CMN Resolution No. 4658 — Cybersecurity Policy and Cloud Computing Requirements for Financial Institutions

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the National Monetary Council, in a session held on April 26, 2018, based on Articles 4, item VIII, of the aforementioned Law, 9 of Law No. 4,728 of July 14, 1965, 7 and 23, item "a", of Law No. 6,099 of September 12, 1974, 1, item II, of Law No. 10,194 of February 14, 2001, and 1, § 1, of Complementary Law No. 130 of April 17, 2009,

RESOLVES:

CHAPTER I

ON THE OBJECT AND SCOPE OF APPLICATION

Article 1. This Resolution provides for the cybersecurity policy and the requirements for contracting data processing and storage services and cloud computing services to be observed by financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

CHAPTER II

ON THE CYBERSECURITY POLICY

Section I

On the Implementation of the Cybersecurity Policy

Article 2. The institutions referred to in Article 1 must implement and maintain a cybersecurity policy formulated based on principles and guidelines that seek to ensure the confidentiality, integrity, and availability of data and information systems used.

§ 1. The policy mentioned in the caput must be compatible with:

I - the size, risk profile, and business model of the institution;

II - the nature of operations and the complexity of the institution's products, services, activities, and processes; and

III - the sensitivity of the data and information under the institution's responsibility.

§ 2. The adoption of a single cybersecurity policy is permitted by:

I - prudential conglomerate; and

II - credit cooperative system.

§ 3. Institutions that do not constitute their own cybersecurity policy as a result of the provision in § 2 must formalize the option for this facility in a meeting of the board of directors or, in its absence, the institution's management.

Article 3. The cybersecurity policy must include, at minimum:

I - the institution's cybersecurity objectives;

II - the procedures and controls adopted to reduce the institution's vulnerability to incidents and to meet other cybersecurity objectives;

III - specific controls, including those aimed at information traceability, that seek to ensure the security of sensitive information;

IV - the recording, cause and impact analysis, as well as the control of the effects of incidents relevant to the institution's activities;

V - the guidelines for:

a) the development of incident scenarios considered in business continuity tests;

b) the definition of procedures and controls aimed at the prevention and handling of incidents to be adopted by third-party service providers that handle sensitive data or information or that are relevant to the conduct of the institution's operational activities;

c) the classification of data and information regarding relevance; and

d) the definition of parameters to be used in the assessment of the relevance of incidents;

VI - the mechanisms for disseminating the cybersecurity culture within the institution, including:

a) the implementation of training programs and periodic personnel evaluation;

b) the provision of information to clients and users regarding precautions in the use of financial products and services; and

c) the commitment of senior management to the continuous improvement of procedures related to cybersecurity; and

VII - initiatives for sharing information on relevant incidents, mentioned in item IV, with other institutions referred to in Article 1.

§ 1. In defining the cybersecurity objectives referred to in item I of the caput, the institution's capacity to prevent, detect, and reduce vulnerability to incidents related to the cyber environment must be considered.

§ 2. The procedures and controls referred to in item II of the caput must cover, at minimum, authentication, encryption, intrusion prevention and detection, information leak prevention, periodic testing and scanning for vulnerability detection, protection against malicious software, the establishment of traceability mechanisms, access controls and computer network segmentation, and the maintenance of data and information backups.

§ 3. The procedures and controls cited in item II of the caput must be applied, including in the development of secure information systems and the adoption of new technologies used in the institution's activities.

§ 4. The recording, cause and impact analysis, as well as the control of incident effects, cited in item IV of the caput, must include information received from third-party service providers.

§ 5. The guidelines referred to in item V, item "b", of the caput must include procedures and controls at levels of complexity, scope, and precision compatible with those used by the institution itself.

Section II

On the Disclosure of the Cybersecurity Policy

Article 4. The cybersecurity policy must be disclosed to the institution's employees and third-party service providers, using clear, accessible language and at a level of detail compatible with the functions performed and the sensitivity of the information.

Article 5. Institutions must disclose to the public a summary containing the general lines of the cybersecurity policy.

Section III

On the Action and Incident Response Plan

Article 6. The institutions referred to in Article 1 must establish an action and incident response plan aimed at implementing the cybersecurity policy.

Sole paragraph. The plan mentioned in the caput must cover, at minimum:

I - the actions to be developed by the institution to adapt its organizational and operational structures to the principles and guidelines of the cybersecurity policy;

II - the routines, procedures, controls, and technologies to be used in the prevention and response to incidents, in accordance with the cybersecurity policy guidelines; and

III - the area responsible for recording and controlling the effects of relevant incidents.

Article 7. The institutions referred to in Article 1 must designate a director responsible for the cybersecurity policy and the execution of the action and incident response plan.

Sole paragraph. The director mentioned in the caput may perform other functions within the institution, provided there is no conflict of interest.

Article 8. The institutions referred to in Article 1 must prepare an annual report on the implementation of the action and incident response plan, mentioned in Article 6, with a reference date of December 31.

§ 1. The report referred to in the caput must address, at minimum:

I - the effectiveness of the implementation of the actions described in Article 6, sole paragraph, item I;

II - the summary of the results obtained in the implementation of the routines, procedures, controls, and technologies to be used in the prevention and response to incidents described in Article 6, sole paragraph, item II;

III - the relevant incidents related to the cyber environment that occurred during the period; and

IV - the results of business continuity tests, considering scenarios of unavailability caused by incidents.

§ 2. The report mentioned in the caput must be:

I - submitted to the risk committee, when it exists; and

II - presented to the board of directors or, in its absence, the institution's management by March 31 of the year following the reference date.

Article 9. The cybersecurity policy referred to in Article 2 and the action and incident response plan mentioned in Article 6 must be approved by the board of directors or, in its absence, the institution's management.

Article 10. The cybersecurity policy and the action and incident response plan must be documented and reviewed, at minimum, annually.

CHAPTER III

ON THE CONTRACTING OF DATA PROCESSING AND STORAGE SERVICES AND CLOUD COMPUTING

Article 11. The institutions referred to in Article 1 must ensure that their policies, strategies, and structures for risk management provided for in current regulations, specifically regarding decision criteria for outsourcing services, include the contracting of relevant data processing and storage and cloud computing services, in the country or abroad.

Article 12. The institutions mentioned in Article 1, prior to contracting relevant data processing and storage and cloud computing services, must adopt procedures that include:

I - the adoption of corporate governance and management practices proportional to the relevance of the service to be contracted and the risks to which they are exposed; and

II - the verification of the potential service provider's capacity to ensure:

a) compliance with current legislation and regulations;

b) the institution's access to the data and information to be processed or stored by the service provider;

c) the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider;

d) its adherence to certifications required by the institution for the provision of the service to be contracted;

e) the institution's access to reports prepared by an independent specialized audit company hired by the service provider, regarding the procedures and controls used in the provision of the services to be contracted;

f) the provision of information and management resources adequate for monitoring the services to be provided;

g) the identification and segregation of the institution's client data through physical or logical controls; and

h) the quality of access controls aimed at protecting the institution's client data and information.

§ 1. In assessing the relevance of the service to be contracted, mentioned in item I of the caput, the contracting institution must consider the criticality of the service and the sensitivity of the data and information to be processed, stored, and managed by the contractor, taking into account, among other things, the classification performed in accordance with Article 3, item V, item "c".

§ 2. The procedures referred to in the caput, including the information regarding the verification mentioned in item II, must be documented.

§ 3. In the case of application execution via the internet, referred to in item III of Article 13, the institution must ensure that the potential service providers adopt controls that mitigate the effects of potential vulnerabilities in the release of new versions of the application.

§ 4. The institution must possess the necessary resources and competencies for the adequate management of the services to be contracted, including for information analysis and use of resources provided in accordance with item "f" of item II of the caput.

Article 13. For the purposes of this Resolution, cloud computing services include the availability to the contracting institution, on demand and virtually, of at least one of the following services:

I - data processing, data storage, network infrastructure, and other computational resources that allow the contracting institution to deploy or execute software, which may include operating systems and applications developed by the institution or acquired by it;

II - deployment or execution of applications developed by the contracting institution, or acquired by it, using the service provider's computational resources; or

III - execution, via the internet, of applications deployed or developed by the service provider, using the service provider's own computational resources.

Article 14. The contracting institution of the services mentioned in Article 12 is responsible for the reliability, integrity, availability, security, and confidentiality of the contracted services, as well as for compliance with current legislation and regulations.

Article 15. The contracting of relevant data processing, storage, and cloud computing services must be previously communicated by the institutions referred to in Article 1 to the Central Bank of Brazil.

§ 1. The communication referred to in the caput must contain the following information:

I - the name of the company to be contracted;

II - the relevant services to be contracted; and

III - the indication of the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed, defined in accordance with item III of Article 16, in the case of contracting abroad.

§ 2. The communication referred to in the caput must be carried out, at minimum, sixty days before the contracting of the services.

§ 3. Contractual changes that imply modification of the information referred to in § 1 must be communicated to the Central Bank of Brazil, at minimum, sixty days before the contractual change.

Article 16. The contracting of relevant data processing, storage, and cloud computing services provided abroad must observe the following requirements:

I - the existence of an agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services may be provided;

II - the contracting institution must ensure that the provision of the services referred to in the caput does not cause harm to its regular functioning nor hinder the actions of the Central Bank of Brazil;

III - the contracting institution must define, prior to contracting, the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed; and

IV - the contracting institution must provide alternatives for business continuity in the event of impossibility of maintaining or terminating the service provision contract.

§ 1. In the case of the absence of an agreement as per item I of the caput, the contracting institution must request authorization from the Central Bank of Brazil for the contracting, observing the deadline and information required in accordance with Article 15 of this Resolution.

§ 2. To comply with items II and III of the caput, institutions must ensure that the legislation and regulations in the countries and regions in each country where the services may be provided do not restrict or prevent the access of the contracting institutions and the Central Bank of Brazil to the data and information.

§ 3. The proof of compliance with the requirements referred to in items I to IV of the caput and the fulfillment of the requirement referred to in § 2 must be documented.

Article 17. Contracts for the provision of relevant data processing, storage, and cloud computing services must provide:

I - the indication of the countries and the region in each country where the services may be provided and the data may be stored, processed, and managed;

II - the adoption of security measures for the transmission and storage of the data cited in item I;

III - the maintenance, while the contract is in effect, of the segregation of data and access controls to protect client information;

IV - the obligation, in the event of contract termination, of:

a) transfer of the data cited in item I to the new service provider or to the contracting institution; and

b) deletion of the data cited in item I by the replaced contracted company, after the data transfer provided for in item "a" and the confirmation of the integrity and availability of the received data;

V - the contracting institution's access to:

a) information provided by the contracted company, aiming to verify compliance with items I to III;

b) information regarding certifications and specialized audit reports, cited in Article 12, item II, items "d" and "e"; and

c) information and management resources adequate for monitoring the services to be provided, cited in Article 12, item II, item "f";

VI - the obligation of the contracted company to notify the contracting institution about the subcontracting of relevant services to the institution;

VII - the Central Bank of Brazil's permission to access the contracts and agreements entered into for the provision of services, the documentation and information regarding the services provided, the data stored and information about their processing, the data and information backups, as well as the access codes to the data and information;

VIII - the adoption of measures by the contracting institution, as a result of a determination by the Central Bank of Brazil; and

IX - the obligation of the contracted company to keep the contracting institution permanently informed about any limitations that may affect the provision of services or compliance with current legislation and regulations.

Sole paragraph. The contract mentioned in the caput must provide, for the case of the declaration of a resolution regime for the contracting institution by the Central Bank of Brazil:

I - the obligation of the contracted company to grant full and unrestricted access to the person responsible for the resolution regime to the contracts, agreements, documentation, and information regarding the services provided, the data stored and information about their processing, the data and information backups, as well as the access codes, cited in item VII of the caput, that are in the possession of the contracted company; and

II - the obligation of prior notification by the person responsible for the resolution regime about the intention of the contracted company to interrupt the provision of services, at least thirty days in advance of the date scheduled for the interruption, observed that:

a) the contracted company agrees to accept any request for an additional thirty-day period for the interruption of the service, made by the person responsible for the resolution regime; and

b) prior notification must also occur in the situation where the interruption is motivated by the contractor's default.

Article 18. The provisions of Articles 11 to 17 do not apply to the contracting of systems operated by clearinghouses, by settlement and clearing service providers, or by entities that carry out registration or centralized deposit activities.

CHAPTER IV

GENERAL PROVISIONS

Article 19. The institutions referred to in Article 1 must ensure that their risk management policies provided for in current regulations include, regarding business continuity, the following:

I - the handling of relevant incidents related to the cyber environment referred to in Article 3, item IV;

II - the procedures to be followed in the event of interruption of relevant data processing and storage and cloud computing services contracted, covering scenarios that consider the replacement of the contracted company and the restoration of the institution's normal operation; and

III - the incident scenarios considered in the business continuity tests referred to in Article 3, item V, item "a".

Article 20. The procedures adopted by institutions for risk management provided for in current regulations must include, regarding business continuity:

I - the treatment provided for to mitigate the effects of the relevant incidents referred to in item IV of Article 3 and the interruption of relevant data processing, storage, and cloud computing services contracted;

II - the deadline established for the resumption or normalization of their activities or the relevant interrupted services, cited in item I; and

III - the timely communication to the Central Bank of Brazil of relevant incident occurrences and interruptions of relevant services, cited in item I, that constitute a crisis situation for the financial institution, as well as the measures for the resumption of its activities.

Article 21. The institutions referred to in Article 1 must establish monitoring and control mechanisms to ensure the implementation and effectiveness of the cybersecurity policy, the action and incident response plan, and the requirements for contracting data processing, storage, and cloud computing services, including:

I - the definition of processes, tests, and audit trails;

II - the definition of adequate metrics and indicators; and

III - the identification and correction of any deficiencies.

§ 1. Notifications received regarding the subcontracting of relevant services described in Article 17, item VI, must be considered in the definition of the mechanisms referred to in the caput.

§ 2. The mechanisms referred to in the caput must be subjected to periodic tests by internal audit, when applicable, compatible with the institution's internal controls.

Article 22. Without prejudice to the duty of confidentiality and free competition, the institutions mentioned in Article 1 must develop initiatives for sharing information on the relevant incidents referred to in Article 3, item IV.

§ 1. The sharing referred to in the caput must include information on relevant incidents received from third-party service providers.

§ 2. The shared information must be available to the Central Bank of Brazil.

CHAPTER V

FINAL PROVISIONS

Article 23. The following must be available to the Central Bank of Brazil for a period of five years:

I - the document regarding the cybersecurity policy, referred to in Article 2;

II - the minutes of the board of directors meeting or, in its absence, the institution's management, in the case where the option referred to in Article 2, § 2 is formalized;

III - the document regarding the action and incident response plan, referred to in Article 6;

IV - the annual report, referred to in Article 8;

V - the documentation on the procedures referred to in Article 12, § 2;

VI - the documentation referred to in Article 16, § 3, in the case of services provided abroad;

VII - the contracts referred to in Article 17, counting the period referred to in the caput from the termination of the contract; and

VIII - the data, records, and information regarding the monitoring and control mechanisms referred to in Article 21, counting the period referred to in the caput from the implementation of the cited mechanisms.

Article 24. The Central Bank of Brazil may adopt the necessary measures to comply with the provisions of this Resolution, as well as establish:

I - the requirements and procedures for sharing information, in accordance with Article 22;

II - the requirement for certifications and other technical requirements to be requested from contracted companies, by the contracting financial institution, in the provision of the services referred to in Article 12;

III - the maximum timeframes, referred to in Article 20, item II, for the restart or normalization of activities or relevant services interrupted; and

IV - the technical requirements and operational procedures to be observed by institutions to comply with this Resolution.

Article 25. The institutions referred to in Article 1 who, on the date of entry into force of this Resolution, have already contracted the provision of relevant services for processing, data storage, and cloud computing, must present to the Central Bank of Brazil, within a maximum period of one hundred and eighty days, counted from the date of entry into force of this Resolution, an adaptation schedule:

I - to compliance with the provisions of Article 16, items I, II, IV, and § 2nd, in the case of services provided abroad; and

II - to the provisions of Articles 15, § 1st, and 17.

Sole Paragraph. The timeframe provided in the adaptation schedule mentioned in the caput cannot exceed December 31, 2021.

Article 26. The approval of the cybersecurity policy, referred to in Article 2, and the action and incident response plan, referred to in Article 6, must be carried out, in the manner of Article 9, by May 6, 2019.

Article 27. The Central Bank of Brazil may veto or impose restrictions on the contracting of data processing and storage services and cloud computing when it finds, at any time, non-compliance with the provisions of this Resolution, as well as limitations on the Central Bank of Brazil's operations, establishing a timeframe for the adaptation of the aforementioned services.

Article 28. This Resolution enters into force on the date of its publication.

                 Ilan Goldfajn  
                 President of the Central Bank of Brazil