Central Bank of Trinidad and Tobago Circular on Cyber Risk Survey

CENTRAL BANK OF TRINIDAD & TOBAGO Eric Williams Plaza, Independence Square, Port-of-Spain, Trinidad, Trinidad and Tobago Postal Address: P.O. Box 1250 Telephone: (868) 621-2288, 235-2288; Fax: (868) 612-6396 E-Mail Address: info@central-bank.org.tt Website: www.central-bank.org.tt

April 8, 2019

CIRCULAR LETTER TO: ALL COMMERCIAL BANKS LICENCED UNDER THE FINANCIAL INSTITUTIONS ACT, 2008

REF: CB-OIFI-929/2019

SURVEY ON CYBER RISK

The Central Bank of Trinidad and Tobago (Central Bank) notes that cyber risk has become a key operational risk impacting licensees, given the high prevalence of cyber-attacks on financial institutions’ networks. The financial sector is arguably more exposed to cyber risk than other sectors, given that it is IT-intensive and highly dependent on information as a key input. Licensees’ use of technology includes greater levels of automation and integration with third-party service providers and customers. Bank IT systems also have multiple points of contact with outside parties that can result in significant vulnerability to cyber-attacks, and could be used as entry points for attacks targeting other parts of the financial system. Financial institutions are also highly interconnected (including with other sectors) through the payment systems.

The types of cyber-attacks facing financial institutions are varied and range from data breaches (unauthorized disclosure of personal information); security incidents (malicious attacks directed at a company); privacy violations (alleged violation of consumer privacy); and phishing incidents (individual financial crimes).

To mitigate cyber risks, financial institutions must implement appropriate monitoring and investigative systems, as well as consumer notification alerts. Further, the increasing cyber-attacks on financial institutions have focused attention on the need to strengthen cyber security. As the threats and vulnerabilities of these events evolve, licensees are expected to enhance their security standards to mitigate against the increasing risk associated with these activities.

Accordingly, the Central Bank is issuing a survey to gather information on the adequacy of financial institutions’ cyber security frameworks to ascertain security measures currently in place by institutions to lower the risk of loss.

The survey should be submitted in soft copy to cybersurvey@central-bank.org.tt May 10, 2019. Queries can also be submitted to email address or alternatively you should contact Mr. Kendall Cuffy at extension 5198 or kcuffy@central-bank.org.tt.

---

CIRCULAR LETTER TO: ALL COMMERCIAL BANKS LICENCED UNDER THE FINANCIAL INSTITUTIONS ACT, 2008

April 8, 2019

We look forward to your cooperation.

Yours sincerely

[Signature]

Patrick Solomon INSPECTOR OF FINANCIAL INSTITUTIONS

Att.

2