or in transit, including on removable and mobile storage devices, with secure protocols (article 14).
- Have cybersecurity-incident response plans that mitigate the impact of an incident, and test them (article 18).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia del Sistema Financiero, which applies the sanctions of the Ley de Supervisión y Regulación del Sistema Financiero to a breach of the norms (article 41).
Settledness
- As of
- Open questions
- Which sanction tier of the Ley de Supervisión y Regulación del Sistema Financiero applies to a breach of the NRP-32?
What this law does
Article 1 regulates the cybersecurity measures of the financial entities through which the information on the financial products and services offered to clients in digital channels is collected, processed, transmitted and stored. Article 2 binds the banks established in El Salvador and the branches of foreign banks established in El Salvador.
Article 5 requires the entities to have vulnerability-management processes based on penetration tests and vulnerability scans, and to remediate or mitigate all security gaps and not only the critical and high-risk ones. Article 7 requires the entities to use multi-factor authentication on any user account that accesses through the Internet and on privileged accounts. Article 14 requires the entities to encrypt critical information at rest or in transit.
Article 18 requires the entities to have response plans to mitigate the impact of a cybersecurity incident and to test them. Article 41 provides that a breach of the NRP-32 is sanctioned under the Ley de Supervisión y Regulación del Sistema Financiero. Article 44 sets as the day the NRP-32 enters into force.
When LexLint raises it
When your app profile says your app is a bank.