Resolution No. 4,893

CMN RESOLUTION

NO. 4,893, OF FEBRUARY 26, 2021

Establishes the cybersecurity policy and the requirements for contracting data processing and storage services and cloud computing services to be observed by institutions authorized to operate by the Central Bank of Brazil.

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595, of December 31, 1964, makes public that the National Monetary Council, in a session held on February 25, 2021, based on Articles 4, item VIII, of the aforementioned Law, 9 of Law No. 4,728, of July 14, 1965, 7 and 23, item "a", of Law No. 6,099, of September 12, 1974, 1, item II, of Law No. 10,194, of February 14, 2001, and 1, § 1, of Complementary Law No. 130, of April 17, 2009,

RESOLVES:

CHAPTER I

OF THE OBJECT AND SCOPE OF APPLICATION

Art. 1. This Resolution establishes the cybersecurity policy and the requirements for contracting data processing and storage services and cloud computing services to be observed by institutions authorized to operate by the Central Bank of Brazil.

Sole Paragraph. The provisions of this Resolution do not apply to payment institutions, which must observe the regulations issued by the Central Bank of Brazil in the exercise of their legal duties. (Amended, effective from 1/3/2024, by CMN Resolution No. 5,117, of 1/25/2024.)

Sole Paragraph. The provisions of this Resolution do not apply to consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, and currency brokerage firms, which must observe the regulations issued by the Central Bank of Brazil in the exercise of their legal duties. (Amended, effective from 1/3/2024, by CMN Resolution No. 5,117, of 1/25/2024.)

CHAPTER II

OF THE CYBERSECURITY POLICY

Section I

Implementation of the Cybersecurity Policy

Art. 2. The institutions referred to in Art. 1 must implement and maintain a cybersecurity policy formulated based on principles and guidelines that seek to ensure the confidentiality, integrity, and availability of data and information systems used.

§ 1. The policy mentioned in the caput must be compatible with:

I - the size, risk profile, and business model of the institution;

II - the nature of the operations and the complexity of the institution's products, services, activities, and processes; and

III - the sensitivity of the data and information under the institution's responsibility.

§ 2. The adoption of a single cybersecurity policy is permitted for:

I - prudential conglomerates; and

II - credit cooperative systems.

§ 3. Institutions that do not constitute their own cybersecurity policy as a result of the provision in § 2 must formalize the option for this facility in a meeting of the board of directors or, in its absence, the management board of the institution.

Art. 3. The cybersecurity policy must include, at a minimum:

I - the institution's cybersecurity objectives;

II - the procedures and controls adopted to reduce the institution's vulnerability to incidents and to meet other cybersecurity objectives;

III - specific controls, including those aimed at information traceability, that seek to ensure the security of sensitive information;

IV - the recording, analysis of cause and impact, and control of the effects of incidents relevant to the institution's activities;

V - guidelines for:

a) the development of incident scenarios considered in business continuity tests;

b) the definition of procedures and controls aimed at the prevention and treatment of incidents to be adopted by third-party service providers that handle sensitive data or information or that are relevant to the conduct of the institution's operational activities;

c) the classification of data and information regarding relevance; and

d) the definition of parameters to be used in the assessment of the relevance of incidents;

VI - mechanisms for disseminating cybersecurity culture within the institution, including:

a) the implementation of training programs and periodic evaluation of personnel;

b) the provision of information to clients and users regarding precautions in the use of financial products and services; and

c) the commitment of senior management to the continuous improvement of procedures related to cybersecurity; and

VII - initiatives for sharing information about relevant incidents, mentioned in item IV, with the other institutions referred to in Art. 1.

§ 1. In defining the cybersecurity objectives referred to in item I of the caput, the institution's capacity to prevent, detect, and reduce vulnerability to incidents related to the cyber environment must be included.

§ 2. The procedures and controls referred to in item II of the caput must cover, at a minimum: (Amended by CMN Resolution No. 5,274, of 12/18/2025.)

I - authentication; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - encryption mechanisms; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - intrusion prevention and detection mechanisms; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

IV - information leak prevention mechanisms; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

V - protection mechanisms against malicious software; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

VI - traceability mechanisms; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

VII - data and information backup management; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

VIII - assessment and correction of vulnerabilities of computing resources and information systems; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

IX - access controls; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

X - the definition and implementation of secure configuration profiles for technology assets; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

XI - network protection mechanisms; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

XII - digital certificate management; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

XIII - security requirements for the integration of information systems through electronic interfaces; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

XIV - intelligence actions in the cyber environment, including monitoring information of interest to the institution on the internet, the Deep Web, and the Dark Web, as well as private communication groups. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 3. The procedures and controls cited in item II of the caput must be applied, including: (Amended by CMN Resolution No. 5,274, of 12/18/2025.)

I - in the development of secure information systems; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - in the adoption of new technologies employed in the institution's activities. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 4. The recording, analysis of cause and impact, and control of the effects of incidents, cited in item IV of the caput, must include information received from third-party service providers.

§ 5. The guidelines referred to in item V, item "b", of the caput, must include procedures and controls at levels of complexity, scope, and precision compatible with those used by the institution itself.

§ 6. The institution must verify the provision in item I of § 3, where applicable, in cases of information systems acquired by it or developed by third-party service providers, executed using the institution's own computing resources. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 7. The traceability mechanisms referred to in item VI of § 2 must cover the traceability of transactions and operations, including, at a minimum: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - end-to-end data and information processing audit trails, including the definition and generation of logs that enable the identification of processing failures or atypical behaviors, as well as supporting analyses; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - definition of information retention time according to the type of processing performed; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - secure retention of audit trails. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 8. The assessment and correction of vulnerabilities referred to in item VIII of § 2 must include, at a minimum: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - periodic tests and analyses to detect vulnerabilities in information systems; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - periodic scans of technological resources with the objective of identifying devices improperly connected to the corporate network that may establish connections with technology assets external to the institution; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - periodic analyses of technological resources with the objective of identifying vulnerabilities that may compromise the security of the institution's technology assets; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

IV - intrusion tests; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

V - timely correction of identified vulnerabilities. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 9. The access controls referred to in item IX of § 2 must include, at a minimum: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - mechanisms to limit access to the corporate network to credentialed users and authorized devices; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - periodic and timely review of access permissions, especially for third-party employees with access to the institution's computing resources; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - implementation of multi-factor authentication for access to the corporate network from environments external to the institution. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 10. The definition and implementation of secure configuration profiles referred to in item X of § 2 must provide, at a minimum: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - the management of the lifecycle of the institution's computing resources; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - the regular application of security patches; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - the proper configuration of services to be supported by computing resources; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

IV - the change of passwords and other standards that may be used for unauthorized access to computing resources. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 11. The network protection mechanisms referred to in item XI of § 2 must include, at a minimum: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - computer network segmentation, safeguarding, in particular, the production environment and computing resources that support critical business processes; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - the establishment of firewall rules, as well as the monitoring of connections, avoiding connection attempts to information systems originating from technology assets located outside the institution's corporate network; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - the definition of criteria for the establishment and monitoring of connections with external environments, especially during nighttime and non-working days; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

IV - measures to identify and prevent unauthorized connections with environments external to the institution originating from the institution's technological resources; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

V - the implementation and maintenance of processes and tools for the identification, analysis, treatment, and control of atypical events in the institution's production environment, including, as examples, the establishment of virtual private networks – VPN and attempts at privileged access to computing resources, especially during nighttime and non-working days; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

VI - the establishment of measures to restrict access to corporate networks only to duly authorized devices or technology assets. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

§ 12. The digital certificate management referred to in item XII of § 2 must provide, at a minimum: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - the monitoring of the use of certificates and digital signatures, including the implementation of the traceability mechanisms referred to in § 7; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II - procedures for the storage of information, including physical and logical access controls to private keys under the institution's responsibility; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

III - procedures and tools to prevent the unauthorized sharing of private keys associated with the institution's digital certificates; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

IV - the timely validation of revoked certificates with certification authorities. (Added by CMN Resolution No. 5,274, of 12/18/2025.)

Art. 3-A. The institutions referred to in Art. 1 must establish the following additional security requirements, as an integral part of the procedures and controls provided for in their cybersecurity policy referred to in Art. 3: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

I - in the case of electronic data communication on the National Financial System Network – RSFN: (Added by CMN Resolution No. 5,274, of 12/18/2025.)

a) use of multi-factor authentication for administrative access to the Pix environments and Reserve Transfer System – STR; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

b) physical and logical isolation of the Pix environment from the institution's other systems, maintaining a dedicated and separate instance from other environments in cases of contracted cloud computing services; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

c) physical and logical isolation of the STR environment from the institution's other systems, maintaining a dedicated and separate instance from other environments in cases of contracted cloud computing services; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

d) monitoring of the use of credentials and digital certificates, as well as the establishment of controls for the storage of this information, especially those used within the scope of the Instant Payment System – SPI; (Added by CMN Resolution No. 5,274, of 12/18/2025.)

e) implementation of mechanisms for end-to-end validation of transaction integrity by the institution before the digital signature of associated messages, ensuring that the data has not been corrupted or manipulated during the generation process of these messages; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

f) prohibition of access by third-party service providers to the private keys associated with digital certificates used by the institution for message signing; and (Added by CMN Resolution No. 5,274, of 12/18/2025.)

II

• in the case of connection as a participant in Financial Market Systems – SMF authorized to operate, the implementation of security controls for the prevention, detection, and response to fraud, to be observed by the institution. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

Sole Paragraph. Institutions must observe this article in a manner compatible with the provisions of: (Included by CMN Resolution No. 5,274, of 12/18/2025.)

I

• this Resolution; (Included by CMN Resolution No. 5,274, of 12/18/2025.)

II

• in force regulation; and (Included by CMN Resolution No. 5,274, of 12/18/2025.)

III

• in all technical requirements of the RSFN provided for in the SFN Services Catalog, the SFN Network Manual, and the SFN Security Manual, published by the Central Bank of Brazil. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

Section II
Cybersecurity Policy Disclosure

Art. 4º The cybersecurity policy must be disclosed to the institution's employees and to third-party service providers, using clear, accessible language and at a level of detail compatible with the functions performed and with the sensitivity of the information.

Art. 5º Institutions must disclose to the public a summary containing the general guidelines of the cybersecurity policy.

Section III
Action Plan and Incident Response

Art. 6º The institutions referred to in Art. 1º must establish an action plan and incident response plan aimed at implementing the cybersecurity policy.

Sole Paragraph. The plan mentioned in the caput must cover, at a minimum:

I

• the actions to be developed by the institution to adapt its organizational and operational structures to the principles and guidelines of the cybersecurity policy;

II

• the routines, procedures, controls, and technologies to be used in the prevention and response to incidents, in accordance with the guidelines of the cybersecurity policy; and

III

• the area responsible for recording and controlling the effects of relevant incidents.

Art. 7º The institutions referred to in Art. 1º must designate a director responsible for the cybersecurity policy and for the execution of the action plan and incident response plan.

Sole Paragraph. The director mentioned in the caput may perform other functions in the institution, provided there is no conflict of interest.

Art. 8º The institutions referred to in Art. 1º must prepare an annual report on the implementation of the action plan and incident response plan, mentioned in Art. 6º, with a base date of December 31.

§ 1º The report referred to in the caput must address, at a minimum:

I

• the effectiveness of the implementation of the actions described in Art. 6º, sole paragraph, item I;

II

• the summary of the results obtained in the implementation of the routines, procedures, controls, and technologies to be used in the prevention and response to incidents described in Art. 6º, sole paragraph, item II;

III - relevant incidents related to the cyber environment that occurred during the period; and

III

• relevant incidents related to the cyber environment that occurred during the period; (Wording given by CMN Resolution No. 5,274, of 12/18/2025.)

IV - the results of business continuity tests, considering scenarios of unavailability caused by incidents.

IV

• the results of business continuity tests, considering scenarios of unavailability caused by incidents; and (Wording given by CMN Resolution No. 5,274, of 12/18/2025.)

V

• the results of intrusion tests and the tests, scans, and periodic analyses for vulnerability detection referred to in Art. 3º, § 8º, and the action plans established for their corrections, observing the provisions of Art. 22-A, caput, item III. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

§ 2º The report mentioned in the caput must be:

I

• submitted to the risk committee, when it exists; and

II

• presented to the board of directors or, in its absence, to the institution's management by March 31 of the year following the base date.

Art. 9º The cybersecurity policy referred to in Art. 2º and the action plan and incident response plan mentioned in Art. 6º must be approved by the board of directors or, in its absence, by the institution's management.

Art. 10. The cybersecurity policy and the action plan and incident response plan must be documented and reviewed, at a minimum, annually.

CHAPTER III
HIRING OF DATA PROCESSING AND STORAGE SERVICES AND CLOUD COMPUTING

Art. 11. The institutions referred to in Art. 1º must ensure that their policies, strategies, and structures for risk management provided for in force regulation, specifically regarding decision criteria for outsourcing services, encompass the hiring of relevant data processing and storage and cloud computing services, in the country or abroad.

Art. 12. The institutions mentioned in Art. 1º, prior to hiring relevant data processing and storage and cloud computing services, must adopt procedures that encompass:

I

• the adoption of corporate governance and management practices proportional to the relevance of the service to be hired and to the risks to which they are exposed; and

II

• the verification of the potential service provider's capacity to ensure:

a) compliance with legislation and in-force regulation;

b) the institution's access to the data and information to be processed or stored by the service provider;

c) the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider;

d) its adherence to certifications required by the institution for the provision of the service to be hired;

e) the hiring institution's access to reports prepared by an independent specialized audit company hired by the service provider, regarding the procedures and controls used in the provision of the services to be hired;

f) the provision of information and management resources adequate for monitoring the services to be provided;

g) the identification and segregation of the institution's clients' data through physical or logical controls; and

h) the quality of access controls aimed at protecting the institution's clients' data and information.

§ 1º In evaluating the relevance of the service to be hired, mentioned in item I of the caput, the hiring institution must consider the criticality of the service and the sensitivity of the data and information to be processed, stored, and managed by the contractor, taking into account, among other things, the classification carried out in accordance with Art. 3º, item V, letter "c".

§ 2º The procedures referred to in the caput, including the information related to the verification mentioned in item II, must be documented.

§ 3º In the case of the execution of applications via the internet, referred to in item III of Art. 13, the institution must ensure that the potential service providers adopt controls that mitigate the effects of potential vulnerabilities in the release of new versions of the application.

§ 4º The institution must possess the necessary resources and competencies for the adequate management of the services to be hired, including for the analysis of information and use of resources provided in accordance with letter "f" of item II of the caput.

Art. 13. For the purposes of this Resolution, cloud computing services encompass the availability to the hiring institution, on demand and in a virtual manner, of at least one of the following services:

I

• data processing, data storage, network infrastructure, and other computational resources that allow the hiring institution to deploy or execute software, which may include operating systems and applications developed by the institution or acquired by it;

II

• the deployment or execution of applications developed by the hiring institution, or acquired by it, using the service provider's computational resources; or

III

• the execution, via the internet, of applications deployed or developed by the service provider, using the service provider's own computational resources.

Art. 14. The institution hiring the services mentioned in Art. 12 is responsible for the reliability, integrity, availability, security, and confidentiality regarding the hired services, as well as for compliance with legislation and in-force regulation.

Art. 15. The hiring of relevant data processing, storage, and cloud computing services must be communicated by the institutions referred to in Art. 1º to the Central Bank of Brazil.

§ 1º The communication mentioned in the caput must contain the following information:

I

• the name of the hired company;

II

• the relevant services hired; and

III

• the indication of the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed, defined in accordance with item III of Art. 16, in the case of hiring abroad.

§ 2º The communication referred to in the caput must be carried out within ten days after the hiring of the services.

§ 3º Contractual changes that imply modification of the information referred to in § 1º must be communicated to the Central Bank of Brazil within ten days after the contractual change.

Art. 16. The hiring of relevant data processing, storage, and cloud computing services provided abroad must observe the following requirements:

I

• the existence of an agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services may be provided;

II

• the hiring institution must ensure that the provision of the services referred to in the caput does not cause harm to its regular functioning nor hinder the action of the Central Bank of Brazil;

III

• the hiring institution must define, prior to hiring, the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed; and

IV

• the hiring institution must provide alternatives for business continuity, in the event of impossibility of maintaining or terminating the service provision contract.

§ 1º In the case of non-existence of an agreement in accordance with item I of the caput, the hiring institution must request authorization from the Central Bank of Brazil for:

I

• the hiring of the service, at least sixty days prior to the hiring, observing the provisions of Art. 15, § 1º, of this Resolution; and

II

• contractual changes that imply modification of the information referred to in Art. 15, § 1º, observing the minimum period of sixty days prior to the contractual change.

§ 2º To comply with items II and III of the caput, institutions must ensure that the legislation and regulation in the countries and regions in each country where the services may be provided do not restrict or prevent the access of the hiring institutions and the Central Bank of Brazil to the data and information.

§ 3º The proof of compliance with the requirements referred to in items I to IV of the caput and the fulfillment of the requirement referred to in § 2º must be documented.

Art. 17. Contracts for the provision of relevant data processing, storage, and cloud computing services must provide for:

I

• the indication of the countries and the region in each country where the services may be provided and the data may be stored, processed, and managed;

II

• the adoption of security measures for the transmission and storage of the data cited in item I of the caput;

III

• the maintenance, while the contract is in effect, of the segregation of data and access controls for the protection of client information;

IV

• the obligation, in the event of contract termination, of:

a) transfer of the data cited in item I of the caput to the new service provider or to the hiring institution; and

b) deletion of the data cited in item I of the caput by the replaced hired company, after the data transfer provided for in letter "a" and the confirmation of the integrity and availability of the received data;

V

• the hiring institution's access to:

a) information provided by the hired company, aiming to verify compliance with the provisions of items I to III of the caput;

b) information related to certifications and specialized audit reports, cited in Art. 12, item II, letters "d" and "e"; and

c) information and management resources adequate for monitoring the services to be provided, cited in Art. 12, item II, letter "f";

VI

• the obligation of the hired company to notify the hiring institution about the subcontracting of relevant services for the institution;

VII

• the permission for the Central Bank of Brazil to access the contracts and agreements entered into for the provision of services, the documentation and information related to the services provided, the data stored and the information about their processing, the data and information backups, as well as the access codes to the data and information;

VIII

• the adoption of measures by the hiring institution, as a result of a determination by the Central Bank of Brazil; and

IX

• the obligation of the hired company to keep the hiring institution permanently informed about any limitations that may affect the provision of services or compliance with legislation and in-force regulation.

Sole Paragraph. The contracts mentioned in the caput must provide, for the case of the declaration of a resolution regime for the hiring institution by the Central Bank of Brazil:

I

• the obligation of the hired company to grant full and unrestricted access to the person responsible for the resolution regime to the contracts, agreements, documentation, and information related to the services provided, the data stored and the information about their processing, the data and information backups, as well as the access codes cited in item VII of the caput that are in the possession of the hired company; and

II

• the obligation of prior notification to the person responsible for the resolution regime about the hired company's intention to interrupt the provision of services, at least thirty days in advance of the date scheduled for the interruption, observing that:

a) the hired company agrees to accept any request for an additional thirty-day period for the service interruption, made by the person responsible for the resolution regime; and

b) the prior notification must also occur in the situation where the interruption is motivated by the hiring institution's default.

Art. 18. The provisions of Arts. 11 to 17 do not apply to the hiring of systems operated by clearing houses, by clearing and settlement service providers, or by entities that carry out recording or centralized deposit activities.

CHAPTER IV
GENERAL PROVISIONS

Art. 19. The institutions referred to in Art. 1º must ensure that their risk management policies provided for in force regulation provide, regarding business continuity, for:

I

• the treatment of relevant incidents related to the cyber environment referred to in Art. 3º, item IV;

II

• the procedures to be followed in the event of interruption of relevant data processing and storage and cloud computing services hired, encompassing scenarios that consider the replacement of the hired company and the restoration of the institution's normal operation; and

III

• the incident scenarios considered in the business continuity tests referred to in Art. 3º, item V, letter "a".

Art. 20. The procedures adopted by institutions for risk management provided for in force regulation must encompass, regarding business continuity:

I

• the treatment provided for to mitigate the effects of the relevant incidents referred to in item IV of Art. 3º and of the interruption of the relevant data processing, storage, and cloud computing services hired;

II

• the period established for the restart or normalization of their activities or of the relevant services interrupted, cited in item I of the caput; and

III

• the timely communication to the Central Bank of Brazil of the occurrence of relevant incidents and of the interruptions of the relevant services cited in item I of the caput that constitute a crisis situation for the financial institution, as well as of the measures for the restart of its activities.

Sole Paragraph. Institutions must establish and document the criteria that constitute a crisis situation referred to in item III of the caput.

Art. 21. The institutions referred to in Art. 1º must institute monitoring and control mechanisms aimed at ensuring the implementation and effectiveness of the cybersecurity policy, the action plan and incident response plan, and the requirements for hiring data processing, storage, and cloud computing services, including:

I

• the definition of processes, tests, and audit trails;

II

• the definition of adequate metrics and indicators; and

III

• the identification and correction of any deficiencies.

§ 1º The notifications received regarding the subcontracting of relevant services described in Art. 17, item VI, must be considered in the definition of the mechanisms referred to in the caput.

§ 2º The mechanisms referred to in the caput must be submitted to periodic tests by internal audit, when applicable, compatible with the institution's internal controls.

Art. 22. Without prejudice to the duty of confidentiality and free competition, the institutions mentioned in Art. 1º must develop initiatives for the sharing of information about the relevant incidents referred to in Art. 3º, item IV.

§ 1º The sharing referred to in the caput must encompass information about relevant incidents received from third-party service providers.

§ 2º The shared information must be available to the Central Bank of Brazil.

Art. 22-A. Institutions must ensure that the intrusion tests mentioned in Art. 3º, § 8º, item IV, must: (Included by CMN Resolution No. 5,274, of 12/18/2025.)

I

• have a minimum annual periodicity; (Included by CMN Resolution No. 5,274, of 12/18/2025.)

II

• be carried out with independence and impartiality by a natural person or specialized company hired by the institution for this purpose, without prejudice to the carrying out of tests by the institution's own teams; and (Included by CMN Resolution No. 5,274, of 12/18/2025.)

III

• have the results of their execution documented, especially any vulnerabilities that are identified and the action plans established for their corrections. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

Art. 22-B. The service provided for the electronic communication of data in the RSFN, referred to in Art. 3-A, caput, item I, is considered relevant for the purposes of applying the provisions of this Resolution regarding the hiring of data processing, storage, and cloud computing services. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

§ 1º The provisions of the caput apply regardless of the form of connection with the RSFN. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

§ 2º The service referred to in the caput includes cases where the service provider provides message processing services within the SFN and the Brazilian Payments System – SPB. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

CHAPTER V
FINAL PROVISIONS

Art. 23. The following must be made available to the Central Bank of Brazil for a period of five years:

I

• the document related to the cybersecurity policy, referred to in Art. 2º;

II

• the minutes of the board of directors meeting or, in its absence, of the institution's management, in the case that the option referred to in Art. 2º, § 2º, is formalized;

III

• the document related to the action plan and incident response plan, referred to in Art. 6º;

IV

• the annual report, referred to in Art. 8º;

V

• the documentation on the procedures referred to in Art. 12, § 2º;

VI

• the documentation referred to in Art. 16, § 3º, in the case of services provided abroad;

VII

• the contracts referred to in Art. 17, counting the period referred to in the caput from the termination of the contract;

VIII - the data, records, and information related to the monitoring and control mechanisms referred to in Art. 21, counting the period referred to in the caput from the implementation of the cited mechanisms; and

VIII

• the data, records, and information related to the monitoring and control mechanisms referred to in Art. 21, counting the period referred to in the caput from the implementation of the cited mechanisms; (Wording given by CMN Resolution No. 5,274, of 12/18/2025.)

IX - the documentation with the criteria that constitute a crisis situation referred to in Art. 20, Sole Paragraph.

IX

• the documentation with the criteria that constitute a crisis situation referred to in Art. 20, sole paragraph; and (Wording given by CMN Resolution No. 5,274, of 12/18/2025.)

X

• documentation with the results of the execution of intrusion tests and the action plans established for the correction of vulnerabilities identified under Article 22-A, caput, item III, counting the period from the date of execution of the tests. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

Art. 24. The Central Bank of Brazil may adopt the necessary measures to comply with the provisions of this Resolution, as well as establish:

I - the requirements and procedures for the sharing of information, under the terms of Article 22;

II - the requirement of certifications and other technical requirements to be requested from contracted companies, by the contracting financial institution, in the provision of the services referred to in Article 12;

III - the maximum periods referred to in Article 20, item II for the restart or normalization of activities or relevant services interrupted; and

III - the maximum periods referred to in Article 20, caput, item II, for the restart or normalization of activities or relevant services interrupted; (Redaction given by CMN Resolution No. 5,274, of 12/18/2025.)

IV - the technical requirements and operational procedures to be observed by institutions for the compliance with this Resolution.

IV - the specification of security requirements for the integration of information systems through electronic interfaces, referred to in Article 3, § 2, item XIII; and (Redaction given by CMN Resolution No. 5,274, of 12/18/2025.)

V - the technical requirements and operational procedures to be observed by institutions for the compliance with this Resolution. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

§ 1º In the regulation referred to in the caput, the Central Bank of Brazil must observe the principles and guidelines referred to in Article 2, caput. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

§ 2º In the regulation referred to in item IV of the caput, the Central Bank of Brazil must also observe the following general guidelines: (Included by CMN Resolution No. 5,274, of 12/18/2025.)

I - the requirements to be specified will be those necessary and adequate to support the integration of systems referred to in Article 3, § 2, item XIII; and (Included by CMN Resolution No. 5,274, of 12/18/2025.)

II - the content regarding the requirements must accompany technological innovations, in order to maintain its aptitude as one of the procedures and controls for implementing the cybersecurity policy in future scenarios. (Included by CMN Resolution No. 5,274, of 12/18/2025.)

Art. 25. The institutions referred to in Article 1 that, on April 26, 2018, had already contracted the provision of relevant services of processing, data storage, and cloud computing must adapt the contract for the provision of such services:

I - to the compliance with the provisions of Article 16, items I, II, IV, and § 2, in the case of services provided abroad; and

II - to the provisions of Articles 15, § 1, and 17.

Sole Paragraph. The period provided for adaptation to the provisions of the caput cannot exceed December 31, 2021.

Art. 26. The Central Bank of Brazil may veto or impose restrictions for the contracting of data processing and storage services and cloud computing when it verifies, at any time, the non-observance of the provisions of this Resolution, as well as the limitation to the action of the Central Bank of Brazil, establishing a period for the adaptation of the referred services.

Art. 27. The following are revoked:

I - Resolution No. 4,658, of April 26, 2018; and

II - Resolution No. 4,752, of September 26, 2019.

Art. 28. This Resolution enters into force on July 1, 2021.

Roberto de Oliveira Campos Neto
President of the Central Bank of Brazil