Regulatory Alerts2024-05-09
Added · Updated
Notice on Technology Risk Management for Licensed Credit Bureaus
Licensed credit bureaus must establish a framework to identify critical systems and maintain high availability, ensuring maximum unscheduled downtime does not exceed 4 hours within any 12-month period. Each critical system requires a recovery time objective of no more than 4 hours, with validation and documentation of system recovery testing conducted at least annually. Upon discovering a relevant incident, bureaus must notify the Authority within 1 hour and submit a root cause and impact analysis report within 14 days. Additionally, licensed credit bureaus are required to implement IT controls to protect relevant person information from unauthorized access or disclosure.
Topics
Share