Cybersecurity Best Practices Guideline for Financial Institutions

CENTRAL BANK OF TRINIDAD AND TOBAGO Eric Williams Plaza, Independence Square, Port-of-Spain, Trinidad, Trinidad and Tobago Postal Address: P.O. Box 1250 Telephone: (868) 621-CBTT (2288), 235-CBTT (2288); Fax: 612-6396 E-Mail Address: info@central-bank.org.tt Website: www.central-bank.org.tt

September 15, 2023 CIRCULAR LETTER TO: All Institutions – Licensed Under the Financial Institutions Act, 2008 Registered Under the Insurance Act, 2018 Registered Under the Exchange Control Act Chap 79:50 Financial Holding Companies Payments System Operators or Payment services providers pursuant to the FIA or CBA Bankers Association of Trinidad and Tobago Association of Trinidad and Tobago Insurance Companies Institute of Chartered Accountants of Trinidad and Tobago Insurance Brokers Association of Trinidad and Tobago Caribbean Actuarial Association REF: CB-OIFI-2976/2023 Cybersecurity Best Practices Guideline for Financial Institutions On June 29, 2023, the Central Bank of Trinidad and Tobago (“Central Bank”) issued a draft Cybersecurity Best Practices Guideline (“Guideline”) to the industry for comment. The Central Bank has considered the feedback received and is pleased to issue the final Guideline for your review and implementation. A Table of Central Bank’s responses to feedback received on the draft Guideline is also provided for purposes of transparency. The principles based Guideline takes into account international best practices and is intended to raise awareness of, and strengthen cybersecurity practices, within financial institutions. Financial institutions are expected to use the guiding principles to establish robust cybersecurity frameworks within their organizations that are proportional to their business models, complexity, and risks. Complementary to the Guideline, the Central Bank is issuing a Self-Assessment Return (“Return”) and a Cybersecurity Incident Reporting Form (“Reporting Form”). Financial institutions must conduct an annual self-assessment against the Guideline and submit this Return to the Central Bank by March 31st of the next calendar year, with the first submission due by March 31, 2024. Financial institutions should also attach detailed action plans to remedy any material deficiencies identified in their self￾assessments. The Cybersecurity Incident Reporting Form is being instituted to facilitate prompt notification and reporting to the Central Bank upon occurrence of a material cyber incident. Financial institutions should establish the requisite policies and procedures for identification of a material cyber incident and incorporate this reporting requirement into their processes.

Circular Letter To: All Institutions – Cybersecurity Best Practices Guideline for Financial Institutions September 15, 2023 Financial institutions can access the Guideline, Return, and Reporting Form on the Central Bank’s website at the following location: https://www.central￾bank.org.tt/core-functions/supervision/cybersecurity. The Table of Responses can be found at any of the locations below. Sector Location on Bank’s Website Banking:  Table of Responses: https://www.central-bank.org.tt/core￾functions/supervision/banking-sector￾draft-consultation-papers Insurance  Table of Responses: https://www.central-bank.org.tt/core￾functions/supervision/insurance￾sector/draft-and-consultation-papers Bureaux de change  Table of Responses: https://www.central-bank.org.tt/core￾functions/supervision/bureaux-de￾change/draft-consultation-papers Payment System Providers and E-money Issuers  Table of Responses: https://www.central-bank.org.tt/core￾functions/financial-stability/payments￾systems under “Draft and Consultation Documents” Any questions or queries regarding the listed documents should be submitted electronically to cyberguides@central-bank.org.tt. We thank you for your input in finalizing this important Guideline and look forward to receiving your first self-assessment by March 31, 2024. Yours sincerely Patrick Solomon INSPECTOR OF FINANCIAL INSTITUTIONS