Technical Standards for Information Security Management

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020
THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:
I. That in accordance with Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System, for the proper functioning of the Financial Supervision and Regulation System, it is required that the members of the financial system and other supervised entities comply with the current regulations and the adoption of the highest standards of conduct in the development of their business, acts, and operations, in accordance with what is established in the aforementioned Law, in other applicable laws, in the regulations, and in the technical standards issued for such effect.
II. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes the entities subject to the supervision of the Superintendence of the Financial System.
III. That in accordance with Article 32, last paragraph, of the Law on Supervision and Regulation of the Financial System, it establishes that, for the purposes of said Law, the members of the financial system may use microfilm, optical discs, magnetic media, electronic media, or any other means that allows archiving documents and information, with the objective of efficiently storing the records, documents, and reports that correspond, including securities.
IV. That in accordance with Article 35, first paragraph and letter d) of the Law on Supervision and Regulation of the Financial System, the directors, managers, and other officials holding positions of direction or administration in the members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management are fulfilled, and among other actions, they must include the measures that will be adopted to prevent possible non-compliance with regulatory requirements and those that will be adopted in the event that they have incurred in them.
V. That in accordance with Article 99, letters a) and g) of the Law on Supervision and Regulation of the Financial System, the Central Bank of Reserve of El Salvador is the institution responsible for the approval of technical standards related to risk management by the supervised entities, as well as those in which the minimum conditions that the premises, their security measures, and the conservation and archiving of documentation of the members of the financial system must meet are defined.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020
VI. That taking as reference international standards which suggest, among other good practice activities, the implementation of an Information Security Governance, so that through it the entities ensure that they manage appropriately the information security of their clients and of the entity itself.
VII. That it is of utmost importance that the entities guarantee that the information they collect, process, and store from their clients is subject to the due confidentiality; is always available for consultation and use by the clients and the entities; and that it is accurate according to the truthfulness of the legal documents from which it was extracted.
VIII. That the speed with which the information systems environment evolves makes it necessary to issue provisions containing the necessary specifications so that the entities have the appropriate technology to perform their functions efficiently.
THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES, to issue the following:

TECHNICAL STANDARDS FOR INFORMATION SECURITY MANAGEMENT

CHAPTER I
OBJECTIVE, SUBJECTS, AND TERMS

Objective
Art. 1.- These Standards have as their objective to establish the minimum criteria for the management of information security and its cybersecurity, in accordance with international best practices, the nature, size, risk profile of the entities, and the volume of their operations.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are the following:
a) Banks constituted in El Salvador, their offices abroad, and their subsidiaries; branches and offices of foreign banks established in the country; b) Companies that, in accordance with the law, integrate financial conglomerates, or that the Superintendence declares as such, which includes both their holding companies and their member companies;

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020 c) Pension fund management institutions and the funds they manage; d) Insurance companies, their branches abroad, and the branches of foreign insurance companies established in the country, and Insurance Cooperative Associations constituted in the country, insofar as it does not contradict their respective Law; e) Stock exchanges, stockbrokerage firms, companies specialized in the deposit and custody of securities, risk classifiers, and agents specialized in the valuation of securities; f) Cooperative banks, savings and credit companies, and federations regulated by the Law on Cooperative Banks and Savings and Credit Companies; g) Mutual guarantee companies and their local guarantors; h) Companies that offer complementary services to the financial services of the members of the financial system, particularly those in which they participate as investors; i) Management companies or operators of payment systems and securities settlement systems; j) The Social Fund for Housing and the National Fund for Popular Housing, insofar as it does not contradict their creation laws nor what is established by the Court of Accounts; k) The Social Insurance Institute of the Armed Forces; l) The Salvadoran Institute of Pensions; (1) m) The Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador, insofar as it does not contradict their creation laws nor what is established by the Court of Accounts; n) Securitization companies and the funds they manage; o) Exchanges of products and services; p) Investment fund managers and the funds they manage; q) Electronic Money Provider Companies; r) Data Information Agencies; s) The Pension Unit of the Salvadoran Social Security Institute; (2) t) The Salvadoran Social Security Institute, the latter with respect to the Public Pension System, the Professional Risks Regime, and technical health reserves; and (2) u) Investment banks, their offices abroad, and their subsidiaries. (2)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Information asset: component that supports one or more business processes and generates value to the entity. Information assets can be of various types, including: data or information, services (processes), computer programs, physical devices, communication networks, information supports, auxiliary equipment, and physical facilities, and intangibles (brands);

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020 b) Senior Management: the Executive President, Executive Director, General Manager, or acting person, and the executive positions that report to them, for the case of the Development Bank of El Salvador, the President; c) Application, program, or computer system: any software used by the entity for the collection, storage, processing, visualization, or transmission of information related to the financial products or services that the entity offers to its clients; d) Central Bank: Central Bank of Reserve of El Salvador; e) Significant change: Corresponds to a change in the business model, mergers, or acquisitions; (1) f) Alternate data center: refers to an installation, separate from the entity's physical infrastructure, with a technological infrastructure that guarantees that critical business operations can continue when the main data center is not available; (1) g) Main data center: set of computer equipment on which operating systems and applications operate that process and store information of the financial products and services that entities offer to their clients; (1) h) Cyber threat or cyber threat: potential occurrence of a situation that could become a cyberattack; (1) i) Cyberattack or cyberattack: organized or premeditated action of one or more agents that use the services or applications of cyberspace or are the target of the same or where cyberspace is the source or tool for the realization of unauthorized access to the entity's information, compromising the security of the entity's information; (1) j) Cyberspace: complex environment resulting from the interaction of people, software, and services on the Internet through technological devices connected to said network, which does not exist in any physical form; (1) k) Cyber risk, cyber risk, or cybersecurity risk: possible negative results derived from failures in the security of technological infrastructure or associated with cyberattacks; (1) l) Cybersecurity: development of technical capabilities to defend and anticipate cyber threats in order to protect and ensure the confidentiality, integrity, and availability of information in cyberspace and which is essential for the operation of the entity; (1) m) Confidentiality: property of information by which it is considered accessible only to those duly authorized and only for the specific and expressly delimited purposes; (1) n) Secure Configuration: process aimed at eliminating an attack vector by patching vulnerabilities and disabling non-essential services; (1) o) Availability: property of information by which it remains organized and accessible for use when required by authorized users; (1) p) Entity: subject obligated to comply with the provisions of these Standards, listed in Article 2 thereof; (1)

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020 q) Event: occurrence or series of occurrences that can be internal or external to the entity, originating from the same cause, that occur during the same period; (1) r) Cybersecurity event: occurrence of a situation that could affect the protection or assurance of the entity's information, infrastructure, or technological platform and applications that are essential to the business; (1) s) Authentication factor: information used to verify the identity of a service or a person; (1) t) Information Security Management: processes by which information security is prevented, detected, and responded to, regardless of its format, including paper documents, digital and intellectual property, and verbal or visual communications; (1) u) Information Security Governance: set of responsibilities and practices that aim to provide strategic direction and ensure that corporate objectives related to information security are achieved, managing it in accordance with international standards, according to the nature, size, risk profile of the entities, and volume of their operations, and verifying that the company's resources are used responsibly for these purposes; (1) v) Information security or cybersecurity incident: one or more specific events, associated with a cyberattack, a possible failure in the information security policy, in the controls, or a previously unknown situation relevant to information security, which has a significant probability of compromising business operations and damaging said security; (1) w) Information: set of organized and understandable data that communicate a message. Information can be printed or digital. In case the information is digital, it can be in formats of any type, such as electronic, optical, or magnetic. Any communication (oral, visual, or written) that could include facts, data, or opinions in any medium or form will also be considered; (1) x) Infrastructure or technological platform: hardware and software components on which information related to financial products and services offered by the entity is collected, processed, transmitted, and stored; (1) y) Integrity: property by which it is safeguarded that information is complete, accurate, and valid; (1) z) ISAE (Information Security for Event Management) or SIEM by its English acronym: information system that provides real-time analysis of security alerts generated by applications, security devices, and network elements, such as, for example, systems for centralizing operating system event logs; (1) aa) Board of Directors: collegial body responsible for the administration of the entity, with supervision, direction, and control functions, or equivalent body. For the case of Cooperative Associations, it will be the Board of Directors, or as defined in its Creation Law; (1) bb) Backup: copy of the original information made in order to have a means for its recovery in case of partial or total loss of these; (1) cc) Information Security Program: set of
plans implemented to preserve and continuously improve information security, based on business requirements and risk analysis; (1)

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020 dd) Provider: Providers that provide technology, information system, infrastructure, or cybersecurity services to entities, to whom access is granted for a determined period of time; (1) ee) Resilience: is the capacity of a mechanism or system to recover its initial state when the perturbation to which it may have been subjected has ceased; (1) ff) Information Security: set of measures that allow safeguarding and protecting information complying with the properties of confidentiality, integrity, and availability of the same, in order that threats do not materialize; (1) gg) Physical security: application of physical barriers and control procedures, as preventive measures and countermeasures against threats to the entity's information assets and information; (1) hh) Logical security: application of barriers and procedures that safeguard access to information and only allow access to authorized persons or services, leaving evidence thereof; (1) ii) Critical services: are the services and activities defined as priorities whose unavailability compromises the existence of the entity; (1) jj) Information Security Management System (ISMS): refers to the design, implementation, and continuous maintenance of a set of policies and processes to effectively manage information security and cybersecurity; (1) kk) Superintendence: Superintendence of the Financial System; (1) ll) Outsourcing of information technology activities, operations, or processes: occurs when the entity entrusts the performance of activities, operations, or processes of information technologies, related to the entity's services or financial products, to a third party, that is, to a natural or legal person distinct from the entity; (1) mm) Cybersecurity Unit (UCIB): unit responsible for monitoring, evaluating, and defending the entity's information systems such as websites, applications, databases, main or alternate data centers, servers, networks, desktops, devices, among others; and (1) nn) Vulnerability: weakness of an asset or control that can be exploited or used by a threat. All those threats that arise from the interaction of systems in cyberspace are taken into account. (1)

CHAPTER II
ROLES AND RESPONSIBILITIES

Information Security and Cybersecurity Function Art. 4.- Entities must have an organizational structure in accordance with their products, services, operations, size, risk profile, and business model, in such a way that clearly delimits the functions, roles, responsibilities, and powers associated with information security and cybersecurity, as well as the levels of dependence and interrelation that correspond to each of the other areas of the entity. Likewise, entities must ensure that all their personnel recognize information security and cybersecurity as one of their responsibilities, applying the necessary confidentiality measures. The information whose security must be preserved will be that which, according to the classification of information assets performed by the entity, requires a security or protection treatment.

Board of Directors Responsibilities
Art. 5.- The Board of Directors or equivalent body will be responsible for establishing adequate governance and management of information security, so it must perform at least the following:
a) Approve the necessary resources for the establishment, implementation, monitoring, and maintenance of information security management, in order to have the appropriate infrastructure, methodology, tactics, and personnel. Likewise, it must appoint a person responsible for managing information security, who will have permanent and direct communication with Senior Management, who in turn will report directly to the Board of Directors. The Board of Directors will record the appointment in the Minutes, which must be sent to the Superintendence no later than ten business days after said appointment; b) Approve the information security program and the ISMS structure; and c) Require Internal Audit to verify the existence and compliance of the ISMS structure.

Senior Management Responsibilities
Art. 6.- To implement information security management in accordance with the Board of Directors' provisions, the Senior Management of the entities must perform at least the following:
a) Support the information security program; b) Promote the continuous improvement of the ISMS and ensure its permanent validity; and c) Support the information security manager in the execution of information security strategies and tactics required, in the event of an unforeseen information security or cybersecurity incident. Senior Management must communicate this directly to the Board of Directors.

Risk Committee Responsibilities
Art. 7.- Entities must have a Risk Committee which will observe what is established in these Standards and in the (NRP-17) approved by the Central Bank, through its Standards Committee.
In matters of information security risk management, the Risk Committee, or acting person, will be responsible for carrying out at least the following:
a) Propose to the Board of Directors the ISMS structure; b) Review, evaluate, and propose for the Board of Directors' approval the information security program and resources, said resources must be separate from the budgets allocated to any other area of the entity; and c) Monitor the management of information security.

Risk Unit Responsibility
Art. 8.- Regarding the management of information security, the Risk Unit, or acting person, must perform the following:
a) Propose to the Risk Committee or acting person, the creation of specialized Committees, areas, or positions for the fulfillment of responsibilities related to the management of information security; and b) Ensure that the management of information security is consistent with the policies and methodologies applied for risk management. Due to its hierarchical position and functions, the designated person or organizational unit must ensure that its reports are made known to the Board of Directors or the instance it delegates.

Specialized Information Security Unit or Area
Art. 9.- Based on its size, nature, and complexity of products, services, and operations, the information security function will be performed by a specialized unit or area of the entity. The specialized unit or area must be independent with respect to business or support areas. The Board of Directors, or equivalent body of the entity, must define the specialized unit or area in information security that will be responsible for designing, implementing, and maintaining an ISMS. Such unit must perform at least the following:
a) Draft and propose to the Risk Committee or acting person, the policies and methodologies for the management of information security; b) Coordinate among the various relevant areas of the entity the administration of the ISMS; c) Ensure effective management of information security; d) Propose a manual of specific information security controls to the Risk Committee for evaluation and validation and subsequently submit it for approval by the Board of Directors; e) Coordinate with the corresponding areas the implementation of information security controls throughout the entity and in outsourced operations or processes, related to information assets according to the entity's classification;

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

f) Design and propose, to the Risk Committee for its evaluation and validation, the metrics that allow for the review and monitoring of information security; g) Develop awareness activities for all personnel on information security; h) Prepare the information security program and propose it to the Risk Committee or its equivalent, for its review and evaluation; i) Evaluate information security and cybersecurity incidents and recommend, to the corresponding instances, preventive and corrective actions, in accordance with internal procedures established by the entity; and j) Inform the Risk Committee of the relevant aspects of information security management for timely decision-making.

In the event that the organizational structure or size of the entity does not allow for the creation of this unit, the corresponding functions may be developed by an administrative unit designated by the Board of Directors, striving to comply with what is provided in these Standards and ensuring objectivity, adequate handling of conflicts of interest, independence of judgment, confidentiality, and access to information. In these cases, the entity will be responsible for having supporting documentation of the reviewed topics, and the entity's Board of Directors will maintain responsibility for the execution of the functions defined in these Standards.

CHAPTER III
ON INFORMATION SECURITY MANAGEMENT

Information Security Management System (ISMS) and information security controls Art. 10.- Entities must establish, maintain, and document an ISMS that is consistent with the Business Continuity Management System and with operational risk management. The minimum activities that entities must perform to develop an ISMS are as follows:
a) Establishment of an ISMS:
i. Specify the scope of the ISMS according to the characteristics of the entity's business, its assets, technology, among others;
ii. Institute an information security and cybersecurity policy in relation to the nature, size, or volume of the entity's business operations;
iii. Identify, analyze, evaluate, and mitigate risks associated with assets, processes, people, projects, and information technology services, through the methodology approved by the Board of Directors, considering the threats and vulnerabilities to which they are exposed, identifying the impacts; and
iv. Define information security controls, duly documented.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

b) Operation of an ISMS:
i. Elaborate and implement a plan through which identified risks will be treated with their respective controls;
ii. Specify how the effectiveness of said controls will be measured;
iii. Establish training and awareness programs for all entity personnel, at least once a year;
iv. Administer the resources that make up the ISMS; and
v. Apply instructions and controls that are effective for the immediate detection and response to information security incidents.
c) Monitoring and Review of the ISMS:
i. Execute periodic reviews of the effectiveness of the ISMS;
ii. Evaluate the defined controls; and
iii. Review the information security program at least once a year and, if pertinent, update said plan.
d) Maintenance and Improvement of the ISMS:
i. Apply the improvements found to the ISMS;
ii. Execute corrective and preventive actions to eliminate or mitigate failures in information security and cybersecurity; and
iii. Timely inform all interested parties of all actions and results of information security management.

Based on their size, nature, and complexity of products, services, and operations, entities may subject their processes to internationally recognized certifications regarding information security.

Logical Security
Art. 11.- For the management of logical security of the information administered, entities must consider at minimum the following:
a) Formal procedures for granting, administering rights, profiles, and roles of privileged accounts and end-user accounts, providers, and clients where applicable to the particular industry, as well as the deactivation of same in cases where required; (1) b) Establish adequate segregation of duties, such that the same person does not have multiple roles or privileges that could endanger information security; c) Reviews at least semi-annually on the rights granted to users and the actual use of rights, prioritizing infrastructure, critical systems, and services, and incorporating into a log the result of the review and actions taken. Said log must include at minimum the following: (1)
i. User accounts or user roles that were affected during the review; (1)

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

ii. Date and time of the review; (1)
iii. User account reviewed; (1)
iv. User roles reviewed; (1)
v. Actions taken; (1)
vi. Full name of the person responsible for carrying out the role review process; and (1)
vii. Person who approved the role authorization; (1)
d) Users must have personal-use authentication factors, such that assigned responsibilities can be followed and identified. Likewise, entities must apply authentication factors for their information assets; e) Permanent controls on computer applications; f) Maintenance, monitoring, and analysis of audit logs; g) Tracking of audit trails and access and use of systems to detect unauthorized activities; h) Controls on remote access that consider at minimum internal users and providers, and controls on access to mobile devices that interact with the entity's technology infrastructure; (1) i) Controls on secure configuration of hardware, software, communication equipment, mobile devices; limiting services, protocols, ports, and users; and (1) j) Establish an inventory of profiles and accounts, which must include user, administrator, and provider accounts, the latter if necessary. Said inventory must contain at minimum the person's name, the business area to which they belong, the username, assigned profile, activation start/end dates, computer systems to which they have access, roles, and active privileges. (1)

The first review referred to in letter c) of this article must be carried out no later than August 11, 2025. Likewise, the first inventory of profiles and accounts referred to in letter j) of this article must be carried out no later than May 5, 2025. (1)

Cybersecurity Function
Art. 12.- For effective management of cybersecurity risk, considering aspects such as structure, size, service channels, transactional volume, number of clients, risk assessment, and services provided, the entity must implement a cybersecurity function, which must comply at minimum with the following:
a) Report to the Board of Directors, the Risk Committee, and Senior Management the results of its management, especially in the identification of cyber threats, results of the effectiveness evaluation of cybersecurity programs, proposals for improvement in cybersecurity matters, and summary of cybersecurity incidents that affected the entity. The periodicity of reports must be at least semi-annually; b) Update permanently and in a specialized manner to be aware of new modes of cyberattacks that could affect the entity, according to the policies established by the entity based on its risk assessment and attending to criteria of reasonableness; c) Propose trainings that members of the Board of Directors, Risk Committee, Senior Management, and others designated by the entity's Board of Directors must regularly receive on topics related to cybersecurity and keep them updated on new cyber threats; d) Monitor and verify compliance with policies and procedures established in cybersecurity matters, without prejudice to those tasks performed by internal audit; e) Advise Senior Management and the Board of Directors on matters they deem necessary regarding cybersecurity so that these latter can follow up and make appropriate decisions in this matter; f) Perform risk analysis to determine the pertinence of hiring or implementing the service of a Cybersecurity Operations Center (UCIB), which can be managed from abroad. The analysis must identify the characteristics of the provider and tools and services to be contracted; considering what is established in Annex No. 1 of these Standards; and g) Propose, to the corresponding instances, cybersecurity budgets.

Without prejudice to the activities that the cybersecurity function referred to in this Chapter must perform, incident response management functions may be disaggregated into different lines of defense established by the entity.

Communication of information security or cybersecurity incidents Art. 13.- The entity must establish notification and communication procedures that contemplate at minimum the following:
a) Information that it will report to Senior Management and the Superintendence, regarding information security and cybersecurity incidents, at the moment it has knowledge of the materialized incident, by the means available to it and that according to its risk analysis, exceed the risk limits approved by the Board of Directors, making a brief description of the incident, which includes the general information available regarding the possible cause and impact and actions executed. Subsequently, the entity, within a maximum period of seven business days after having reported said incident, must submit complete the following documentation: (1)
i. Date and time of occurrence start;
ii. Date and time of occurrence end, if the incident has ended;
iii. Description of the incident;
iv. Causes of the failures;

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

v. Technical diagnosis;
vi. Affected channels;
vii. Downtime;
viii. Impact caused; and
ix. Corrective actions executed and/or action plan to be implemented by that entity to remedy the causes that originated the incident or incidents, as well as to prevent them in the future; and
b) Information that it will report, according to its policies and in a timely manner, to its clients and users of financial products and services affected, regarding cybersecurity incidents that had affected the confidentiality or integrity of their information, as well as the measures adopted to mitigate the incident.

Risk Coverage
Art. 14.- Entities must include in contracts for outsourcing critical services, the relevant measures and obligations for the adoption and compliance with policies for the management of cybersecurity and information security risks. Likewise, periodically verify compliance with the obligations and measures established in said contracts, for which it must implement adequate mechanisms for such purposes.

In the case of entities governed by what is provided in the Law of Acquisitions and Public Administration Contracts, they will carry out this activity without contravening said Law.

In no case must the security of the third party be inferior to that of the client. Therefore, contracts must specify the minimum information security requirements accepted by the entities.

Art. 15.- The entity may evaluate the convenience of having insurance that covers the costs associated with cyberattacks, establishing the periodicity with which it will carry out the evaluation.

Stages of the cybersecurity risk management process Art. 16.- Entities must have a continuous documented process, periodically reviewed, for the management of cybersecurity risks, for which it must contemplate at minimum the following stages:
a) Prevention: Entities must develop and implement adequate controls to ensure information security and cybersecurity management. The prevention function admits the capacity to limit or contain the impact of a possible cybersecurity incident. In this stage, entities must perform at minimum the following:
i. Establish, maintain, and document access controls (logical, physical, and procedural) and identity management under the premise that people can only have access to the resources required by their work, for as long as necessary;
ii. Adopt policies, procedures, mechanisms, and manual or automated tools for the protection of information;
iii. Identify and measure cyber threats that could affect the entity and establish controls for their mitigation;
iv. Have tools or services that allow identifying, logging, and correlating events that alert to anomalies and security incidents that have affected information assets, to implement adequate controls such as an ISAE system;
v. Monitor different sources of information such as websites, blogs, social networks, providers, and communities of interest, with the purpose of identifying possible cyberattacks against the entity;
vi. Inform clients and users of the entity's financial services about recommendations they must adopt for cybersecurity management; and
vii. Identification of critical information assets exposed to cyberspace.
b) Protection and Detection: In this stage, entities must develop and implement appropriate activities to identify, analyze, and control cybersecurity events. The protection and detection function allows for the timely discovery of cybersecurity events and incidents and how to protect against them, for which entities must apply at minimum the following:
i. Adopt procedures and mechanisms to identify, analyze, and mitigate cybersecurity threats and incidents that arise;
ii. Manage computer vulnerabilities of technological platforms that support information assets and are exposed to cyberattacks or internal technological risks, strengthening security links in information services related to financial products or services provided by the entity; and
iii. Perform continuous monitoring of the entity's technological infrastructure, using automated tools and an organizational structure, with the purpose of identifying and mitigating unusual behaviors that could evidence cyberattacks or cybersecurity incidents against the entity.
c) Response: Even with the security measures adopted, entities must develop and implement activities to mitigate incidents related to cybersecurity. To face this situation, entities must perform at minimum the following activities:
i. Establish cybersecurity incident response procedures such as: automatic disconnection of equipment, password changes, updating antivirus signature databases, blocking IP addresses, or any other that the entity determines;
ii. Evaluate network elements to identify other devices that may have been affected;

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

iii. Adopt the necessary mechanisms so that information systems or any other element of the entity's technological infrastructure, apply the appropriate resilience after a cyberattack; and
iv. Preserve digital evidence, if it exists, so that security areas or pertinent authorities can carry out the corresponding investigations; and
d) Recovery and Learning: To carry out this stage, entities must develop and implement appropriate activities to maintain resilience plans and restore any capability or service that has deteriorated due to a cybersecurity incident. Therefore, said entities must at minimum perform the following:
i. Adjust their risk management and information security systems as a consequence of the incidents presented, adopting the controls that are pertinent;
ii. Consider within the business continuity plan the recovery and resumption of operations;
iii. Perform tests of the business continuity plan that simulate the materialization of cyberattacks; and
iv. Socialize, when the entity deems it pertinent, the lessons learned internally and with entities in its financial sector.

Art. 17.- Personnel Security
Entities, where applicable, for the management of information by employees and subcontracted personnel working therein, must consider at minimum the following:
a) Personnel selection processes that include verification of backgrounds, in accordance with current labor legislation; b) Disciplinary processes in case of non-compliance with security policies; and c) Defined procedures in case of personnel termination, including aspects such as revocation of access rights and formal return of assets.

Art. 18.- Physical and Environmental Security of Information Assets Entities must ensure that access is appropriately granted to all information assets and that they are in optimal places and conditions, for which at minimum the following will be considered:
a) Controls to avoid damage or interference to personnel and information assets of the entity and avoid unauthorized physical access; and b) Controls to prevent loss, damage, or theft of information assets, including the protection of equipment and personnel against physical and environmental threats that allow combating latent threats such as fire, water, unusual temperatures, earthquakes, among others.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

Information Asset Inventory and Information Classification Art. 19.- For the information asset inventory and information classification, the entity must perform at minimum the following:
a) Perform and maintain an updated inventory of information assets, considering what is defined in Article 3 letter a) of these Standards and assign responsibilities regarding the protection of said assets; and (1) b) Classify information, in terms of legally established requirements that are applicable, and the critical degree of information for the entity, as well as the appropriate control measures that must be associated with the classifications.

The information referred to in this article must be updated by December 31 of each year, and submitted to the Superintendence no later than January 31 of the following year, by the means established by it. The first submission of this information must be made to the Superintendence no later than May 5, 2025. (1)

Administration of Operations and Communications Art. 20.- Entities must implement an administration of operations and communications of financial services or products offered to clients or users, such that it allows them to have policies and plans for technological infrastructure renewal, and thus be able to mitigate security risks associated with the obsolescence of said infrastructure, for which it will establish at minimum the following:
a) Approved and documented procedures for the operation of computer systems; b) Controls and tests on changes in the operational environment, which includes changes in information systems, technological infrastructure, and procedures; c) Separation of development, testing, and production environments of computer systems; d) Monitoring and supervision of information technology services provided by third parties; e) Administration of processing, storage, and transmission capacity of information, with periodic analysis of these capacities; f) Preventive and detection controls on the use of computer programs of dubious origin, viruses, malware, denial of service, phishing, and other similar; g) Security on protocols, network ports, wireless networks, browsers, storage media, perimeter, and system documentation, exchange of information at internal and external levels, including email provided by the entity as well as personal use, both at local and remote levels, and on electronic channels; h) Backup of audit logs and monitoring of system use; and

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

i) Vulnerability and intrusion tests or evaluations on technology infrastructure components and mitigation of identified security gaps. These must be performed at least once a year and whenever there are changes in the aforementioned infrastructure. These activities may be performed by providers of this type of service and must be documented in accordance with what is provided in Article 29 of these Standards. From the above, a summary of results must be sent no later than ten business days after receiving the provider's report, as well as a remediation plan for the detected vulnerabilities, within a period of thirty business days after the date of submission of the aforementioned summary, detailing the activities to be performed, start and end dates, and responsible parties, according to their criticality. The first submission of the remediation plan must be made no later than December 31, 2025. (1)

Acquisition, development, and maintenance of computer systems Art. 21.- For the administration of security in the acquisition, development, and maintenance of computer systems, the entities, where applicable, must take into account at least the following:
a) Include controls for the entry, access, transmission, processing, and output of information; b) Apply encryption techniques that effectively guarantee the protection of the storage and transport of critical information according to the entity's classification; c) Define controls on the implementation of applications before entering production; d) Control access to the source code of computer systems that are property of the entity; e) Maintain strict and formal change and version control, which will be duly supported by computer systems in the case of complex environments or with a high number of changes; f) Have secure development mechanisms that allow analyzing and correcting existing security vulnerabilities in the entity's computer applications. This type of analysis must be performed throughout the development lifecycle of such applications and establish appropriate correction procedures; likewise, when such systems are in production; and g) Establish a procedure for the secure and controlled installation of software updates, with the objective of preventing vulnerabilities and without affecting the performance of the infrastructure.

Art. 22.- The Board of Directors will resolve on the need to perform replacements, substitutions, or acquisitions, documenting its decision in the corresponding Meeting Minutes.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

For the case of entities governed by the provisions of the Public Procurement Law, this activity will be carried out without contravening said Law. (1) If, as a result of the activities established in Article 10 of these Standards, the entities determine the need to perform substitutions, replacements, or significant changes to main computer systems, whether these are database management systems or applications, or the acquisition of infrastructure and/or computer systems for new operations, products, or financial services that the entity offers to its clients; the corresponding unit or area must present the following information to the Board of Directors or whoever acts on its behalf: (1) a) Technical and financial feasibility study; b) Study of the characteristics of the current platform; c) Potential risks associated with the substitution or replacement of the main computer system; d) Mitigation and contingency mechanisms in case the risks referred to in the preceding letter materialize; e) Advantages and disadvantages associated with the substitution, replacement, or acquisition of the system; f) Justification of the activity to be performed; and g) Analysis and conclusions of the providers' offers. Additionally, the complete information detailed above must be sent to the Superintendency fifteen business days in advance of going into production. (1) Likewise, clients must be notified, 24 hours in advance and through the corresponding digital channel, when such channel or channels used by them are taken offline for scheduled maintenance, indicating the time that will be disabled and the alternative means through which clients can perform banking operations. (1)

Processing, backup, and restoration procedures of information Art. 23.- Entities must have regular backup procedures validated periodically. These procedures must include the necessary measures to ensure that essential information can be recovered in a timely and efficient manner in case of failure in the media or after a disaster. These measures must be consistent with the entity's business continuity strategy. Entities will retain backup information and restoration procedures in a location at a sufficient distance to avoid exposing them to possible events that compromise the operation of the main information processing data center, in such a way that geographical, physical, and environmental threats are mitigated. The distance will be determined according to the risk assessment performed by the entity. Entities must store their information backups, notifying the Superintendency of the specific location where the information of their clients is stored or processed. Such notification must be made 10 business days after operations have begun or when there is a change of location thereof.

Management of information security incidents
Art. 24.- To ensure that security incidents and vulnerabilities are controlled in a timely manner, entities must consider at least the following aspects:
a) Procedures for internal communication and due documentation of information security incidents and vulnerabilities associated with information systems; and b) Established procedures to provide an adequate response to reported security incidents and vulnerabilities.

Location and transfer of the main data center and alternate data center of information Art. 25.- Entities must inform the Superintendency, thirty business days in advance of the start of operations, of the transfer and specific location of their main data center and alternate operations data center, where the information corresponding to the products and financial services offered to their clients is stored and processed, attaching the work plan to carry out these activities including start and end dates, responsible parties for execution, attaching the Minutes Point of the Board of Directors' agreement, as well as the information contained in Article 22 of these Standards. (1) When an entity wishes to locate the main data center or the alternate data center of information outside the country's borders, through the outsourcing of information technology activities or operations, it must demonstrate to the Superintendency compliance with the conditions established in Annex No. 1 of these Standards.

Outsourcing of information technology activities or operations Art. 26.- Entities are responsible for preserving the security of their information, that of their clients, and all information to which they have access, use, process, or store for the development of their operations; therefore, in case they decide to outsource information technology activities or operations, they must verify that the provision of the service complies with the conditions contained in Sections A, B, and C of Annex No. 1 of these Standards.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

The conditions established in Annex No. 1 of these Standards must be documented in a report that entities will send to the Superintendency, with a fifteen business days advance prior to the activity going into production. (1) The conditions described in Section B of Annex No. 1 of these Standards, under which information technology activities or operations will be outsourced, may be established in a standard form contract or a negotiable contract. The aforementioned contract must explicitly state everything concerning the service provided, the confidentiality, information security, processes, systems, technologies that house them, among others. Additionally, that the processing or storage of the outsourced information is effectively isolated at all times, such that there is no communication or connectivity with the information of other clients of the provider. Entities that wish to outsource information technology activities or operations related to financial products and services that they offer will always be ultimately responsible for the integrity, availability, and confidentiality of the information that is accessed, processed, transmitted, and stored in such outsourcing. Likewise, entities must prepare and send, attached to the aforementioned Report, an activity schedule that includes deadlines, responsible parties, and main milestones for the implementation control of the project. (1)

CHAPTER IV
INFORMATION AND CONTROL

Financial Conglomerates
Art. 27.- In the case of financial conglomerates referred to in Chapter I of Title Five of the Banks Law, the information security unit may be the same as that of the controlling bank for entities with similar or complementary business; Pension Fund Administrators will have their own information security unit. With prior consultation with the Board of Directors, the head of the information security unit of the controlling entity or the controlling bank must define the information security program to be used in the companies that make up the financial conglomerates and determine the internal organization of information security, both at the level of the controlling entity and the companies that integrate it, with the objective of ensuring the quality and methodologies used in the information security program. The information security unit of the controlling bank or the holding company must have effective control systems to verify that all companies controlled by a bank or a sole-purpose holding company comply with the policies established by the Board of Directors and local regulations.

Information Privacy
Art. 28.- Entities must adopt measures that ensure the protection and confidentiality of information under their responsibility, such as personal data, and information they receive from their clients, service users, providers, among others; without prejudice to what is established in the current legal framework.

Documentation
Art. 29.- Entities must submit to the Superintendency, within the first one hundred twenty calendar days following the close of each annual fiscal year, as part of a report on the level of compliance with ISMS requirements.
The report must contain at least the following:
a) The strategies and main policies used for the management of information security and cybersecurity; b) Main ISMS requirements achieved; and c) The information security program.
For the case of the Information Security Program, entities must send it to the Superintendency annually and whenever it is modified.

Internal Audit
Art. 30.- The Internal Audit Unit must consider in its annual work plan the evaluation of compliance with the provisions of these Standards.

Technical details of information submission
Art. 31.- The Superintendency will send to the entities, within a maximum period of ninety days following the date of entry into force of these Standards, with a copy to the Central Bank, the technical details related to the submission of the required information. The information requests will be limited to the collection of information as regulated in these Standards.

CHAPTER V
OTHER PROVISIONS AND VALIDITY

Sanctions
Art. 32.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is provided in the Financial System Supervision and Regulation Law.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

Procedures in Process
Art. 33.- Administrative procedures and resources that were pending on the date of validity of these Standards will continue to be carried out in accordance with the regulations under which they were initiated.

Contracting after entry into force
Art. 34.- Entities that, after the date of entry into force of these Standards, wish to acquire computer systems or entrust their development to a third party and that are related to financial products or services of said entity, must comply with what is provided in Article 22, letter c) of these Standards.

Adaptation Plan
Art. 35.- Entities, to comply with the provisions established in these Standards, must submit to the Superintendency an adaptation plan, within one hundred eighty days following the validity of these Standards. Once the plan is submitted, entities must implement it within a maximum period of twenty-four months counted from its submission.

Unforeseen Aspects
Art. 36.- Aspects not foreseen in terms of regulation in these Standards will be resolved by the Central Bank through its Standards Committee.

Validity
Art. 37.- These Standards will enter into force on July 1, 2020.

(1) Modifications to articles 2, 3, 11, 13, 19, 20, 22, 25, and 26 approved by the Central Bank through its Standards Committee, in Session No. CN-02/2025 of March 20, 2025, with validity from April 4, 2025.
(2) Modifications in article 2 approved by the Central Bank through its Standards Committee, in Session No. CN-08/2025, of September 30, 2025, with validity from October 15, 2025.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

Annex No. 1

CONDITIONS FOR OUTSOURCING INFORMATION TECHNOLOGY ACTIVITIES OR OPERATIONS RELATED TO FINANCIAL PRODUCTS AND SERVICES OFFERED BY THE ENTITY

The entity that wishes to outsource information technology activities or operations must verify that the provision of the service complies with the following conditions:

Section A

1. Prior to outsourcing, a risk assessment must be performed to identify risks derived from the services to be contracted (or outsourcing of activities or services) and establish appropriate mitigation mechanisms. The entity must also consider in the evaluations those risks generated as a consequence of the concentration of financial entities with a provider, establishing mitigation mechanisms and actions to be taken if such provider fails, considering, as much as possible, contracting other providers or having other guarantees to mitigate this type of risk, in order to guarantee clients' rights.
2. The evaluation referred to in the preceding number must consider operational risks (including technological and legal), reputational risks, and financial risks.
3. Due identification of the provider:
   a. Regarding the provider: Name or Business Name and business scope, experience, services, clients (legal entities), service periods, among others. b. For the case of a local provider, list of shareholders and main officials, and in cases provided by Law, Sworn Statement signed by the entity confirming the non-existence of conflict of interest between the entity and the provider.
   c. The entity must perform due diligence on said provider regarding its financial solidity, experience in providing the service, reputation, administrative, technical, and operational capabilities in relation to the services to be outsourced. The due diligence performed during the selection process must be documented and reviewed annually; using the most recent information, as part of the monitoring and control processes of the outsourcing of the activity or operation.
   d. Location (country and city) of the provider's facilities where the information technology activities or operations are outsourced. e. Description of the strengths or reasons for the selection of the provider.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

Annex No. 1
4. The entity must identify all service providers in the supply chain and guarantee that the provider's responsibilities can be fulfilled throughout the chain.
5. The entity must guarantee to the Superintendency, when it deems it appropriate, access and availability of data or information related to the outsourced service without restrictions; maintaining in national territory the appropriate mechanisms and the adequate and necessary personnel for such purposes, likewise guaranteeing the conditions for access for internal audit and external audit firms that must perform their evaluations in compliance with the current regulatory framework.
6. The entity must require the service provider to provide a valid sworn statement or certification, indicating that they have an information security management program, business continuity plans, tests developed and test results, likewise verifying the capacity to recover and resume service in case of interruptions.
7. The entity must verify that it can require the service provider to provide valid audit reports associated with the services provided. Such information must be provided, upon request of the Superintendency.

Section B

1. Clearly indicate that the entity has exclusive ownership of all its data or information related to the activity or process to be outsourced; that the provider does not acquire any type of rights or licenses through the contract to use the data or information that the entity provides to it for its own purposes; and that the provider does not acquire and cannot claim any interest in the data or information due to the confidentiality and security that must be maintained regarding them, without prejudice to what is established in Article 133 of the Banks Law.
2. Description of the information technology services or operations planned to be outsourced and the type of information to be processed.
3. Description of the applications planned to be under the provider's charge.
4. Clearly establish the scope of the service, the responsibilities of the entity and its service provider(s), for each service provided.
5. Establish service levels under normal and contingency conditions after an interruption; for the latter, it must be guaranteed that contingency and service continuity plans are established, such that the provider, and subcontractors if any, guarantee compliance with the outsourced activity or operation and that the outsourcing risk is within the level determined as acceptable for the contracting entity.
6. Planned communication procedure between providers and the entity.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

Annex No. 1
7. Conditions regarding the provider's capacity, availability, recovery times, incident resolution, and service hours.
8. The provider's obligation to inform, as much as possible, the entity about any event or situation that could significantly affect the provision of the service.
9. That the provider will promptly correct detected computer vulnerabilities.
10. Definition of control mechanisms, by the entity, in the review and monitoring of services provided, as well as the escalation procedure.
11. Obligation to establish non-disclosure agreements, if applicable, by subcontracted personnel of the provider related to the handling of the entity's information.
12. Provisions on intellectual property and copyright.
13. Confidentiality and protection of information during the contract term and subsequently, in case of termination.
14. Establish encrypted end-to-end communication channels with the service provider.
15. Indemnity agreements to mitigate impacts caused by possible deficiencies in service provision by the provider, according to what is established regarding the agreed service level.
16. For the case where the provider performs subcontracting in the services it is offering to the entity, it must consider operational risks (including technological and legal), reputational risks, and financial risks.
17. When applicable, the provider must state that the information and processing or storage subject to the contract are effectively isolated at all times, such that there is no communication or connectivity with the information of other clients of the subcontracted provider.
18. The provider must clearly indicate to the subcontractor that the entity has exclusive ownership of all its data or information related to the activity or process to be outsourced; that the subcontracted provider does not acquire any type of rights or licenses through the contract to use the data or information that the provider provides to it for its own purposes; and that the subcontracted provider does not acquire and cannot claim any interest in the data or information due to the confidentiality and security that must be maintained regarding them.
19. Guarantee the return and destruction or secure deletion of the information involved in the provision of the service in case the entity requests it or upon termination of the contract, and its treatment, in order to protect clients' rights.

NRP-23
INFORMATION
Approval:
14/04/2020
Validity: 01/07/2020

Annex No. 1

Section C

1. The entity must establish response procedures, which must be transparent, to share information with the Superintendency, seventy-two hours after an information security incident occurs.

2. The entity must ensure that it can terminate the contracted service without undue interruption to its services or operations, or its compliance with the regulatory framework; therefore, it must have exit plans and termination arrangements, all duly documented and tested.

3. That the entity has appropriate policies and procedures to evaluate, administer, and monitor services provided by third parties and to periodically verify their compliance.

4. The entity must establish the processes to be applied in case of resolution, intervention, or liquidation to guarantee that the Superintendency has access to the data or information in the event that such cases materialize.