Registered with the Ministry of Justice of the Kyrgyz Republic

On 22 October 2004. Registration number 117-04

Approved

by resolution of the Board

of the National Bank

of the Kyrgyz Republic

of 15 September 2004 No. 24/10

STANDARDS

for Ensuring Information

Security of Institutions of the Banking System

of the Kyrgyz Republic

Introduction

Scope
Normative references
Terms and definitions
Symbols and abbreviations
Initial conceptual scheme of information
security of institutions of the BS KR
Basic principles of ensuring information
security of institutions of the BS KR

6.1. Basic principles of secure functioning of
institutions

6.2. Special principles of ensuring information
security of institutions

Models of threats and violators of information
security of institutions of the BS KR
Information security policy of institutions of the BS KR

8.1. Composition and purpose of the information
security policy of institutions of the BS KR

8.2. General (basic) requirements for ensuring
information security reflected in the information security policies of an institution

Management of information security of institutions
of the BS KR
Levels of management of information security of
institutions of the BS KR
Audit and monitoring of information security of
institutions of the BS KR
Directions for developing the standards

Annex A. Term systems used in the document

Annex B.

Annex C.

Annex D.

Introduction

Institutions of the banking system (BS) of the KYRGYZ REPUBLIC (KR) include the National Bank of the Kyrgyz Republic, commercial banks, the Settlement-Savings Company, as well as branches and representative offices of foreign banks, to which these standards apply.

These organizations are institutions of the banking system of the KYRGYZ REPUBLIC (institutions of the BS KR). Development and strengthening of the BS KR, as well as ensuring the efficiency, security and reliability of the banking and payment system of the KR, are tasks of the National Bank of the Kyrgyz Republic. The most important condition for achieving these tasks is ensuring the necessary and sufficient level of information security (IS) of institutions of the BS KR, their assets (including information assets), which is largely determined by the information security of banking technological processes (payment, information, etc.), automated banking systems (ABS), etc.

The specific features of banking systems are such that negative consequences of failures in the operation of individual institutions can lead to rapid development of a systemic crisis of the payment system of the KR, causing damage to the interests of owners and clients. In cases of IS incidents, the risk of possible damage to institutions of the BS KR sharply increases. Therefore, for institutions of the BS KR, threats to information assets, that is, IS threats, represent a real danger.

To counter such threats and ensure the effectiveness of measures to eliminate the adverse consequences of IS incidents (their impact on operational, credit and other risks), institutions of the BS KR should ensure the necessary and sufficient level of IS. It is also necessary to preserve this level over a long period of time. For these reasons, ensuring IS is for institutions of the BS KR one of the fundamental aspects of their activity.

Activities related to ensuring IS must be strictly controlled. In this regard, the National Bank of the Kyrgyz Republic, being responsible for the implementation of the goals of its activity, is a firm supporter of regular assessment of the level of IS in institutions of the BS KR, assessment of risks and adoption of measures necessary to manage these risks.

Proceeding from this, these standards for ensuring IS of institutions of the BS KR have been developed.

Main goals of the standards for ensuring IS of institutions of the BS KR:

increasing trust in the BS KR;
increasing the stability of functioning of institutions of the BS KR and, on this basis, the stability of functioning of the BS KR as a whole;
achieving adequacy of measures to ensure IS of institutions of the BS KR to their real threats;
preventing and/or reducing damage from IS incidents.

Main tasks of the standards for ensuring IS of institutions of the BS KR:

establishing uniform requirements for ensuring IS of institutions of the BS KR;
increasing the effectiveness of measures to ensure and maintain IS of institutions of the BS KR.

The document was developed by the Information Protection Division of the National Bank of the Kyrgyz Republic and is introduced for the first time.

Scope

This document applies to institutions of the banking system of the KYRGYZ REPUBLIC (institutions of the BS KR) and establishes provisions (policies, requirements, etc.) for ensuring information security in institutions of the banking system of the KYRGYZ REPUBLIC.

Normative references

This document has been developed taking into account the following international standards and documents:

ISO/IEC 15408-2002 Information technology. Security techniques. Evaluation criteria for IT security.
ISO/IEC 12207-99 Information technology. Software life cycle processes.
ISO/IEC TR 15271-2002 Information technology. Guide for the application of ISO/IEC 12207 (Software life cycle processes).
ISO/IEC 17799-2000 Information technology. Code of practice for information security management.
ISO/IEC 13335 Information technology. Security techniques. Guidelines for the management of IT security.
ISO 13569 Banking and related financial services. Information security guidelines.
ISO/IEC 18044 Information technology. Security techniques. Information security incident management.
ISO/IEC 15288-2002 Information technology. Life cycle management. System life cycle processes.
ISO/IEC 15504-98 Information technology. Software process assessment.

Terms and definitions

In this document, the following terms with corresponding definitions are used in alphabetical order. In Annex A to this document, these and related concepts are presented grouped in accordance with the general principles of constructing term systems and taking into account their significance:

3.1. automated banking system: A system consisting of personnel and a complex of means for automating its activity, implementing banking information technology for performing established functions.

3.2. assets of institutions of the banking system of the KYRGYZ REPUBLIC: Everything of value to institutions of the banking system of the KYRGYZ REPUBLIC from the point of view of achieving its goals.

Note - The assets of institutions of the banking system may include:

banking resources (financial, human, computing, telecommunications, etc.);
information assets, including various types of banking information (payment, financial-analytical, official, management, etc.) at the following phases of their life cycle: generation (creation), processing, storage, transmission, destruction;
banking processes (banking payment technological processes, banking information technological processes, life cycle processes of automated banking systems, etc.);
banking products and services provided to clients.

3.3. audit of information security of institutions of the banking system of the KYRGYZ REPUBLIC: A periodic, independent of the audit object and documented process for obtaining audit evidence and objectively evaluating it in order to establish the degree of fulfillment of established requirements for ensuring information security and standards for auditing information security of institutions of the banking system of the KYRGYZ REPUBLIC.

Notes:

Internal audits ("first-party audits") are conducted by the institution itself or on its behalf for management review or other internal purposes of the institution.
External audits include "second-party audits" and "third-party audits". Second-party audits are conducted by parties interested in the activity of the institution, for example, consumers or other persons on their behalf. Third-party audits are conducted by independent external audit organizations.

3.4. authentication of an electronic message: The process of establishing the authenticity and integrity of an electronic message.

3.5. banking information technology: Techniques, methods and ways of using computer technology in performing the functions of storage, processing, transmission and use of financial or other information related to the functioning of institutions of the banking system of the KYRGYZ REPUBLIC.

3.6. banking technology: A set of methods of activity and processes in the banking sector, as well as a scientific description of methods of activity.

Note: Depending on the type of activity, the following are distinguished: banking information technological process, banking payment technological process, etc.

3.7. banking information technological process: Part of the banking technological process containing operations on non-payment information necessary for the functioning of institutions of the banking system of the KYRGYZ REPUBLIC.

Note: Non-payment information necessary for the functioning of institutions of the banking system may include statistical reporting and internal economic activity data, analytical, financial, reference information.

3.8. banking payment technological process: Part of the banking technological process containing settlement, accounting, cash and other banking operations on payment information related to the movement of money from one account to another, opening (closing) accounts or monitoring these operations.

Note: Payment information may include payment (settlement) messages and information related to the conduct of settlement, accounting, cash and other operations.

3.9. banking technological process: A technological process containing operations for changing and (or) determining the state of banking information used in the functioning or necessary for banking products, banking services of the functioning of institutions of the banking system of the KYRGYZ REPUBLIC.

Notes:

Operations on banking information may be performed manually or be automated, for example, with the help of complexes of automation means of automated banking systems.
Operations on banking information require specifying the roles of their participants (executors and persons making decisions or having authority to change technological processes, including personnel of automated systems).

3.10. information security of institutions of the banking system of the KYRGYZ REPUBLIC: The state of protection of the interests (goals) of institutions of the banking system of the KYRGYZ REPUBLIC in the information sphere.

Note: The information sphere is a set of information, information infrastructure, subjects carrying out the collection, formation, dissemination and use of information, as well as a system for regulating the relations arising in this process.

3.11. information assets of institutions of the banking system of the KYRGYZ REPUBLIC: Assets of institutions of the banking system of the KYRGYZ REPUBLIC that are of value to it from the point of view of achieving goals and are related to its information sphere.

3.12. information security incident: An actual, attempted or probable violation of information security.

Note: A violation may be caused either by human error, or by malfunction, or by natural factors (for example, fire or flood), or by deliberate malicious actions, or by a violation of confidentiality, integrity, availability, accountability or non-repudiation, affecting a system, service and/or network and their components.

3.13. key of the electronic message authentication code: Unique data used in creating and verifying the electronic message authentication code.

3.14. electronic message authentication code: Data used to establish the authenticity and control the integrity of an electronic message.

3.15. monitoring of information security of institutions of the banking system of the KYRGYZ REPUBLIC: Operational and continuous observation of the objects of monitoring of ensuring information security in institutions of the banking system of the KYRGYZ REPUBLIC, collection, analysis and generalization of observation results for specified goals.

Notes:

The object of monitoring, depending on the goals, may be an automated banking system or its part, information banking technological processes, information banking services, etc.
The goals of information security monitoring are determined by the information security management service of institutions of the banking system.

3.16. conformity assessment of information security of institutions of the banking system of the KYRGYZ REPUBLIC: Any activity related to the direct or indirect determination that the relevant information security requirements in institutions of the banking system of the KYRGYZ REPUBLIC are met.

3.17. levels of management of information security processes of institutions of the banking system of the KYRGYZ REPUBLIC: A scheme for measuring the maturity of information security management processes of institutions of the banking system of the KYRGYZ REPUBLIC.

3.18. management of information security of institutions of the banking system of the KYRGYZ REPUBLIC: A set of purposeful actions carried out with the aim of reducing risk to an acceptable level for institutions of the banking system of the KYRGYZ REPUBLIC in the information sphere.

Notes:

The set of actions includes assessment of the situation and state of the object of management (for example, risk assessment and management), selection of control actions and their implementation (planning, implementation and maintenance of protective measures (information security controls)).
The information sphere is a set of information, information infrastructure, subjects carrying out the collection, formation, dissemination and use of information, as well as a system for regulating the relations arising in this process.

3.19. establishment of authenticity and integrity of a message: Verification of an electronic message that allows establishing that the message comes from the specified source and was not changed during its transmission.

Symbols and abbreviations

BS - banking system;

KR - Kyrgyz Republic;

ABS - automated banking system;

IS - information security;

OS - operating system;

DBMS - database management system;

UAS - unauthorized access;

LC - life cycle;

CM - computing machine;

LAN - local area network;

CCIS - cryptographic information protection facility;

EDS - electronic digital signature;

AC - authentication code.

Initial conceptual scheme of information security of institutions of the BS KR

5.1. The initial conceptual scheme of information security of institutions of the BS KR is based on the confrontation between the owner((1) see note) and the violator((2) see note) for control over information assets. However, other, non-malicious actions are also within the scope of consideration of this document.

In the case when the violator causes damage by establishing control over information assets, both of the institution of the BS KR itself and over clients who have entrusted their own assets to it.

5.2. The greatest opportunities for causing damage to an institution of the BS KR are possessed by its own personnel. An external violator most likely may have an accomplice inside the institution.

5.3. The owner practically never knows about a impending attack; it is always unexpected. Attacks, as a rule, are local and specific in place, purpose and time.

5.4. However, the violator studies the object of attack, as a rule, not only theoretically, without revealing himself in any way, but also practically, by experiment, selecting "picklocks" to the institution's IS system. Thus, he works out the most effective method of attack. Therefore, the owner must constantly strive to identify traces of such activity. For this purpose, the owner creates an authorized body - its own IS service (subdivisions (persons) in the institution responsible for ensuring IS) or entrusts protection to an external firm (outsourcing).

5.5. However, it is difficult and resource-intensive, and therefore ineffective, to search for traces of such activity everywhere and to tune one's IS system based on the fact. Therefore, the owner's main tool is a forecast of the threat model and violator model compiled and based on experience.

The more accurate the forecast is made (the threat model and violator model are compiled), the lower the risks of IS violation in an institution of the BS KR with minimal resource expenditures.

5.6. The most correct and effective way to achieve a minimum level of risks of IS violation for the owner is to develop, on the basis of an accurate forecast, an IS policy and, in accordance with it, build an IS system.

5.7. The IS policy of institutions of the BS KR is developed taking into account the specific features and interests of a particular owner.

5.8. Compliance with IS measures is to a significant extent an element of corporate ethics; therefore, the level of IS in an institution of the BS KR is seriously influenced by relations both within the collective and between the collective and the owner or the management of the institution representing the owner's interests. Therefore, these relations must be managed.

5.9. Any protective measures, for a number of objective reasons, tend to weaken over time, as a result of which the overall level of IS may decline. This inevitably leads to an increase in IS risks.

To prevent this, it is necessary to conduct constant monitoring and audit of the IS system of institutions of the BS KR and timely take measures to maintain the effectiveness of the IS system at the required level.

5.10. Far from every owner has the potential to compile an accurate forecast (threat model and violator model). Such a forecast can and should be compiled taking into account the experience of leading specialists of the banking system, as well as taking into account international experience in this sphere. The basic IS requirements of institutions of the BS KR should be developed analogously.

5.11. The strategy for ensuring IS of institutions of the BS KR, therefore, consists in using a developed IS system operating according to an existing plan and countering attacks by violators. In the case of the realization of threats not envisaged by the plan, an additional action plan must be used that allows minimizing possible losses. For example, the loss of databases is easily compensated by their regular copying to a backup computer protected from the impact of similar threats.

Basic principles of ensuring information security of institutions of the BS KR

The principles of ensuring IS set forth constitute the basis for developing the information security policy of institutions of the BS KR.

6.1. Basic principles of secure functioning of institutions:

6.1.1. Timeliness of problem detection. The institution must timely detect problems inside and outside that could potentially affect its business goals.

6.1.2. Predictability of problem development. The institution must identify the cause-and-effect essence of the identified problems and, on this basis, build an accurate forecast of their development.

6.1.3. Assessability of the impact of problems on business goals. The institution must adequately assess the degree of impact of the identified problems on its business goals.

6.1.4. Adequacy of the choice of protective measures. The institution must choose protective measures adequate to the threat and violator models.

6.1.5. Effectiveness of implementation of protective measures. The institution must effectively implement the adopted protective measures.

6.1.6 Use of experience in making and implementing decisions. The institution must accumulate, generalize and use both its own experience and the experience of other organizations at all levels of decision-making and their execution.

6.1.7. Continuity of implementation of the principles of secure functioning. The institution must ensure continuity in space and time of the implementation of the principles of secure functioning.

6.2. Special principles of ensuring information security of institutions:

6.2.1. Certainty of goals. The IS goals of institutions must be clearly defined. Uncertainty leads to "blurriness" of the organizational structure, personnel roles, IS policies and the impossibility of assessing the adequacy of the adopted protective measures.

6.2.2. Knowledge of one's clients and employees. The institution must know its clients and employees, carefully select them, develop and maintain corporate ethics, which creates a favorable trusting environment for the institution's activity in managing assets.

6.2.3. Personification and adequate separation of roles and responsibility. The responsibility of officials of the institution for decisions related to its assets must be personified and exercised primarily in the form of accountability. It must be adequate to the degree of influence on the goals of institutions, recorded in policies, controlled and improved.

6.2.4. Adequacy of roles to functions and procedures and their comparability with criteria and the evaluation system. Roles must adequately reflect the functions performed and the procedures for their implementation adopted in the institution. When assigning interrelated roles, the necessary sequence of their execution must be taken into account. A role must be coordinated with the criteria for evaluating the effectiveness of its execution. The main content and quality of the role performed is actually determined by the evaluation system applied to it.

6.2.5. Availability of resources in space and time. At any moment, any necessary resource of the institution must be available for use. For this, resources should, as far as possible, be evenly distributed in the institution taking into account their significance for achieving goals. Unevenness of distribution must be compensated by the protective measures applied. Possible concentration of critical resources must be balanced by fully accessible access to them and measures increasing reliability and disaster resistance.

6.2.6. Observability and assessability of ensuring IS. Any protective measures proposed by the information security service must be arranged so that the result of their application is clearly observable and could be assessed.

Models of threats and violators of information security of institutions of the BS KR

7.1. The threat and violator models (IS forecast) must be the main tool of the institution's management when deploying, maintaining and improving the IS system of institutions.

7.2. The activity of institutions of the BS KR is supported by the information infrastructure included in it, which ensures the implementation of banking technologies and can be represented as a hierarchy of the following main levels:

physical (communication lines, hardware, etc.);
network (network hardware: routers, switches, hubs, etc.);
network applications;
operating systems (OS);
database management systems (DBMS);
banking technological processes;
business processes of institutions.

7.3. At each of the levels, threats and their sources (including intruders), methods and means of protection and criteria for assessing effectiveness are different.

7.4. The main goal of an intruder is to gain control over assets at the business process level. A direct attack at the business process level, for example, by disclosing confidential banking analytical information, is more effective for the intruder and more dangerous for the owner.

An attack carried out through lower levels requires greater and specific experience, knowledge and resources (including time) and is therefore less effective in terms of the "cost/result obtained" ratio.

7.5. Assets - objects of protection in an institution of the BS KR, depending on the volume of banking operations performed, business priorities and its goals, may be:

automated banking systems;
information banking resources and products (financial information, information on account status, payment information, banking analytical information, electronic banking regulations, etc.);
intra-bank official information (technological and management information of automated banking systems, etc.) at the following phases of its life cycle: generation (creation), processing, storage, transmission, destruction;
banking (payment and information) technological processes of creation, collection, processing, accumulation, storage, retrieval and dissemination of banking information;
banking services (products) provided to clients, for example, remote banking services, provision of information banking products to users, etc.

7.6. The institution must determine specific objects of protection at each of the levels of the information infrastructure.

7.7. The most relevant sources of threats at the physical, network levels and the level of network applications are:

external (viruses; intruders: hackers((3) see note), phreakers((4) see note); etc.), carrying out unauthorized access (UAA);
internal, implementing threats within the framework of their powers and beyond them (personnel having access rights to hardware, including network hardware, network application administrators, etc.);
combined sources of threats: external and internal, acting in collusion.

7.8. The most relevant sources of threats at the levels of operating systems, database management systems, banking technological processes are:

internal, implementing threats within the framework of their powers and beyond them (OS administrators, DBMS administrators, users of banking applications and technologies, IS administrators, etc.);
combined sources of threats: external and internal, acting in collusion((5) see note).

7.9. The most relevant sources of threats at the business process level are:

internal sources, implementing threats within the framework of their powers and beyond them (authorized users and operators of ABS, representatives of the institution's management, etc.);
combined sources of threats: external (for example, competitors) and internal, acting in collusion.

7.10. Sources of threats use vulnerabilities of objects and the protection system to implement a threat.

7.11. A good practice is the development of threat and IS intruder models for a given institution.

The IS threat model includes a description of sources of threats, vulnerabilities used by threats, methods and objects of attacks suitable for implementing the threat, types of possible loss (for example, confidentiality, integrity, availability of assets), scales of potential damage.

For human sources of threats, an IS intruder model may be developed, including a description of their experience, knowledge, available resources necessary to implement the threat, and possible motivation for their actions.

The degree of detail of the parameters of threat and IS intruder models may vary and is determined by the real needs for each institution individually.

7.12. When analyzing IS threats, it is necessary to proceed from the fact that these threats directly affect the operational (exploitation) risks of the institution's activities. Operational risks affect the business processes of the institution.

7.13. Operational risks are generated by the following operational factors: technical malfunctions, erroneous (accidental) and/or intentional malicious actions of the institution's personnel, its clients during their direct access to the institution's ABS, and other factors.

7.14. The most effective way to minimize IS violation risks for the owner is the development of an IS assurance system in accordance with the IS policy of institutions of the BS KR, developed, among other things, on the basis of threat and IS intruder models.

Information security policy of institutions of the BS KR

8.1. Composition and purpose of the information security policy of institutions of the BS KR

8.1.1. The owner (and/or management) of the institution must ensure the development and adoption of the IS policy of institutions of the BS KR, including the allocation of resources required for the implementation of this policy.

8.1.2. The IS policy must describe the goals and objectives of the IS assurance system and define a set of rules, requirements and guiding principles in the field of IS that guide the institution in its activities.

8.1.3. Persons responsible for the implementation of the IS policy must be appointed.

8.2. General (basic) requirements for ensuring information security reflected in the information security policies of the institution

8.2.1. Development of general requirements for ensuring information security for institutions of the BS KR

8.2.1.1. IS requirements must be interconnected into a continuous complex in terms of tasks, subsystems, levels and stages of the life cycle.

8.2.1.2. IS requirements must define the content and goals of the activities of institutions of the BS KR within the framework of IS management processes.

8.2.1.3. These requirements must be formulated for the following most important areas:

DB management;
management of AS maintenance;
personnel management;
stages of the ABS life cycle;
protection against UAA of access control and logging;
anti-virus protection;
use of Internet resources;
use of cryptographic information protection tools;
protection of banking payment and information technological processes.

8.2.2. Main tasks of the information security assurance system of the BS KR

8.2.2.1. To achieve the main goal of protecting information and its processing system, the security system must ensure effective solution of the following tasks:

protection from interference in the functioning of the IS by unregistered persons (only users registered in the established order must have the ability to use the automated system and access its resources);
differentiation of access of registered users to hardware, software and information resources (the ability to access only those resources and perform only those operations with them that are necessary for specific users to perform their job duties);
protection against unauthorized access:
to information circulating in the BS KR;
to computer equipment;
to hardware, software and cryptographic protection tools;
registration of user actions when using protected resources in system logs and periodic monitoring of the correctness of user actions of the system by analyzing the contents of these logs;
integrity control (ensuring immutability) of the program execution environment and its restoration in case of violation;
protection against unauthorized modification and integrity control of used software tools, as well as protection of the system from the introduction of unauthorized programs, including computer viruses;
protection of restricted-distribution information from leakage via technical channels during its processing, storage and transmission via communication channels;
protection of restricted-distribution information stored, processed and transmitted via communication channels from unauthorized disclosure or distortion;
ensuring authentication of users participating in information exchange (confirmation of authenticity of the sender and recipient of information);
ensuring the functioning of cryptographic information protection tools in case of compromise of part of the key system;
timely identification of sources of information security threats, causes and conditions contributing to damage to interested subjects of information relations, creation of a mechanism for rapid response to information security threats and negative trends;
creation of conditions for minimizing and localizing damage caused by unlawful actions of individuals and legal entities, weakening the negative impact and eliminating the consequences of information security violations;
provision by a complex of technical and procedural protection measures against unauthorized access from users of Internet networks.

8.2.3. Main ways to achieve protection goals

8.2.3.1. The main protection goals set and the solution of the tasks listed above are achieved by:

strict accounting of all system resources subject to protection (information, tasks, communication channels, servers, automated workstations, etc.);
regulation of processes of processing information subject to protection using automation tools and actions of employees of structural subdivisions using the IS, as well as actions of personnel performing maintenance and modification of software and technical means, on the basis of organizational and administrative documents on information security issues;
completeness, real feasibility and consistency of requirements of organizational and administrative documents on information security issues;
appointment and training of officials (employees) responsible for organizing and implementing practical measures to ensure information security and its processing processes;
granting each employee (user) the minimum access rights to IS resources necessary for them to perform their functional duties;
clear knowledge and strict compliance by all employees using and maintaining hardware and software with the requirements of organizational and administrative documents on information security issues;
personal responsibility for their actions of each employee participating within the framework of their functional duties in the processes of automated information processing and having access to IS resources;
implementation of technological processes of information processing using complexes of organizational and technical measures for the protection of software, hardware and data;
use of physical and technical (software and hardware) means of protecting system resources and continuous administrative support for their use;
differentiation of information flows, providing for the prevention of higher confidentiality level information getting onto media and into files with a lower confidentiality level, as well as prohibiting the transmission of restricted-distribution information over unprotected communication channels;
effective control over compliance by employees with information security requirements;
conducting constant analysis of the effectiveness and sufficiency of the measures taken and the information protection tools used, development and implementation of proposals for improving the information protection system.

8.2.4. Regulation of employee access to the use of information resources

8.2.4.1. Within the framework of the authorization system for access, it must be established: who, to whom, what information and for what type of access can provide and under what conditions. The access differentiation system, which must involve determining for all users of the AS the information and software resources available to them for specific operations (read, write, modify, delete, execute) using specified software and hardware access tools.

8.2.4.2. Employee access to work with the AS and access to its resources must be strictly regulated. Any changes in the composition and powers of users must be made in the established procedure, fixed in regulatory documents.

8.3.4.3. The main users of information are employees of structural subdivisions. The level of powers of each user is determined individually, observing the following requirements:

open, confidential information must be placed on different servers (this simplifies the provision of protection);
each employee uses only the rights prescribed to them in relation to the information with which they need to work in accordance with job duties;
the manager has the right, within established limits in accordance with their job duties, to view official information of their subordinates in their absence;
the most critical technological operations must be performed according to the "two-man rule" or "four-eyes control" rule - the correctness of the entered information is confirmed by another official who does not have the right to enter information.

8.2.4.4. All employees authorized to work (users) must bear personal responsibility for violations of the established procedure for automated information processing, rules for storage, use and transfer of protected system resources at their disposal.

8.2.4.5. Processing of protected information in subsystems must be carried out in accordance with approved technological instructions (technical procedures) for these subsystems.

8.2.5. Regulation of database maintenance processes and modification of information resources

8.2.5.1. All operations for maintaining databases and employee access to work with these databases must be strictly regulated (must be performed in accordance with approved technological instructions). Any changes in the composition and powers of database users must be made in the established procedure.

8.2.5.2. Distribution of names, generation of passwords, maintenance of rules for differentiating access to databases is assigned to special users - database administrators, system administrators and application administrators.

8.2.6. Regulation of maintenance processes and modification of hardware and software resources of the IS

8.2.6.1. All hardware and software resources of the IS must be categorized in the established procedure (for each resource the required level of protection must be determined). System resources subject to protection (tasks, programs, AWS) are subject to strict accounting (based on the use of appropriate forms or specialized databases).

8.2.6.2. The hardware and software configuration of automated workstations on which protected information is processed (from which access to protected resources is possible) must correspond to the range of functional duties assigned to users of this AWS. All unused (excess) input-output devices (COM, LPT ports, floppy disk drives, CD from other storage media, etc.) on such AWS must be disabled/removed; software and data unused for work on AWS disks must also be removed.

8.2.6.3. To simplify maintenance, servicing and organization of protection, AWS must be equipped with software and configured in a unified manner (in accordance with established rules).

8.2.6.4. Commissioning of new AWS and all changes in the configuration of technical and software means must be carried out only in the established procedure.

8.2.6.5. All software (developed by bank specialists or purchased from manufacturers) must undergo testing in the established procedure. Only software tools obtained in the established procedure must be installed and used in subsystems. The use of unaccounted software must be prohibited.

8.2.6.6. Development of software for tasks (task complexes), testing of developed and purchased software, transfer of software into operation must be carried out in accordance with the established procedure for development, testing and transfer of tasks (task complexes) into operation.

8.2.7. Ensuring and controlling physical integrity (immutability of configuration) of hardware resources

8.2.7.1. Necessary technical protection means must be installed on all AWS subject to protection (corresponding to the category of AWS data).

8.2.7.2. Units and blocks of computer equipment to which access by maintenance personnel is not required during operation, after adjustment, repair and other work related to access to their wiring diagrams, must be closed and sealed (stamped) by employees responsible for information protection. The fact of opening sealed computer blocks must be recorded.

8.2.7.3. Daily monitoring of the integrity and correspondence of seals/stamps on computers must be carried out by AWS users, and in case of violation they are obliged to inform information security administrators (those responsible for the security of information of subdivisions).

8.2.8. General requirements for ensuring information security when assigning and distributing roles and on personnel security

8.2.8.1. A role is a predefined set of rules establishing permissible interaction between a subject, for example, an employee of an institution, and a certain object, for example, a software and hardware tool.

For the effective fulfillment of the institution's goals and asset management tasks, appropriate roles of the institution's personnel must be identified and defined. Roles should be personalized with the establishment of responsibility for their performance. Responsibility must be fixed in job descriptions.

8.2.8.2. When defining roles for employees of an institution of the BS KR, it is necessary to take into account the goals of the institution, available resources, functional and procedural requirements, criteria for assessing the effectiveness of implementing the rules for a given role.

8.2.8.3. It is not allowed for one personal role to fully reflect a goal, for example, to include all rules required for the implementation of a business process. It is not permissible to combine in one person (in any combination) the roles of execution, administration or control, for example, executor and administrator, administrator and controller or other combinations.

8.2.8.4. The role must be provided with resources necessary and sufficient for its performance.

8.2.8.5. Roles must be grouped and interact so that the organizational structure corresponds to the goals of the institution. The role of one of the heads of the institution (authorized manager, senior manager, etc.) must include the task of coordinating the timeliness and quality of performance of employee roles to achieve the institution's goals.

8.2.8.6. Improper performance of the rules for assigning and distributing roles creates vulnerabilities.

8.2.8.7. To control the quality of compliance with IS requirements, roles for IS assurance must be identified and defined in the institution.

8.2.8.8. When hiring, the identity of the person and the declared qualifications, accuracy and completeness of biographical facts, and availability of recommendations must be verified.

8.2.8.9. Persons who are supposed to be hired for work related to protected assets or operations should be subject to verification in terms of professional skills and assessment of professional suitability. It is necessary to perform control checks of already working employees regularly, as well as unscheduled when facts of their non-standard behavior or participation in IS incidents are revealed.

8.2.8.10. All personnel, as well as representatives of external organizations when concluding contracts for the provision of services, must sign agreements on confidentiality (an example of the obligation is given in Appendix B), commitment to the rules of corporate ethics, including requirements for preventing conflicts of interest((6) see note). At the same time, the condition of confidentiality must extend to all official information entrusted to the employee or representative of an external organization in the course of their performance of official duties, or which became known to them in the course of work.

8.2.8.11. All personnel must be competent to perform their functions. Personnel competence should be ensured through IS training processes, personnel awareness in the field of IS and periodic verification of the level of competence.

8.2.8.12. Personnel duties to comply with IS requirements should be included in contracts (Appendix B).

8.2.9. General requirements for ensuring information security of automated banking systems at the stages of the life cycle

8.2.9.1. IS of ABS must be ensured at all stages of the life cycle (LC) of ABS automating banking technological processes, taking into account all parties involved in the LC processes (developers, customers, suppliers of products and services, operating and supervisory subdivisions).

8.2.9.2. When ordering ABS, it is recommended to determine the LC model (LC stages, work stages and LC processes performed at these stages) in accordance with the document ISO/IEC 15288, or using another analogous standard.

8.2.9.3. Development of technical specifications, design, creation and testing and acceptance of ABS protection means and systems must be carried out in agreement with the subdivisions (persons) in the institution of the BS KR responsible for ensuring IS.

8.2.9.3. Creation, commissioning, operation, decommissioning of ABS in terms of IS issues must be carried out under the control of the subdivision (persons) in the institution responsible for ensuring IS.

8.2.9.4. At the stages related to the development of ABS (determination of requirements of interested parties, requirements analysis, architectural design, implementation, integration and verification, delivery, commissioning), the developer must ensure protection against threats:

incorrect formulation of requirements for ABS;
selection of an inadequate ABS LC model, including inadequate selection of LC processes and participants involved in them;
adoption of incorrect design decisions;
introduction by the developer of defects at the level of architectural decisions;
introduction by the developer of undocumented capabilities into ABS;
inadequate (incomplete, contradictory, incorrect, etc.) implementation of requirements for ABS;
development of poor-quality documentation;
assembly of ABS by the developer/manufacturer in violation of requirements, which leads to the appearance of undocumented capabilities in ABS or to inadequate implementation of requirements;
incorrect configuration of ABS;
acceptance of ABS that does not meet the customer's requirements;

8.2.9 (continued)

introduction of undocumented capabilities into the ABS during acceptance testing by means of undocumented capabilities of functional tests and IS tests.

8.2.9.5. Specialised organisations engaged on a contractual basis to develop and install ABS protection means and systems must hold licences for this type of activity in accordance with the legislation of the Kyrgyz Republic.

8.2.9.6. When institutions of the BS of the Kyrgyz Republic acquire ready-made ABS and their components from a developer, documentation must be requested containing a description of the protective measures taken by the developer in relation to the threats listed in clause 8.2.3.4.

The developer must also provide documentation containing a description of the protective measures taken by the developer of the ABS and their components in relation to development security, delivery security and operation, life-cycle support, including a description of the life-cycle model and vulnerability assessment. This documentation may be provided within the framework of a declaration of conformity or be the result of a conformity assessment of the product carried out within the framework of the relevant assessment system.

The contract (agreement) for the supply of ABS and their components to institutions of the BS of the Kyrgyz Republic must include provisions for the maintenance of the supplied products for their entire service life. If it is impossible to include these requirements in the contract (agreement), the possibility must be considered of acquiring from the developer a complete set of working design documentation for the product, ensuring the possibility of maintaining the ABS and their components without the developer's participation. If both of these options are unacceptable, for example owing to high cost, the management of the institution of the BS of the Kyrgyz Republic must ensure an analysis of the impact of the threat of inability to maintain the ABS and their components on ensuring business continuity.

8.2.9.7. At the operation stage, four types of high-level threats must be identified:

deliberate unauthorised disclosure, modification or destruction of information;
unintentional modification or destruction of information;
non-delivery or erroneous delivery of information;
denial of service or degradation of service.

8.2.9.8. At the maintenance stage, protection must be ensured against the threats of:

introduction of changes into the ABS leading to disruption of its functionality or to the appearance of undocumented capabilities;
failure by the developer/supplier to introduce changes necessary to support the correct functioning and correct state of the ABS.

8.2.9.9. At the decommissioning stage, protection must be ensured against the threat of incomplete removal of user data and IS support tool data from the permanent memory of the ABS or from external media.

8.2.9.10. IS requirements must be included in all agreements and contracts for the performance of work or provision of services at all stages of the ABS life cycle.

8.2.10. General requirements for ensuring information security in access management and registration

8.2.10.1. When allocating access rights of personnel and clients to the assets of an institution of the BS of the Kyrgyz Republic, one should be guided by the special principle of "knowledge of one's clients and employees" (see 6.2.1), expressed in the following principles:

"know your client" ((7) see note);
"know your employee" ((8) see note);
"need to know" ((9) see note),

and also be guided by the principle of "dual control" ((10) see note).

8.2.10.2. The ABS must use certified or authorised-for-use means of protecting information from unauthorised access (UA).

8.2.10.3. The institution must ensure:

operation of a password protection system for electronic computing machines (ECM) and local area networks (LAN). It is recommended to organise a centralised password protection service for the generation, distribution, change and deletion of passwords, the development of necessary instructions and control over the actions of personnel working with passwords;
consistent and transparent administrative and technical support for the tasks of managing access to the resources of ECM and/or LAN. The granting/revocation of authority for employee access to ECM and/or LAN resources is authorised by the head of the functional subdivision of the institution, who bears personal responsibility for ensuring IS in that subdivision;
control of user access to ECM and/or LAN resources. Operational control of user access is carried out by the subdivisions (persons) in the institution responsible for ensuring IS;
formation of unique message identifiers and user identifiers (the types of identifiers are determined by the specifics of the particular technological process);
registration of the actions of personnel and users in a special electronic log. This electronic log must be accessible for reading, viewing, analysis, storage and backup only to the IS administrator.

8.2.11. General requirements for ensuring information security by means of antivirus protection

8.2.11.1. Only officially purchased antivirus protection tools must be used in institutions of the BS of the Kyrgyz Republic. Installation and regular updating of antivirus protection tools on automated workstations and ABS servers must be carried out by the ABS administrators.

8.2.11.2. When ensuring antivirus protection, the institution must develop and put into effect antivirus protection instructions that take into account the specifics of banking technological processes. Particular attention must be paid to antivirus filtering of electronic mail traffic.

8.2.11.3. The presence and use in ECM and ABS of software and data not related to the performance of specific functions in the banking technological processes of the institution is not permitted.

8.2.11.4. Software being installed or modified must first be checked for the absence of viruses. After installation or modification of software, an antivirus check must be performed.

8.2.11.5. If a computer virus is detected, work must be suspended, management must be informed and the elimination of the consequences of the virus attack must be organised.

8.2.11.6. Disabling or failure to update antivirus tools is not permitted. Installation and updating of antivirus tools in the institution must be controlled by representatives of the subdivisions (persons) responsible for ensuring IS.

8.2.11.7. Responsibility for compliance with the requirements of the antivirus protection instruction must be assigned to the head of the functional subdivision of the institution, and the duties for implementing antivirus protection measures must be assigned to every employee of the institution who has access to ECM and/or ABS.

8.2.12. General requirements for ensuring information security when using Internet network resources

8.2.12.1. Internet network resources in an institution of the BS of the Kyrgyz Republic may be used only for conducting remote banking services (for example, Internet-banking), for obtaining and disseminating information related to banking activity (by creating information Web-sites), for information-analytical work in the interests of the institution, and also for exchanging mail messages exclusively with external organisations.

Other use of Internet network resources, a decision on which has not been taken by the management of the institution in the established manner, must be regarded as a violation of IS.

8.2.12.2. ECMs by means of which interaction with the Internet network is carried out must be dedicated (from among those in operation in the operating subdivision) and not connected to the internal networks of the institution of the BS of the Kyrgyz Republic.

In institutions of the BS of the Kyrgyz Republic that provide remote banking services to clients, in connection with the increased information security risks when interacting with the Internet network, the corresponding information protection means (firewalls, antivirus tools, etc.) must be used, ensuring the reception and transmission of information only in the established format and only for the specific technology.

8.2.12.3. Mail exchange through the Internet network must be carried out using protective measures.

8.2.12.4. Information obtained from the Internet network and necessary for the bank's activity, including electronic mail, must be archived. The archive must be accessible only to the subdivision (person) responsible for ensuring IS and to the management of the institution.

8.2.12.5. All ECMs by means of which interaction with the Internet network is carried out must not contain any confidential information.

The presence of banking information on such ECMs is determined by the objectives of the institution, taking into account the high probability of unauthorised access, loss and distortion of this information.

8.2.12.6. When interacting with the Internet network, counteraction to hacker attacks must be ensured.

8.2.12.7. The procedure for connecting to and using Internet network resources in an organisation of the BS of the Kyrgyz Republic must be controlled by the subdivisions (persons) responsible for ensuring IS. Any connection to and use of the Internet network must be authorised by the management of the functional subdivision of the institution.

8.2.13. General requirements for ensuring information security when using cryptographic information protection tools

8.2.13.1. Cryptographic protection tools:

must allow embedding into the technological scheme for processing electronic messages, ensure interaction with application software at the level of processing requests for cryptographic transformations and issuing results;
must be supplied by developers with a complete set of operational documentation, including a description of the key system, the rules for working with it, and also justification of the necessary organisational and staffing support;
must be implemented on the basis of algorithms corresponding to the national standards of the Kyrgyz Republic and/or the standards of the institution or authorised in the territory of the Kyrgyz Republic;
must have a strict key-usage regulation presupposing control by the IS administrator over the user's actions at all stages of working with key information (receipt of the key medium, entry of keys, use of keys and surrender of the key medium);
must ensure the implementation of key-reset procedures in cases of absence of routine user activity in accordance with the key-usage regulation or when the ABS switches to a non-routine operating mode;

8.2.13.2. When using cryptographic information protection tools (CIPT) in the ABS, continuity must be maintained in the processes of logging the operation of the CIPT and ensuring the integrity of the software for all links of the ABS;

8.2.13.3. The IS of the processes of producing key documents of the CIPT must be ensured by a complex of technological, organisational, technical and software measures and protection means.

8.2.13.4. To increase the level of security during the operation of the CIPT and their key systems in the ABS, good practice is:

implementation of an audit procedure that records all significant events that occurred in the process of exchanging electronic messages and all possible IS incidents;
implementation of a risk assessment procedure that allows an reasoned assessment of the situation in each specific case of electronic message exchange;
determination, as a result of the risk assessment, of a key-reset procedure in cases of absence of routine user activity in accordance with the key-usage regulation or when the ABS switches to a non-routine operating mode.

8.2.13.5. The internal procedure for the use of the CIPT in the ABS is determined by the management of the institution and must include:

the procedure for putting into operation;
the procedure for operation;
the procedure for restoring operability in emergency cases;
the procedure for making changes;
the procedure for decommissioning;
the procedure for managing the key system;
the procedure for handling key information media.

8.2.13.6. Keys for authentication codes (AC) and/or electronic digital signature (EDS) must be produced by each participant of the ABS independently. In the case of production of AC and EDS keys for one institution in another institution of the BS of the Kyrgyz Republic, the consent of the first institution to consider this key as its own must be recorded in the contract.

8.2.13.7. These rules apply to all types of software (application and system), hardware and information support of the CIPT.

8.2.14. General requirements for ensuring information security of banking payment technological processes

8.2.14.1. The information security system of the banking payment technological process must comply with the requirements of clauses 8.2.2-8.2.7 of this document and other regulatory documents on information security matters whose effect extends to the banking system of the KYRGYZ REPUBLIC.

8.2.14.2. The following must be considered as objects of protection:

the banking payment technological process;
payment information (note to clause 3.8 of this document);
the technological process for managing the roles and powers of employees of institutions of the BS of the Kyrgyz Republic involved in ensuring the banking payment technological process.

8.2.14.3. The banking payment technological process must be unambiguously defined (reflected) in the normative-methodological documents of institutions of the BS of the Kyrgyz Republic.

8.2.14.4. The procedure for exchanging payment information must be fixed in agreements between the participants carrying out the exchange of payment information. The participants may be institutions of the BS of the Kyrgyz Republic, legal entities and natural persons.

8.2.14.5. No employee of an institution of the BS of the Kyrgyz Republic must possess the full totality of powers for the uncontrolled creation, authorisation, processing, destruction or alteration of payment information. Employees of an institution of the BS of the Kyrgyz Republic engaged in the administration of automated systems and information protection means must not have such a possibility.

8.2.14.6. The results of technological operations performed by an employee of an institution of the BS of the Kyrgyz Republic (an automated process) during the processing of payment information must be checked and certified by another employee of the institution of the BS of the Kyrgyz Republic (an automated process).

8.2.14.7. All computing equipment on which operations on payment information are carried out must be equipped with certified or authorised-for-use means of protection against UA and cryptographic information protection means.

8.2.14.8. The complex of measures to ensure the information security of the banking payment technological process must provide for:

protection of payment information from distortion, falsification, redirection, unauthorised destruction, false authorisation of payment documents;
the minimum necessary, guaranteed access of an employee of an institution of the BS of the Kyrgyz Republic only to those resources of the banking payment technological process that are necessary for him to perform his official duties or exercise the rights provided for by the payment information processing technology;
control (monitoring) of compliance with the established technology for preparing, processing, transmitting and storing payment information;
authentication of the processed payment information;
two-way authentication of automated workstations and participants in the exchange of payment information;
restoration of payment information in the event of its deliberate (accidental) destruction (distortion) or failure of computing equipment;
authorised entry of payment information into automated banking systems by two employees with subsequent software verification of the entry results for coincidence (Dual Control);
reconciliation of outgoing payment messages with the corresponding incoming payment messages;
guaranteed delivery of payment messages to the participants of the exchange.

8.2.15. General requirements for ensuring information security of banking information technological processes

8.2.15.1. The information security system of the banking information technological process must comply with the requirements of clauses 8.2.2-8.2.13 of this document and other regulatory documents on information security matters whose effect extends to the BS of the Kyrgyz Republic.

8.2.15.2. In an institution of the BS of the Kyrgyz Republic, information is classified as:

open information intended for official transmission to external organisations and the mass media;
internal banking information intended for use exclusively by employees of the institution of the BS of the Kyrgyz Republic in the performance of their official duties;
information containing limited-distribution data in accordance with the List approved by the institution of the BS of the Kyrgyz Republic;
limited-distribution information bearing the marking "For official use" and received from other organisations of the Kyrgyz Republic;
information containing data constituting a state secret.

Each type of information corresponds to its own necessary level of protection (its own set of protection requirements).

Since the protection requirements for the last two types of information are determined by state regulatory documents, the issues of ensuring the protection of information containing the said data are not considered in this document. The automated systems of an institution of the BS of the Kyrgyz Republic that process, store and/or transmit such information must be physically isolated from the other automated systems of that institution.

8.2.15.3. The following must be considered as objects of protection:

information resources;
control information of the ABS;
the banking information technological process.

8.2.15.4. An institution of the BS of the Kyrgyz Republic bears responsibility for:

the reliability of information officially provided to external organisations and citizens;
the reliability and fulfilment of the regulation for providing external organisations and citizens with information the obligatory provision and procedure for which are defined by the legislation of the Kyrgyz Republic;
ensuring a level of protection, as required by the legislation of the Kyrgyz Republic, both of its own information and of information officially received from external organisations and citizens.

8.2.15.5. For each ABS, an information security administrator must be appointed by the relevant Order. It is permitted to appoint one information security administrator for several ABS, and also to combine the performance of these functions with other duties.

At the same time, combining in one person the functions of ABS administrator and ABS information security administrator is not permitted.

8.2.15.6. The ABS administrator must not have official powers (and, where possible, technical means) to configure system parameters affecting user powers of access to information. However, he must have the right to add a new user to the system without any powers of access to information, and also to remove such a user from the system.

The ABS information security administrator must have official powers and technical capabilities to control the actions of the corresponding ABS administrators (without interfering in their actions) and users, and also powers (and, where possible, technical means) to configure for each user only those system parameters that determine rights of access to information.

The ABS information security administrator must not have the right to add a new user to the ABS or to remove an existing user from it.

If the information security administrator lacks the technical capabilities to configure ABS parameters affecting user powers of access to information, these settings are performed by the ABS administrator, but with the obligatory prior agreement of the established user rights of access to information with the information security administrator.

8.2.15.7. The processes of preparing, entering, processing and storing information, as well as the procedure for installing, configuring, operating and restoring the necessary technical and software tools, must be regulated and supported by instructive and methodological materials agreed with the information security service.

8.2.15.8. The procedure for periodic testing of all functions (requirements) for ensuring IS implemented by software and technical means, using special software tools, must be carried out and regulated. The regulating documents must be agreed with the information security service.

8.2.15.9. The procedure for restoring the IS system must be carried out and regulated.

9. Information security management of institutions of the BS of the Kyrgyz Republic

9.1. IS management in institutions of the BS of the Kyrgyz Republic includes:

development of an information security policy;
development of technical, organisational and administrative plans to ensure the implementation of the information security policy;
development of normative documents on ensuring IS;
creation of administrative and staffing support for the complex of IS tools in the institution;
ensuring the routine functioning of the complex of IS tools in the institution;
exercise of control (monitoring, audit, etc.) over the functioning of the IS system in the institution;
training for the purpose of supporting (improving) the qualifications of the institution's personnel;
risk assessment.

9.2. To implement these tasks, it is necessary to have within the institution (a stand-alone one, or as part of the security service) an information security service (authorised person). The information security service (authorised person) must be vested with the following powers:

manage all plans for ensuring IS in the institution;
develop and submit proposals for changing the institution's IS policy;
change existing and adopt new normative-methodological documents on ensuring IS in the institution;
select the means of managing and ensuring IS in the institution;
control privileged users;
control activity related to access to and use of antivirus protection tools, and also related to the use of other IS tools;
monitor events related to IS;
investigate events related to IS violations and, where necessary, submit proposals on the application of sanctions against persons who have committed unlawful actions, for example, those who have violated the corporate agreement or the requirements of instructions and manuals on ensuring IS in the institution;
participate in actions to restore the operability of the ABS after failures and accidents;
create, maintain and improve the institution's IS management system.

The IS service must have its own budget.

Good practice is for the institution's IS service to have its own curator at the level of the first person in the management of the institution of the BS of the Kyrgyz Republic (or the Deputy Chairman of the Board). At the same time, the IS service and the informatisation service must not have a common curator.

9.3. The IS management system is implemented by the IS service in the form of a set of interdependent and continuously operating processes (control, monitoring, analysis, etc.) for the routine functioning of the used tools

security measures and proper fulfillment by personnel of the information security requirements imposed on them.

9.4. For the successful functioning of the information security management system and support of the processes operating within it, four main processes must be distinguished: planning of the processes for fulfilling information security requirements, implementation and operation of protective measures, verification of the processes for fulfilling information security requirements and protective measures, and improvement of the processes for fulfilling information security requirements and protective measures. Their implementation must be realized in the form of a continuous cycle - "planning-implementation-verification-improvement-planning-...".

9.5. Planning of the processes for fulfilling information security requirements must include the determination of information security goals and policy, information security requirements and the processes for their implementation. Planning should include the processes of forming information security policy, forming information security requirements, risk assessment, and selection of protective measures. The processes for fulfilling information security requirements must be planned so that they make it possible to select protective measures ensuring the achievement of results in accordance with established information security goals and policies ((11) see note).

9.6. Implementation of protective measures must include the introduction of the selected protective measures (organizational measures, technical means of ensuring information security, etc.) with the help of processes of optimal placement and testing for their compliance with established information security requirements. Operation of protective measures must be carried out in accordance with the processes of their administration and technical maintenance.

9.7. Verification of the processes for fulfilling information security requirements and protective measures must include verification and assessment of the compliance of the processes for fulfilling information security requirements with established information security requirements, as well as verification and assessment of the compliance of the institution's information security with the requirements of this document. Verification and assessment must be performed with the help of information security audit and information security monitoring processes.

9.8. Improvement of the processes for fulfilling information security requirements and protective measures must include the implementation of corrective and preventive actions in relation to the processes for fulfilling information security requirements and protective measures based on the results of assessing the compliance of the implementation of information security processes in the institution. Corrective actions must include processes for determining the causes of non-compliance or the nature of changes in the organization's environment, and adjusting the processes for fulfilling information security requirements and protective measures. Preventive actions must include processes for determining potential causes of non-compliance, as well as implementation of preventive changes.

9.9. The quality of functioning of the information security management system should be assessed by the completeness, adequacy and level of management of the processes it supports.

9.10. The organizational basis of information security management in institutions must be determined by the business goals of the institution in the financial market, the size of the institution, the presence of a branch network and other factors.

For institutions that have a network of branches or regional representative offices, it is necessary to establish appropriate information security units locally, providing them with appropriate resources and a regulatory framework.

Levels of information security management of institutions of the banking system of the Kyrgyz Republic

10.1. Levels of management are a measure of the elaboration of the information security management processes applied within the institution.

10.2. The level of elaboration of information security management processes is determined by how fully and consistently the bank's management is guided by information security principles, implements information security policies and requirements, uses accumulated experience and improves the information security system.

10.3. Levels of management are intended for determining:

the current status of the institution;
the position (rating) of the given institution within the banking system of the Kyrgyz Republic;
directions for further development in accordance with the recommendations of international standards;
the institution's forward-looking goals with respect to improving information security.

10.4. The levels of information security management of an institution in this document are based on six levels - from zero to fifth.

The zero level ("non-existent") characterizes the complete absence of any information security management processes within the institution's activity. The institution is not aware of the existence of information security problems.

The first level ("initial") characterizes the presence of documented evidence of the institution's awareness of the existence of information security problems. However, the information security management processes used are not standardized, are applied sporadically and unsystematically. A general approach to information security management has not been developed.

The second level ("repeatable") characterizes the elaboration of information security management processes to a level where their implementation is ensured by various people solving the same task. However, there is no regular training and drilling in standard procedures, and responsibility is placed on the performer. The management of the institution to a significant extent relies on the knowledge of the performers, which entails a high probability of possible errors.

The third level ("defined") characterizes the fact that the processes are standardized, documented and communicated to personnel through training. However, the procedure for using these processes is left to the discretion of the personnel themselves. This determines the probability of deviations from standard procedures that may go undetected. The procedures applied are not optimal and not sufficiently modern, but are a reflection of the practice used in the institution.

The fourth level ("managed") characterizes the fact that monitoring and assessment of the compliance of the processes used in the institution are ensured. When low effectiveness of the implemented information security management processes is identified, their optimization is ensured. Information security management processes are in a stage of continuous improvement and are based on good practice. Means of automation of information security management are used partially and to a limited extent.

The fifth level ("optimized") characterizes the elaboration of information security management processes to the level of best practice based on the results of continuous improvement and comparison of the level relative to other institutions. Protective measures in the institution are used in an integrated manner, providing a basis for improving information security management processes. The institution is capable of rapid adaptation to changes in the environment and business.

10.5. The levels of information security management of an institution are oriented toward assessing the information security management processes specified in section 9 of this document and assessing the fulfillment of basic information security requirements in the institution.

10.6. The levels of information security management processes for institutions capable of ensuring the quality provision of the basic set of banking services are levels not lower than the fourth.

10.7. Taking into account the composition of information security management processes, the fourth level is characterized by the following main indicators:

regulatory and administrative documentation on information security has been developed (information security policy, personnel job descriptions, etc.);
an organizational structure for information security management has been created. Responsibilities for ensuring information security are clearly defined and put into effect. These responsibilities are an object of management;
financing of information security is carried out under a separate line in the institution's budget;
there is an appointed curator of the information security service;
acquisition of the necessary information security means is carried out;
protective measures (technical, technological, organizational) are built into the automated banking system and banking technological processes. In the process of implementing protective measures, cost-benefit analysis is used;
analysis of information security breach risks, as well as possible negative impacts, is consistently performed;
brief sessions on information security matters are mandatory;
personnel certification on security matters has been introduced;
checks for the possibility of intrusion into the automated banking system are a standardized and formalized process;
assessment of the institution's compliance with information security requirements is carried out;
identification, authentication and authorization of users have been standardized. Protective measures are improved taking into account the practical experience accumulated in the institution;
the level of standardization and documentation of information security management processes allows an information security audit to be conducted to a sufficient extent;
information security processes are coordinated with the security service;
information security reporting is linked to business goals;
the management of the institution understands information security problems and participates in solving them through the appointed curator of the information security service from among the institution's senior management.

10.8. Levels should be assessed for each of the information security management processes implemented in the institution, the composition of which is determined by the institution's goals, its organizational structure, etc.

10.9. Based on the results of assessing each of the information security management processes, an overall final rating of the institution must be formed.

The contribution of the level of processes to the overall rating of the institution should be taken into account in accordance with the rating of the process in ensuring the achievement of information security management goals.

A low level of one information security management process may negatively affect the overall rating of the institution. For example, if the level of the control process (monitoring or audit) of the institution's information security management system is assessed as low - zero, first or second - then the overall rating of the institution cannot exceed the level of this process.

Audit and monitoring of information security of institutions of the banking system of the Kyrgyz Republic

11.1. Information security audit of institutions of the banking system of the Kyrgyz Republic may be internal or external. The procedure and frequency of conducting an internal information security audit of the institution as a whole (or of its individual structural subdivisions) or of the automated banking system is determined by the management of the institution on the basis of the needs for such activity. External information security audit is conducted by independent auditors.

11.2. The purpose of an information security audit of an institution is to verify and assess its compliance with the requirements of this document and other information security regulatory acts adopted in the institution. Information security audit must be conducted periodically. External information security audit of an institution of the banking system of the Kyrgyz Republic must be conducted at least once a year.

11.3. When conducting an information security audit of an institution, standard procedures of documentary verification, questioning and interviews with the management and personnel of the institution must be used. If it is necessary to clarify the results of documentary verification, questioning and interviews, within the framework of an internal information security audit an "on-site check" may be used as an additional method, which is conducted to provide assurance that specific protective measures are implemented, correctly used and verified through testing. The circumstances under which an additional method is required within the framework of an internal information security audit must be defined and agreed upon in the information security audit plan of the institution.

11.4. When conducting an internal information security audit, information security incident logs maintained by the institution's information security services and generated on the basis of information security monitoring data may be used.

11.5. Information security monitoring must be conducted by the institution's personnel responsible for information security in order to detect and register deviations of protective measures from information security requirements and to assess the completeness of implementation of the provisions of the information security policy, instructions and manuals for ensuring information security in the institution.

The main goals of information security monitoring in an institution are operational and continuous observation, collection, analysis and processing of data for specified goals determined by the information security management system in the institution. Such analysis goals may be:

control over the implementation of the provisions of regulatory acts on ensuring information security in the institution;
identification of known emergency (or malicious) actions in the institution's automated banking system;
identification of potential information security violations.

For the purposes of operational and continuous observation of monitoring objects, both specialized (for example, software) tools (agents) and paid tools (included in commercial products and systems) for registering the actions of users, processes, etc. may be used.

11.6. When conducting an external information security audit, the management of the institution must provide documentary and, if necessary, technical confirmation that:

a) the information security policy reflects the requirements of the business and the goals of the institution;

b) an organizational structure for information security management has been created;

c) the processes for fulfilling information security requirements are executed and satisfy the set goals;

d) protective measures (for example, firewalls, physical access control means) are configured and used correctly;

e) residual risks are assessed correctly and remain acceptable to the institution;

f) the information security management system corresponds to a certain level of information security management;

g) the recommendations of previous information security audits have been implemented.

11.7. The audit report must be kept in the institution for the established time. Access to the audit report must be permitted only to the management of the institution and the heads of the subdivision (persons) responsible for information security in the institution.

Directions for the development of the standards

The implementation of the provisions of this document is ensured by the relevant manuals, methodological guidelines and the information security assessment system in institutions of the banking system of the Kyrgyz Republic.

The provisions of this document may be refined and expanded on the basis of proposals received from the institution that developed this document or from other institutions using the document in practical activity.

These proposals must be approved by the National Bank of the Kyrgyz Republic, and may be included in the document.

Appendix A

Term systems used in the document

(informative)

A.1 Information security of institutions of the banking system

A.1.1 information security of institutions of the banking system of the KYRGYZ REPUBLIC: The state of protection of the interests (goals) of an institution of the banking system in the information sphere.

Note: The information sphere is a combination of information, information infrastructure, subjects that collect, form, disseminate and use information, as well as the system for regulating the relations arising thereby.

A.1.2 organization: A legal entity which owns, has economic management over or operational management of separate property and is liable for its obligations with this property, may, in its own name, acquire and exercise property and personal non-property rights, bear obligations, be a plaintiff and a defendant in court.

A.1.3 banking system of the KYRGYZ REPUBLIC: The National Bank of the Kyrgyz Republic, commercial banks, the Settlement-Savings Company, as well as branches and representative offices of foreign banks.

A.1.4 safety: Absence of unacceptable risk.

A.1.5 security of the KYRGYZ REPUBLIC: The state of protection of the vitally important interests of the individual, society and the state.

A.1.6 information safety: The state of protection of information processed by means of computer technology or an automated system from internal or external threats.

A.1.7 information security of the KYRGYZ REPUBLIC: The state of protection of its national interests in the information sphere, determined by the totality of balanced interests of the individual, society and the state.

A.1.8 information: Data about persons, objects, facts, events, phenomena and processes, regardless of the form of their presentation.

A.1.9 risk: The combination of the probability of causing harm and the severity of that harm.

A.1.10 acceptable risk: A risk which in a given situation is considered acceptable under existing social values.

A.1.11 probability: A measure of the chance that an event may occur.

Note: Mathematical definition of probability: "a real number in the interval from 0 to 1 relating to a random event". The number may reflect the relative frequency in a series of observations or the degree of confidence that some event will occur. For a high degree of confidence, the probability is close to one.

A.1.12 harm: Physical damage or other injury to people's health, property or the environment.

A.1.13 management of information security of an institution of the banking system of the KYRGYZ REPUBLIC: A combination of purposeful actions carried out with the aim of reducing risk to an acceptable level for an institution of the banking system of the KYRGYZ REPUBLIC in the information sphere.

Notes:

The combination of actions includes assessment of the situation and state of the object of management (for example, risk assessment and management), selection of control actions and their implementation (planning, introduction and maintenance of protective measures (means of information security management)).
The information sphere is a combination of information, information infrastructure, subjects that collect, form, disseminate and use information, as well as the system for regulating the relations arising thereby.

A.1.14 assessment of conformity of information security of an institution of the banking system of the KYRGYZ REPUBLIC: Any activity connected with direct or indirect determination that the relevant information security requirements in an institution of the banking system of the KYRGYZ REPUBLIC are fulfilled.

A.1.15 information security audit of an institution of the banking system of the KYRGYZ REPUBLIC: A periodic, independent of the object of audit and documented process for obtaining audit evidence and objectively evaluating it in order to establish the degree of fulfillment of established requirements for ensuring information security and standards for information security audit of an institution of the banking system of the KYRGYZ REPUBLIC.

Notes:

Internal audits ("first-party audits") are conducted by the institution itself.
External audits include "second-party audits" and "third-party audits". Second-party audits are conducted by parties interested in the institution's activity, for example, consumers or other persons on their behalf. Third-party audits are conducted by external independent audit organizations.

A.1.16 Levels of management of information security management processes of an institution of the banking system of the KYRGYZ REPUBLIC: A scheme for measuring the elaboration of information security management processes of an institution of the banking system of the KYRGYZ REPUBLIC.

A.1.17 monitoring of information security of an institution of the banking system of the KYRGYZ REPUBLIC: Operational and continuous observation of the objects of monitoring of ensuring information security in an institution of the banking system of the KYRGYZ REPUBLIC, collection, analysis and generalization of observation results for specified goals.

Notes:

The object of monitoring, depending on the goals, may be an automated banking system or its part, information banking technological processes, information banking services, etc.
The goals of information security monitoring are determined by the information security management service of an institution of the banking system.

A.2 Banking technologies and technological processes

A.2.1 banking technology: A system of methods, techniques and practices of activity in the banking sector.

A.2.2 banking technological process: A technological process containing operations for changing and (or) determining the state of banking information used in the functioning of, or necessary for, banking products and banking services of an institution of the banking system of the KYRGYZ REPUBLIC.

Notes:

Operations on banking information may be performed manually or be automated, for example, with the help of complexes of automation means of automated banking systems.
Operations on banking information require specification of the roles of their participants (performers and persons making decisions or having authority to change technological processes, including personnel of automated systems).

A.2.3 banking payment technological process: Part of the banking technological process containing settlement, accounting, cash and other banking operations on payment information related to the movement of money from one account to another, opening (closing) accounts or control over these operations.

Note: Payment information may include payment (settlement) messages and information related to the conduct of settlement, accounting, cash and other technological operations.

A.2.4 banking information technological process: Part of the banking technological process containing operations on non-payment information necessary for the functioning of an institution of the banking system of the KYRGYZ REPUBLIC.

Note: Non-payment information necessary for the functioning of an institution of the banking system may include statistical reporting and internal economic activity data, analytical, financial and reference information.

A.2.5 automated banking system: A system consisting of personnel and a complex of means of automating their activity, implementing banking information technology for performing established functions.

A.2.6 banking information technology: Techniques, methods and ways of using computer technology in performing the functions of storage, processing, transmission and use of financial or other information related to the functioning of an institution of the banking system of the KYRGYZ REPUBLIC.

A.2.7 technology: A system of interrelated methods, techniques and practices of a subject-matter activity.

A.2.8 process: A set of interrelated and interacting types of activity that transforms inputs into outputs.

Notes:

The inputs to a process are usually the outputs of other processes.
Processes in an institution are, as a rule, planned and carried out under managed conditions for the purpose of adding value.
A process in which confirmation of the conformity of the final product is difficult or economically inexpedient is often classified as a "special process".

A.2.9 technological process: A process containing purposeful actions to change and (or) determine the state of the object of labor.

Notes:

A technological process may relate to a product, its component part, or to methods of processing, shaping and assembly.
Objects of labor include blanks and products.

A.2.12 automated system: A system consisting of personnel and a complex of means of automating their activity, implementing information technology for performing established functions.

Notes:

1. Depending on the type of activity, the following types of automated systems are distinguished, for example: automated control systems (ACS), computer-aided design systems (CADS), automated scientific research systems (ASRS), and others.

10. Depending on the type of managed object (process), ACS are divided, for example, into ACS for technological processes (ACS TP), ACS for enterprises (ACS E), etc.

A.2.13 information technology: Techniques, methods and ways of using computer technology in performing the functions of storage, processing, transmission and use of data.

A.2.14 system: A set (combination) of material objects (elements) of any, including differing, physical nature and information objects interacting with each other to achieve a common goal, possessing a systemic property (properties), i.e. a property that none of the elements and none of the subsets of elements possesses under any method of division. The systemic property is not directly derivable from the properties of the elements and parts.

Appendix A (continued)

A.2.15 complex of automation means of an AS: The aggregate of all components of an automated system, except people.

A.3 Risk and information security incident of institutions of the banking system of the KYRGYZ REPUBLIC

A.3.1 information security incident: An actual, attempted or probable violation of information security.

A.4 information security of an institution of the banking system of the KYRGYZ REPUBLIC: The state of protection of the interests (goals) of an institution of the banking system in the information sphere.

Note: The information sphere is the aggregate of information, information infrastructure, subjects carrying out the collection, formation, dissemination and use of information, as well as the system for regulating the relations arising in this connection.

A.5 risk of an information security incident of an institution of the banking system of the KYRGYZ REPUBLIC: The combination of the probability of causing damage and the severity of that damage from an actual, attempted or probable violation of the state of protection of the interests (goals) of an institution of the banking system in the information sphere.

A.6 violation of information security of an institution of the banking system of the KYRGYZ REPUBLIC: An event causing damage to the state of protection of the interests (goals) of an institution of the banking system in the information sphere.

A.7 damaging event: An event in which a dangerous situation leads to damage.

A.8 dangerous situation: Circumstances in which people, property or the environment are exposed to danger.

A.9 danger: A potential source of occurrence of damage.

Note: The term "danger" may be made more specific as regards the nature of the danger or the type of expected damage (for example, danger of electric shock, danger of destruction, traumatic danger, toxic danger, fire danger, danger of drowning).

A.10 residual risk: Risk remaining after protective measures have been taken.

A.11 protective measure: A measure used to reduce risk.

A.12 risk analysis: The systematic use of information to identify danger and to quantify risk.

A.13 risk evaluation: A procedure based on the results of risk analysis that establishes whether the tolerable risk has been exceeded.

A.14 risk assessment: The overall process of risk analysis and risk evaluation.

A.15 tolerable risk: Risk which in a given situation is considered acceptable under existing social values.

A.16 risk management: Actions carried out to implement decisions within the framework of risk management.

Note: Risk management may include monitoring, reassessment and actions aimed at ensuring compliance with adopted decisions.

A.17 risk management: Coordinated actions for the direction and management of an institution in respect of risk.

Note: Usually risk management includes risk assessment, risk treatment, risk acceptance and risk communication.

A.18 risk treatment: The process of selecting and implementing measures to modify risk.

Notes:

The term "risk treatment" is sometimes used to denote the measures themselves.
Risk treatment measures may include avoiding, optimizing, transferring or retaining risk.

A.19 risk acceptance: The decision to accept a risk.

Note: Risk acceptance depends on risk criteria.

A.20 risk communication: The exchange of information about risk or the sharing of this information between the decision-maker and other interested parties.

Note: The information may concern the existence, nature, form, probability, severity, acceptability, measures or other aspects of risk.

A.21 risk optimization: A process related to risk, aimed at minimizing negative and maximizing positive consequences and, accordingly, their probability.

Notes:

From the point of view of security, risk optimization is aimed at reducing risk.
Risk optimization depends on risk criteria taking into account cost and legislative requirements.

A.22 risk transfer: Sharing with another party the burden of losses or the benefits from a risk.

Notes:

Legislative or mandatory requirements may restrict, prohibit or mandate the transfer of a certain risk.
Risk transfer may be effected by insurance or other agreements.
Risk transfer may create a new risk or modify an existing risk.
Moving the source is not a transfer of risk.

A.23 risk retention: Acceptance of the burden of losses or the benefit from a specific risk.

Note - risk retention does not include risk treatment as a result of insurance or transfer of risk by other means.

A.24 risk criteria: Rules by which the significance of risk is assessed.

Note - Risk criteria may include associated cost and benefits, legislative and mandatory requirements, socio-economic and environmental aspects, concerns of interested parties, priorities and other costs of assessment.

A.25 risk reduction: Actions taken to reduce the probability, negative consequences or both together, associated with a risk.

A.26 interested party: Any individual, group or organization that can affect a risk, be affected by it or feel itself to be affected by a risk.

Notes:

The decision-maker is also an interested party.
An interested party includes a stakeholder, but has a broader meaning than a stakeholder.

A.27 stakeholder: A person or group of persons interested in the activity or success of an institution.

Examples: consumers, owners, employees of the institution, suppliers, bankers, associations, partners or society.

A.28 Information assets of an institution of the banking system of the KYRGYZ REPUBLIC

A.28.1 information assets of an institution of the banking system of the KYRGYZ REPUBLIC: Assets of an institution of the banking system of the KYRGYZ REPUBLIC that represent value for it from the point of view of achieving its goals and that relate to its information sphere.

A.28.2 assets of an institution of the banking system of the KYRGYZ REPUBLIC: Everything that represents value for an institution of the banking system of the KYRGYZ REPUBLIC from the point of view of achieving its goals.

Note: The assets of an institution of the banking system may include:

banking resources (financial, human, computing, telecommunication, etc.);
information assets, including various types of banking information (payment, financial-analytical, official, managerial, etc.) at the following phases of their life cycle: generation (creation), processing, storage, transmission, destruction;
banking processes (banking payment technological processes, banking information technological processes, life-cycle processes of automated banking systems, etc.);
banking products and services provided to clients.

A.28.3 assets: Everything that has value for an institution.

A.28.4 resource: An object that is used or has been used during the execution of a process.

Notes:

A resource may include various objects such as personnel, maintenance facilities, capital equipment, tools, and public utility enterprises such as electricity, water, fuel and communication infrastructure.
Resources may be reusable, renewable or consumable.

A.28.5 process: A set of interrelated and interacting types of activity that transforms inputs into outputs.

Notes:

The inputs to a process are usually the outputs of other processes.
Processes in an institution are, as a rule, planned and carried out under controlled conditions for the purpose of adding value.
A process in which confirmation of the conformity of the final product is difficult or economically inexpedient is often referred to as a "special process".

A.28.6 value: Property, money, intangible goods, as well as their properties or relations.

A.28.7 product: A set of software, software-hardware and/or hardware IT tools providing certain functional capabilities and intended for direct use or inclusion in various systems.

A.28.8 service: Actions of subjects (owners and holders) to provide users with products.

Appendix B

appendix to the labour contract

(reference)

""___ 20___

Institution, represented by the Head, acting on the basis of the document on the Institution and the requirements of the "Regulation on Ensuring the Preservation of Restricted-Distribution Information in the Institution", and citizen:

(surname, name, patronymic)

acting on his own behalf, hereinafter referred to as the parties, have concluded this contract as follows:

I, ______

(surname, name, patronymic)

being informed that by the nature of my service activity and official duties I will be granted access to restricted-distribution information in the Institution, undertake voluntary obligations:

not to disclose restricted-distribution information that will be entrusted to me (will become known to me) in the course of service;
not to transmit to third parties and not to disclose publicly restricted-distribution information, without the corresponding sanction (permission) of the management;
to fulfil the requirements of orders, instructions and regulations relating to me on the protection of restricted-distribution information;
in the event of an attempt by unauthorized persons to obtain restricted-distribution information from me, to immediately report this fact to the management of my subdivision;
to preserve restricted-distribution information of third-party organizations with which the Institution is bound by contractual relations;
not to use knowledge of restricted-distribution information for engaging in any activity that may cause damage to the interests of the Institution;
in the event of my dismissal, to hand over, on the instruction of the head of the subdivision, all media containing restricted-distribution information that were in my disposition in connection with the performance of my official duties;
to immediately report to the head of my subdivision any loss or shortage of media containing restricted-distribution information, which may lead to unauthorized dissemination of confidential information.

I undertake to conscientiously fulfil my obligations under this contract.

I have read the "Regulation on Ensuring the Preservation of Restricted-Distribution Information in the Institution".

I have been warned that, in the event of non-fulfilment of the obligations assumed, I may be held liable in accordance with the legislation of the Kyrgyz Republic in force and other normative documents in force in the Institution.

The management undertakes, in the event of granting access to citizen:

(surname, name, patronymic)

to restricted-distribution information, to create the necessary conditions for working with such information.

______ "_" ______ 20

(signature of the person who concluded the contract)

Appendix C

Minimum recommended set of normative documents

necessary for building a system for ensuring

information security in an institution of the BS of the KR

Concept for ensuring information security of the Institution.
Information security Policy of the Institution.
Instructions for users on complying with the information security regime of the Institution.
Instructions on the provision and separation of access rights to the information resources of the Institution.
Procedure for backing up and storing information of the Institution.
Instructions on ensuring the security of electronic payments.
Instructions on password protection in the Institution.
Instructions on organizing anti-virus protection in the Institution.
Requirements for the development of a plan for continuous operation and restoration of the operability of the AS of the Institution in crisis situations.
Regulation on ensuring the preservation of restricted-distribution information in the Institution (regulation on commercial secrecy).
Procedure for the admission of unauthorized persons to the facilities of the Institution.
Procedure for the admission of personnel and visitors to the premises of the Institution in which critical information is processed.
Requirements for the process of developing software products in the Institution.
Procedure for acceptance and handover of software in the Institution.
Procedure for conducting confidential negotiations in the Institution.

Appendix D

Stages of implementation of the standards of the National Bank

of the Kyrgyz Republic on ensuring information security

of institutions of the banking system

of the Kyrgyz Republic

| Measures | Deadline |

	of implementation
1. Determination of the level of IS management of an organization	2005
of the BS of the KR.
2. Determination of those responsible for ensuring
information security in an institution of the BS of the KR.
Creation of IS services.
3. Conducting training of specialists of the IS service on
issues of information security.
4. Determination of the security risks of an institution of the BS of the KR.
5. Development of normative documents on issues
of ensuring information security
(Appendix C)(*).
-----------------------------------------------------	---------------
1. Development of a violator model and a threat model	2005-2007
of the security of an institution of the BS of the KR.
2. Development of a set of measures to exclude and
minimize risks in the information systems
of an institution of the BS of the KR.
3. Conducting inspections by external auditors
of the information systems of an institution of the BS of the KR.
4. Creation of a system for ensuring information
security in an institution of the BS of the KR.
5. Allocation of financial resources for ensuring
information security in an institution of the BS of the KR.
-----------------------------------------------------	---------------
1. Conducting training of employees of an institution of the BS of the KR	2005-2007
in the rules of ensuring information security.
2. Recommendations on creating a reserve centre	by 2007
of an institution of the BS of the KR.

(*) The development of normative documents must continue throughout the entire stage of establishing the system for ensuring information security of organizations of the BS of the KR. Previously developed normative documents must be periodically reviewed and, if necessary, revised.

Notes:

(1) In this document, the owner means a subject of economic activity that has the rights of possession, disposal or use of assets and that is interested in or obliged (in accordance with the requirements of laws or other normative legal acts) to ensure the protection of assets from threats that may reduce their value.

(2) In this document, a malicious person means a person who commits or has committed a premeditated act with awareness of its dangerous consequences, or who did not foresee but should have and could have foreseen the possibility of those consequences occurring.

(3) Hacker - a person who is well versed in computers, able not only to write his own programs but also to break into others'; as a rule, hackers break in for interest.

(4) Phreaker: A malicious person who covertly connects with the help of various devices and techniques to telephone networks, providing himself with communication with any point in the world, indicating the number of a legitimate subscriber, who then pays for the telephone services.

(5) At these levels and the level of business processes, the realization of threats by external sources acting independently without the complicity of internal ones is practically impossible.

(6) Conflict of interests means the fact of using one's official position for personal purposes.

(7) "know your client" ("Know your Customer"): a principle used by regulatory bodies to express an attitude towards financial organizations from the point of view of knowledge of their clients' activity.

(8) "know your employee" ("Know your Employee"): a principle demonstrating an organization's concern about employees' attitude to their duties and possible problems, such as abuse of property, fraud or financial difficulties, which may lead to security problems.

(9) "need to know" ("Need to Know"): a security principle that restricts access to information and information-processing resources to those who need to perform certain duties.

(10) "dual control" ("Dual Control"): a principle of preserving the integrity of a process and combating distortion of system functions, requiring that two persons independently perform a certain action before the completion of certain transactions.

(11) For the relevant IS areas (organizational, administrative, technical, etc.), protective measures may be selected on the basis of the recommendations set out in the ISO/IEC 17799 standard, and others.

Standards for Ensuring Information Security of Institutions of the Banking System of the Kyrgyz Republic (Approved by Resolution of the Board of the National Bank of the Kyrgyz Republic No. 24/10 of September 15, 2004)

8.2.9 (continued)

8.2.10. General requirements for ensuring information security in access management and registration

8.2.11. General requirements for ensuring information security by means of antivirus protection

8.2.12. General requirements for ensuring information security when using Internet network resources

8.2.13. General requirements for ensuring information security when using cryptographic information protection tools

8.2.14. General requirements for ensuring information security of banking payment technological processes

8.2.15. General requirements for ensuring information security of banking information technological processes

9. Information security management of institutions of the BS of the Kyrgyz Republic

Appendix A (continued)

A.3 Risk and information security incident of institutions of the banking system of the KYRGYZ REPUBLIC

Appendix B

Appendix C

Appendix D

Lineage: No known changes

Similar documents from other regulators