CMF Proposes Standard on Information Security and Cyber Security
CMF is consulting on the standard for management of information security and cyber security. The proposed standard establishes a series of guidelines and best practices that should be considered by entities in their process of information-security and cyber-security management. This will allow the entities to be better prepared for a scenario in which the management of operational risk becomes increasingly relevant. The guidelines will apply to banks, banking subsidiaries, bank draft support companies, and payment card issuers and operators. The comment period for this consultation ends on December 27, 2019. The instructions set forth in this standard will be effective as of March 01, 2020.
The new chapter of the Updated Collection of Standards (RAN) for banks and other relevant entities contains a series of provisions that are based on international best practices and that should be considered for the management of information security and cyber security. The new chapter of the RAN complements different regulations of CMF, which include chapters on evaluation of operational risk management (Chapter 1-13), risks that entities assume in outsourcing services (Chapter 20-7), information on operational incidents (Chapter 20-8), and business continuity management (Chapter 20-9). The standard is divided into four sections:
- The first section establishes general guidelines for the management of information security and cyber-security matters. Among them, the role of Board of Directors for the proper management of information security and cyber security is highlighted, giving the Board the responsibility of approving the institutional strategy in this area.
- The second section establishes guidelines that institutions should consider for the implementation of a risk management process to support the information security and cyber-security system. Thus, the minimum stages of an information security and cyber-security risk management process are established.
- The third section mainly establishes two aspects of relevance in cyber-security management. One aspect is the determination of the cyber-security critical assets, including physical components such as hardware and technological systems that store, manage, and support these assets. The other aspect underlines the relevance of the protection functions of these assets, the detection of threats and vulnerabilities, the response to incidents, and the recovery of the normal operation of the entity.
- The fourth and final section contemplates the importance that entities have policies and procedures for the identification of assets that make up the critical infrastructure of the financial industry and the payment system as well as for the adequate exchange of incident information with other members.
Related Links (in Spanish)
- Press Release
- Consultation Paper (PDF)
- FAQs on Consultation (PDF)
- Presentation on Consultation (PDF)
Comment Due Date: December 27, 2019
Effective Date: March 01, 2020
Keywords: Americas, Chile, Banking, Information Security, Cyber Risk, Operational Risk, FAQ, CMF
Related Articles
EC Issues Regulation on Adjustments to K-Factor Coefficients Under IFR
The European Commission (EC) published a report summarizing responses to the targeted consultation on the supervisory convergence and the single rulebook in the European Union (EU).
OSFI Issues Results of Pilot on Climate Risk Scenario Analysis
The Office of the Superintendent of Financial Institutions (OSFI) published an update on the discussion paper that intended to engage federally regulated financial institutions and other interested stakeholders in a dialog with OSFI, to proactively enhance and align assurance expectations over key regulatory returns.
ECB Issues Opinions on Green Bonds Standard and CRR Proposals
The European Central Bank (ECB) published its opinion on a proposal for a regulation on European green bonds, following a request from the European Parliament.
ESRB Explores Policy Response to Risks Arising from Digitalization
The Advisory Scientific Committee (ASC) of the European Systemic Risk Board (ESRB) published a report that explores the expected impact of digitalization on provision of financial and banking services, and proposes policy measures to address the risks stemming from digitalization.
EU Authorities Address COVID-19 Reporting, MCD, and PSD2 Issues
The European Banking Authority (EBA) announced that the guidelines on the reporting and disclosure of exposures subject to measures COVID-relief measures shall continue to apply until further notice.
FI Publishes Multiple Regulatory and Reporting Updates
The Swedish Financial Supervisory Authority (FI) announced that the capital adequacy reporting as at December 31, 2021 must be done by February 11, 2022.
BSP Tackles Aspects of Lending and Islamic, Open & Sustainable Finance
The Central Bank of the Philippines (BSP) issued communications covering developments related to online lending platforms, open finance framework and roadmap, and on the expected regulations in the area sustainable finance.
US Agencies Issue Regulatory Updates, FDIC Launches Tech Sprint
The Board of Governors of the Federal Reserve System (FED) published the final rule that amends Regulation I to reduce the quarterly reporting burden for member banks by automating the application process for adjusting their subscriptions to the Federal Reserve Bank capital stock, except in the context of mergers.
EBA Issues Guide on Bank Resolvability, Consults on Transferability
The European Banking Authority (EBA) published its assessment of risks through the quarterly Risk Dashboard and the results of the Autumn edition of the Risk Assessment Questionnaire (RAQ).
MFSA Publishes CRD5 Updates and Supervisory Priorities for 2022
The Malta Financial Services Authority (MFSA) updated the guidelines on supervisory reporting requirements under the reporting framework 3.0.
