Circular No. 3909 — Cybersecurity Policy and Requirements for Cloud Computing and Data Processing Services

The Executive Board of the Central Bank of Brazil, in a session held on August 15, 2018, based on Articles 9, 10, and 15 of Law No. 12,865, of October 9, 2013, and in view of Article 14 of Resolution No. 4,282, of November 4, 2013,

R E S O L V E S:

CHAPTER I

ON THE OBJECT AND SCOPE OF APPLICATION

Art. 1. This Circular provides for the cybersecurity policy and the requirements for contracting data processing and storage services and cloud computing services to be observed by payment institutions authorized to operate by the Central Bank of Brazil.

CHAPTER II

ON THE CYBERSECURITY POLICY

Section I

On the Implementation of the Cybersecurity Policy

Art. 2. Payment institutions must implement and maintain a cybersecurity policy formulated based on principles and guidelines that seek to ensure the confidentiality, integrity, and availability of data and information systems used.

§ 1. The policy mentioned in the caput must be compatible with:

I - the size, risk profile, and business model of the institution;

II - the nature of the institution's activities and the complexity of the products and services offered; and

III - the sensitivity of the data and information under the institution's responsibility.

§ 2. It is admitted that payment institutions that are part of a prudential conglomerate adopt a single cybersecurity policy for the prudential conglomerate, in accordance with the regulations in force, provided that it is compatible with the provisions of this Chapter.

§ 3. Payment institutions that do not constitute their own cybersecurity policy as a result of the provision of § 2 must formalize the option for this facility in a meeting of the board of directors or, in its absence, the institution's executive board.

Art. 3. The cybersecurity policy must include, at a minimum:

I - the cybersecurity objectives of the payment institution;

II - the procedures and controls adopted to reduce the vulnerability of the payment institution to incidents and to meet other cybersecurity objectives;

III - specific controls, including those aimed at information traceability, that seek to ensure the security of sensitive information;

IV - the recording, cause and impact analysis, and control of the effects of incidents relevant to the payment institution's activities;

V - the guidelines for:

a) the preparation of incident scenarios considered in the continuity tests of the payment services provided;

b) the definition of procedures and controls aimed at the prevention and handling of incidents to be adopted by third-party service providers that handle data or sensitive information or that are relevant to the conduct of the payment institution's operational activities;

c) the classification of data and information regarding relevance; and

d) the definition of parameters to be used in the evaluation of the relevance of incidents;

VI - the mechanisms for disseminating the cybersecurity culture within the payment institution, including:

a) the implementation of training programs and periodic personnel evaluations;

b) the provision of information to end-users regarding precautions in the use of products and services offered; and

c) the commitment of senior management to the continuous improvement of procedures related to cybersecurity; and

VII - the initiatives for sharing information on relevant incidents, mentioned in item IV, with payment institutions, financial institutions, and other institutions authorized to operate by the Central Bank of Brazil.

§ 1. In defining the cybersecurity objectives referred to in item I of the caput, the payment institution's capacity to prevent, detect, and reduce vulnerability to incidents related to the cyber environment must be included.

§ 2. The procedures and controls referred to in item II of the caput must cover authentication, encryption, intrusion prevention and detection, information leakage prevention, periodic testing and scanning for vulnerability detection, protection against malicious software, the establishment of traceability mechanisms, access controls and computer network segmentation, and the maintenance of data and information backups.

§ 3. The procedures and controls cited in item II of the caput must be applied, including in the development of secure information systems and the adoption of new technologies used in the payment institution's activities.

§ 4. The recording, cause and impact analysis, and control of incident effects, cited in item IV of the caput, must include information received from third-party service providers.

§ 5. The guidelines referred to in item V, letter "b", of the caput must include procedures and controls at levels of complexity, scope, and precision compatible with those used by the payment institution itself.

Section II

On the Disclosure of the Cybersecurity Policy

Art. 4. The cybersecurity policy must be disclosed to the payment institution's employees and third-party service providers, using clear, accessible language and at a level of detail compatible with the functions performed and the sensitivity of the information.

Art. 5. Payment institutions must disclose to the public a summary containing the general lines of the cybersecurity policy.

Section III

On the Action and Incident Response Plan

Art. 6. Payment institutions must establish an action and incident response plan aimed at implementing the cybersecurity policy.

Sole paragraph. The plan mentioned in the caput must include, at a minimum:

I - the actions to be developed by the institution to adapt its organizational and operational structures to the principles and guidelines of the cybersecurity policy;

II - the routines, procedures, controls, and technologies to be used in the prevention and response to incidents, in accordance with the guidelines of the cybersecurity policy; and

III - the area responsible for recording and controlling the effects of relevant incidents.

Art. 7. Payment institutions must designate a director responsible for the cybersecurity policy and the execution of the action and incident response plan.

Sole paragraph. The director mentioned in the caput may perform other functions within the institution, provided there is no conflict of interest.

Art. 8. Payment institutions must prepare an annual report on the implementation of the action and incident response plan, mentioned in Art. 6, with a base date of December 31.

§ 1. The report referred to in the caput must address, at a minimum:

I - the effectiveness of the implementation of the actions described in Art. 6, sole paragraph, item I;

II - the summary of the results obtained in the implementation of the routines, procedures, controls, and technologies to be used in the prevention and response to incidents described in Art. 6, sole paragraph, item II;

III - the relevant incidents related to the cyber environment occurring during the period; and

IV - the results of the continuity tests of the payment services provided, considering scenarios of unavailability caused by incidents.

§ 2. The report mentioned in the caput must be presented to the board of directors or, in its absence, the institution's executive board by March 31 of the year following the base date.

Art. 9. The cybersecurity policy referred to in Art. 2 and the action and incident response plan mentioned in Art. 6 must be approved by the board of directors or, in its absence, the payment institution's executive board.

Art. 10. The cybersecurity policy and the action and incident response plan must be documented and reviewed, at a minimum, annually.

CHAPTER III

ON THE CONTRACTING OF DATA PROCESSING AND STORAGE SERVICES AND CLOUD COMPUTING

Art. 11. Payment institutions must ensure that their policies, strategies, and structures for risk management provided for in the regulations in force, specifically regarding decision criteria concerning the outsourcing of services, include the contracting of relevant data processing and storage and cloud computing services, in the country or abroad.

Art. 12. Payment institutions, prior to contracting relevant data processing and storage and cloud computing services, must adopt procedures that include:

I - the adoption of corporate governance and management practices proportional to the relevance of the service to be contracted and the risks to which they are exposed; and

II - the verification of the potential service provider's capacity to ensure:

a) compliance with the legislation and regulations in force;

b) the institution's access to the data and information to be processed or stored by the service provider;

c) the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider;

d) its adherence to certifications required by the institution for the provision of the service to be contracted;

e) the institution's access to reports prepared by an independent specialized audit company hired by the service provider, regarding the procedures and controls used in the provision of the services to be contracted;

f) the provision of adequate management information and resources for monitoring the services to be provided;

g) the identification and segregation of end-user data through physical or logical controls; and

h) the quality of access controls aimed at protecting the data and information of the institution's end-users.

§ 1. In evaluating the relevance of the service to be contracted, mentioned in item I of the caput, the contracting institution must consider the criticality of the service and the sensitivity of the data and information to be processed, stored, and managed by the contractor, taking into account, including, the classification carried out in accordance with Art. 3, item V, letter "c".

§ 2. The procedures referred to in the caput, including the information regarding the verification mentioned in item II, must be documented.

§ 3. In the case of application execution via the internet, referred to in Art. 13, item III, the institution must ensure that the potential service providers adopt controls that mitigate the effects of potential vulnerabilities in the release of new versions of the application.

§ 4. The institution must possess the necessary resources and competencies for the adequate management of the services to be contracted, including for information analysis and use of the resources provided in accordance with letter "f" of item II of the caput.

Art. 13. For the purposes of this Circular, cloud computing services include the availability to the contracting payment institution, on demand and virtually, of at least one of the following services:

I - data processing, data storage, network infrastructure, and other computational resources that allow the contracting institution to implement or execute software, which may include operating systems and applications developed by the institution or acquired by it;

II - the implementation or execution of applications developed by the contracting institution, or acquired by it, using the service provider's computational resources; or

III - execution, via the internet, of applications implemented or developed by the service provider, using the service provider's own computational resources.

Art. 14. The payment institution contracting the services mentioned in Art. 12 is responsible for the reliability, integrity, availability, security, and confidentiality of the contracted services, as well as for compliance with the legislation and regulations in force.

Art. 15. The contracting of relevant data processing, storage, and cloud computing services must be previously communicated by payment institutions to the Central Bank of Brazil.

§ 1. The communication referred to in the caput must contain the following information:

I - the name of the company to be contracted;

II - the relevant services to be contracted; and

III - the indication of the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed, defined in accordance with item III of Art. 16, in the case of contracting abroad.

§ 2. The communication referred to in the caput must be carried out, at a minimum, sixty days before the contracting of the services.

§ 3. Contractual changes that imply modification of the information referred to in § 1 must be communicated to the Central Bank of Brazil, at a minimum, sixty days before the contractual change.

§ 4. The communication referred to in the caput may be carried out within a period shorter than that provided in §§ 2 and 3 in exceptional cases, to ensure the regular functioning of the payment institution and provided that it is accompanied by a justified reasoning.

Art. 16. The contracting of relevant data processing, storage, and cloud computing services provided abroad must observe the following requirements:

I - the existence of an agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services may be provided;

II - the contracting payment institution must ensure that the provision of the services referred to in the caput does not cause harm to its regular functioning nor hinder the actions of the Central Bank of Brazil;

III - the contracting payment institution must define, prior to contracting, the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed; and

IV - the contracting payment institution must provide alternatives for the continuity of the payment services provided, in the event of impossibility of maintaining or terminating the service provision contract.

§ 1. In the case of the non-existence of an agreement in accordance with item I of the caput, the contracting payment institution must request authorization from the Central Bank of Brazil for the contracting, observing the period and information required in accordance with Art. 15 of this Circular.

§ 2. To meet items II and III of the caput, institutions must ensure that the legislation and regulations in the countries and regions in each country where the services may be provided do not restrict or prevent the access of the contracting payment institutions and the Central Bank of Brazil to the data and information.

§ 3. The proof of compliance with the requirements referred to in items I to IV of the caput and the fulfillment of the requirement referred to in § 2 must be documented.

Art. 17. Contracts for the provision of relevant data processing, storage, and cloud computing services must provide:

I - the indication of the countries and the region in each country where the services may be provided and the data may be stored, processed, and managed;

II - the adoption of security measures for the transmission and storage of the data cited in item I;

III - the maintenance, while the contract is in force, of the segregation of data and access controls to protect end-user information;

IV - the obligation, in the event of contract termination, of:

a) transfer of the data cited in item I to the new service provider or to the contracting payment institution; and

b) deletion of the data cited in item I by the replaced contracted company, after the data transfer provided for in letter "a" and the confirmation of the integrity and availability of the received data;

V - the contracting payment institution's access to:

a) information provided by the contracted company, aiming to verify compliance with items I to III;

b) information regarding certifications and specialized audit reports, cited in Art. 12, item II, letters "d" and "e"; and

c) information and management resources adequate for monitoring the services to be provided, cited in Art. 12, item II, letter "f";

VI - the obligation of the contracted company to notify the contracting payment institution regarding the subcontracting of relevant services to the institution;

VII - the Central Bank of Brazil's permission to access the contracts and agreements entered into for the provision of services, documentation and information regarding the services provided, data stored and information about their processing, data and information backups, as well as access codes to the data and information;

VIII - the adoption of measures by the contracting payment institution, as a result of a determination by the Central Bank of Brazil; and

IX - the obligation of the contracted company to keep the contracting payment institution permanently informed about any limitations that may affect the provision of services or compliance with the legislation and regulations in force.

Sole paragraph. The contract mentioned in the caput must provide, for the case of the declaration of a resolution regime for the contracting payment institution by the Central Bank of Brazil:

I - the obligation of the contracted company to grant full and unrestricted access to the person responsible for the resolution regime to the contracts, agreements, documentation, and information regarding the services provided, data stored and information about their processing, data and information backups, as well as access codes, cited in item VII of the caput, that are in the possession of the contracted company; and

II - the obligation of prior notification by the person responsible for the resolution regime regarding the intention of the contracted company to interrupt the provision of services, at least thirty days prior to the date scheduled for the interruption, observed that:

a) the contracted company agrees to accept any request for an additional thirty-day period for service interruption, made by the person responsible for the resolution regime; and

b) prior notification must also occur in the situation where the interruption is motivated by the default of the contracting payment institution.

Art. 18. The provisions of Arts. 11 to 17 do not apply to the contracting of systems operated by clearinghouses, by settlement and clearing service providers, or by entities that carry out registration or centralized deposit activities.

CHAPTER IV

GENERAL PROVISIONS

Art. 19. Payment institutions must ensure that their policies provided for in the risk management structure, in accordance with the regulations in force, provide, regarding the continuity of the payment services provided, on:

I - the handling of relevant incidents related to the cyber environment referred to in Art. 3, item IV;

II - the procedures to be followed in the event of interruption of relevant data processing and storage and cloud computing services contracted, including scenarios that consider the replacement of the contracted company and the restoration of the institution's normal operation; and

III - the incident scenarios considered in the continuity tests of the payment services provided referred to in Art. 3, item V, letter "a".

Art. 20. The procedures adopted by payment institutions for risk management provided for in the regulations in force must include, regarding the continuity of the payment services provided:

I - the treatment provided for to mitigate the effects of the relevant incidents referred to in Art. 3, item IV, and the interruption of relevant data processing, storage, and cloud computing services contracted;

II - the period established for the resumption or normalization of their activities or the relevant services interrupted, cited in item I; and

III - the timely communication to the Central Bank of Brazil of relevant incident occurrences and interruptions of relevant services, cited in item I, that constitute a crisis situation for the payment institution, as well as the measures for the resumption of its activities.

Art. 21. Payment institutions must establish monitoring and control mechanisms to ensure the implementation and effectiveness of the cybersecurity policy, the action and incident response plan, and the requirements for contracting data processing and storage and cloud computing services, including:

I - the definition of processes, tests, and audit trails;

II - the definition of adequate metrics and indicators; and

III - the identification and correction of any deficiencies.

§ 1. Notifications received regarding the subcontracting of relevant services described in Art. 17, item VI, must be considered in the definition of the mechanisms referred to in the caput.

§ 2. The mechanisms referred to in the caput must be submitted to periodic tests by internal audit compatible with the institution's internal controls.

Art. 22. Without prejudice to the duty of confidentiality and free competition, payment institutions must develop initiatives for sharing information on the relevant incidents referred to in Art. 3, item IV.

§ 1. The sharing referred to in the caput must include information on relevant incidents received from third-party service providers.

§ 2. The shared information must be available to the Central Bank of Brazil.

CHAPTER V

FINAL PROVISIONS

Art. 23. The following must be available to the Central Bank of Brazil for a period of five years:

I - the document regarding the cybersecurity policy, referred to in Art. 2;

II - the minutes of the meeting of the board of directors or, in its absence, the executive board of the institution, in the case where the option referred to in Art. 2, § 2 is formalized;

III - the document regarding the action and incident response plan, referred to in Art. 6;

IV - the annual report, referred to in Art. 8;

V - the documentation on the procedures referred to in Art. 12, § 2;

VI - the documentation referred to in Art. 16, § 3, in the case of services provided abroad;

VII - the contracts referred to in Art. 17, counting the period referred to in the caput from the termination of the contract; and

VIII - the data, records, and information regarding the monitoring and control mechanisms referred to in Art. 21, counting the period referred to in the caput from the implementation of the said mechanisms.

Art. 24. Payment institutions that, on the date of entry into force of this Circular, have already contracted the provision of relevant processing, data storage, and cloud computing services must present to the Central Bank of Brazil, within a maximum period of ninety days, counted from the date of entry into force of this Circular, a schedule for adaptation:

I - to compliance with the provisions of art. 16, items I, II, IV, and § 2º, in the case of services provided abroad; and

II - to the provisions of arts. 15, § 1º, and 17.

Sole paragraph. The period provided for in the adaptation schedule mentioned in the caput cannot exceed December 31, 2021.

Art. 25. The approval of the cybersecurity policy and the action and incident response plan, referred to in art. 9º, must be carried out within ninety days counted from the date of entry into force of this Circular.

Art. 26. The Central Bank of Brazil may veto or impose restrictions on the contracting of processing, data storage, and cloud computing services when it finds, at any time, non-compliance with the provisions of this Circular, as well as limitations on the Central Bank of Brazil's action, establishing a deadline for the adaptation of the aforementioned services and corresponding contracts.

Art. 27. Circular No. 3,681, of November 4, 2013, shall enter into force with the following alterations:

"Art. 2º ........................................................

I - ..............................................................

..................................................................

j) failures in systems, processes, or information technology infrastructure; and

............................................................" (NR)

"Art. 3º ........................................................

§ 1º The risk management structure mentioned in the caput must:

I - be compatible with the nature of the institution's activities and the complexity of the products and services offered and proportional to the size of the exposures to the aforementioned risks;

II - be segregated from the executive unit of the internal audit activity;

III - allow for the identification, measurement, monitoring, control, mitigation, and continuous and integrated management of operational, liquidity, and credit risks;

IV - provide for policies and strategies approved and reviewed, at least annually, by the board of directors and the board of administration, if any, in order to determine their compatibility with the institution's objectives and market conditions; and

V - maintain documentation regarding its policies, risk management strategies, and governance available to the Central Bank of Brazil.

§ 2º The policies and strategies provided for in item IV of § 1º must cover the following subjects:

I - decision criteria regarding the outsourcing of services and the selection of their providers, including the minimum contractual conditions necessary to mitigate operational risk; and

II - continuity of payment services provided." (NR)

"Art. 4º ........................................................

..................................................................

XV - notification to the end user regarding any non-execution of a transaction;

XVI - mechanisms that allow the end user to verify if the transaction was executed correctly;

XVII - decision criteria regarding the outsourcing of services and the selection of their providers; and

XVIII - assessment, management, and monitoring of operational risk resulting from relevant outsourced services for the regular functioning of the payment institution.

Sole paragraph. If payment institutions outsource functions related to the security of the services offered, the respective service provision contract must stipulate that the contractor must:

I - comply with the provisions of this article; and

II - allow the payment institution access to the data and information regarding the services provided." (NR)

Art. 28. The sole paragraph of art. 3º of Circular No. 3,681, of 2013, is hereby repealed.

Art. 29. This Circular enters into force on September 1, 2019.

                             Otávio Ribeiro Damaso Director of Regulation