Decision on Information Security of Savings Houses

NATIONAL BANK OF THE REPUBLIC OF MACEDONIA Pursuant to Article 47 paragraph 1 item 6 of the Law on National Bank of the Republic of Macedonia ("Official Gazette of the Republic of Macedonia" No. 158/10, 123/12 and 43/14), Article 68 paragraph 1 item 5 and Article 172 paragraph 2 of the Banking Law ("Official Gazette of the Republic of Macedonia" No. 67/07, 90/09, 67/10, 26/13 and 15/15), the National Bank of the Republic of Macedonia Council adopted the following DECISION on information security of savings houses ("Official Gazette of the Republic of Macedonia" No. 74/15)
I. GENERAL PROVISIONS

This Decision shall set forth the methodology for security of savings
house's information system which establishes standards for information system security, by defining criteria for establishing information security management process and ensuring business continuity.
The terms used in this Decision shall denote the following:
2.1. IT risk shall be the risk of loss for the savings house arising from losing,
unauthorized utilization, or unavailability of information, information assets and/or services it provides.
2.2. Security of the savings house's information system shall be
defined as fulfillment of the following criteria:

Confidentiality: information system is accessible only to authorized users;
Integrity: safeguarding of accuracy and completeness of the information
system;
Availability: unrestricted access to the information system for authorized
users.
2.3. Severe business continuity shall denote any inability of savings house
to meet its business obligations for reasons beyond its control, or when savings house is physically unavailable or its telecommunications fail, i.e. when information and information systems that support critical operations of the savings house are not available.
2.4. Security incident shall be any contingent event that may impair or
jeopardize safety and functionality of the information systems that support savings house's business processes.
2.5. Risk assessment shall be establishment of a continuous process that
includes:
identification and classification of resources of the information system of
the savings house;

analysis of the likelihood for threats and weaknesses of the information
system and identification of potential consequences;
assigning priority to risks depending on the size of any loss for the
savings house.
The savings house shall make a report on the risk assessment referred to in subitem 2.5. This report shall be updated in case of significant changes to the information system.
II. INFORMATION SYSTEM SECURITY MANAGEMENT PROCESS

For the purpose of IT risk management, the savings house shall establish
an information system security management process compatible with the nature, scope and complexity of its financial operations. The information system security management process of paragraph 1 of this item shall encompass:

risk assessment,
information system security policy,
implementation of security controls,
security testing,
monitoring and upgrading.

The savings house shall adopt and implement Information System
Security Policy, defining the foundations of the IT risk management process. The policy under paragraph 1 of this item shall contain at least the following elements:

risk management strategy by establishing an action plan for ensuring
information system security,
annual plan for employee training concerning proper utilization of
services available through the savings house's information system,
management of security incidents and establishment of suitable
mechanism for their identification, reporting and efficient elimination of any threat to the information system security,
defining of the role of the IT officer referred to in item 8 of this
Decision and internal operating procedures, in line with the adopted information technology and information security management regulations,
defining of the role of both internal and external audit from the aspect
of ensuring information system security and its testing,
system for managing end user access that includes process of
recording, identifying, monitoring of user access rights, particularly of administrator and remote access to information system resources,
defining of the method of managing modifications to the information
system and security upgrades,
defining of the method of establishing business continuity plan
referred to in item 10 of this Decision,
manner of establishing anti-virus protection,
defining of the method of telecommunication and ensuring protection
of transferable data,

defining of security zones to restrict any physical access to information
and information resources,
defining of the manner of establishing additional security mechanisms,
such as fire prevention, flood prevention, monitoring, sensors and alarms
data protection as defined in the regulations in the Republic of
Macedonia, and
defining of the manner of using services from software and hardware
outsourcing companies and monitoring of their quality.
For the purpose of efficient application of the policy, i.e. policy elements defined in paragraph 2 of this item, the savings house shall establish appropriate procedures.

The policy under item 4 of this Decision shall contain description of the
administrative, technical and physical security controls and the manner of their application in the savings house. The security controls under paragraph 1 of this item shall be compatible with the size and the complexness of the savings house, as well as with the type of its financial activities.
The savings house shall establish a process of professional, independent
and impartial testing of efficiency and suitability of the implemented security controls defined in the policy under item 4 of this Decision.
The savings house shall define criteria, manner and procedure of
notifying management boards, on information about information system operations and security.
The savings house shall assign IT officer and define their business
responsibilities and scope.
The savings house shall establish security incident management process
to ensure timely and efficient response in case of disturbing the security and operational ability of the information system. In case of highest security incident, the savings house shall notify the National Bank on such incident, its effect and undertaken activities. The savings house shall submit the notification referred to in paragraph 2 of this item to the National Bank within 3 (three) days from the date of the security incident.
III. BUSINESS CONTINUITY PLAN
The savings house shall develop and apply its own business continuity
plan, which will be based on several scenarios and will enable functionality and minimization of the losses in case of long term business process disruption.

4
The plan under paragraph 1 of this item shall contain at least the following elements:

identification of critical operations, including those depending on
outsourcing companies,
identification of alternative mechanisms for business continuity in case of
failure of the primary mechanisms,
identification of possibility of recovery of data necessary for business
continuity,
identification of a remote location for critical business operations and
backup of data. The location shall be at proper distance from the primary location, in order to minimize risk of simultaneous unavailability of both locations. For efficient implementation of the plan under paragraph 1 of this item, the savings house shall establish procedures for proper implementation of the elements defined under paragraph 2 of this item.

The savings house shall periodically test and update the plan under item
10 of this Decision.
IV. CLOSING PROVISIONS
This Decision shall enter into force on the eighth day from the date of its
publication in the Official Gazette of the Republic of Macedonia, and shall apply from 1 January 2016. Section III shall apply from 1 January 2017. D. No. 02-15/IV - 4/2015 30 April 2015 Skopje Dimitar Bogov Governor and Chairman of the Council of the National Bank of the Republic of Macedonia