Trinidad and TobagoCybersecurity Best Practices Guideline, Cybersecurity Framework of Financial Institutions
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a company licensed under the Financial Institutions Act, 2008 or registered under the Insurance Act, 2018, the Acts under which the Central Bank established the Guideline (reached by declaring that you provide financial services). The Guideline says other companies are encouraged to adopt it but are not required to report to the Central Bank.
- Establish a cybersecurity framework proportional to your business model, complexity of operations and risks. The Guideline states this as what you should do (Part 1).
- Develop a formal risk-based cybersecurity strategy covering identification, protection, detection, response and recovery, approved by your Board and kept under at least annual review. The Guideline states this as what you should do (Part 2.A).
- Provide regular and appropriate cybersecurity training to employees and customers in an understandable way (Part 2.C).
- Conduct an annual self-assessment against the Guideline and submit the Return to the Central Bank by March 31 of the next calendar year, attaching action plans for any material deficiencies (Circular Letter CB-OIFI-2976/2023).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Trinidad and Tobago, which reviews the self-attestations and independent reviews and periodically conducts risk based on-site examinations to verify compliance with the Guideline.
Settledness
- As of
- Open questions
- Which sanction does the Insurance Act, 2018 attach to a registrant that contravenes a guideline issued under section 278(1) of that Act, as section 12 of the Financial Institutions Act, 2008 does for a licensee?
What this law does
The Central Bank of Trinidad and Tobago's Cybersecurity Best Practices Guideline says it is established in accordance with section 10(b) of the Financial Institutions Act, 2008 and section 278(1) of the Insurance Act, 2018 in respect of companies authorized under those Acts. The Guideline says other institutions not regulated by the Central Bank are encouraged to adopt its provisions but are not required to report to the Central Bank.
The Guideline says a formal risk-based cybersecurity strategy should be developed covering identification, protection, detection, response and recovery. The Guideline says the Board should approve the cybersecurity strategy and be kept informed of developments at least annually. The Guideline says regular and appropriate cybersecurity training must be provided to employees and customers in an understandable way.
The Central Bank's circular letter issuing the final Guideline says financial institutions must conduct an annual self-assessment against the Guideline and submit the Return to the Central Bank by March 31 of the next calendar year. Section 10 of the Financial Institutions Act, 2008 lets the Central Bank issue guidelines on any matter it considers necessary to enable the Central Bank to meet its objectives.
Section 12 of the Financial Institutions Act, 2008 says contravention of a guideline referred to in section 10 is not an offence but does not prevent the Central Bank or the Inspector from taking action under section 86. Section 86 of the Financial Institutions Act, 2008 lets the Inspector direct a licensee that has failed to comply with a measure imposed by the Central Bank to cease or refrain from the conduct or to perform the acts needed to remedy the situation.
When LexLint raises it
When your app profile says your app provides financial services.