Lima, 21 May 2021

S.B.S. Resolution No. 1515-2021

The Superintendent of Banking, Insurance and Private Administrators of Pension Funds

WHEREAS:

That, by SBS Resolution No. 504-2021, the Regulation for the Management of Information Security and Cybersecurity was approved; and the Internal Audit Regulation, approved by SBS Resolution No. 11699-2008, the External Audit Regulation, approved by SBS Resolution No. 17026-2010, the Corporate Governance and Comprehensive Risk Management Regulation, approved by SBS Resolution No. 272-2017, the Operational Risk Regulation, approved by SBS Resolution No. 2116-2009, the Credit and Debit Card Regulation, approved by SBS Resolution No. 6523-2013, and the Electronic Money Operations Regulation approved by SBS Resolution No. 6283-2013, were amended;

That the amendments introduced by the aforementioned resolution aim to establish a reference framework for the information security management system and for strengthening cybersecurity capabilities and the authentication processes of companies, taking into account international standards and good practices;

That it has been considered appropriate to incorporate electronic money issuing companies into the group of companies that may request authorization for the application of the Simplified Regime of the Information Security and Cybersecurity Management System (SGSI-C), for which they must submit a report supporting the reasonableness of the request, as well as to establish proportional requirements for general deposit warehouses; and to amend the aspects related to the contracting of a significant data processing service, in order to specify the exit strategy for the services under the provider's responsibility and to amend the deadline for submitting information to the Superintendency regarding the contracted significant data processing service;

That, for the aforementioned reasons, it is necessary to amend the Regulation for the Management of Information Security and Cybersecurity;

With the approval of the Deputy Superintendencies of Banking and Microfinance, of Private Administrators of Pension Funds, of Insurance, of Risks and of Legal Counsel;

In use of the powers conferred in numerals 7 and 9 of
article 349 of the General Law of the Financial System and the Insurance System and Organic Law of the
Superintendency of Banking and Insurance, Law No. 26702 and its amending norms and in use of the exception established in numeral 3.2 of article 14 of the Regulation approved by Supreme Decree No. 001-2009- JUS;

RESOLVES:

Article One.- Amend paragraphs 4.3 and 4.6 of article 4 of SBS Resolution No. 504-2021, as indicated below:

"Article 4. Proportionality of the information security and cybersecurity management system (SGSI-C)

4.3 The provisions described in Chapter II, Subchapter V of this Regulation are mandatorily applicable to the following companies (Simplified Regime):

a) Investment Bank;

b) Insurance and/or Reinsurance Company, not contemplated in paragraph 4.4;

c) Small and Micro Enterprise Development Entity – EDPYME;

d) Fund Transfer Company;

e) Derrama and Caja de Beneficios under the control of the Superintendency;

f) The Financial Corporation of Development –COFIDE;

g) The Fondo MIVIVIENDA S.A.;

h) Bonding and guarantee companies; and

i) El Banco Agropecuario.

4.6. In the event that the companies of the Financial System and the electronic money issuing companies listed in paragraph 4.2 encounter material limitations to comply with the General Regime, they may request authorization for the application of the Simplified Regime of this Regulation, for which they must submit a report supporting the reasonableness of the request, in terms of the size, nature and complexity of their operations, which will be answered by the Superintendency within sixty (60) business days."

Article Two.- Amend paragraphs 24.2 and 24.3 of article 24 of SBS Resolution No. 504-2021, as indicated below:

"Article 24. Significant data processing services

24.2 The company must comply with the following aspects related to the contracting of a significant service provided by third parties for data processing, which includes cloud services, in a manner complementary to the provisions of articles 22 and 23 of this Regulation, as applicable: (…)

c) Have an exit strategy for the services under the provider's responsibility that allows resuming operations on its own account or through another provider. Such strategy must provide, among other aspects, the actions necessary for the migration of information to the company's resources or those of another provider. (…)

Republic of Peru

SUPERINTENDENCY OF BANKING, INSURANCE AND AFP

24.3 The company must inform this Superintendency about the contracted service, the provider
involved, the agreed service levels, the technological infrastructure used, as well as the procedures and responsible parties to comply with literals a) to f), and as applicable g) of the previous paragraph; at most thirty (30) calendar days after starting the provision of data processing."

Article Three.- This Resolution enters into force as of the day following its publication in the Official Gazette El Peruano.

Register, communicate and publish.

MARIA DEL SOCORRO HEYSEN ZEGARRA
Superintendent of Banking, Insurance and AFP