Banks, other financial firms told to set up round-the-clock cybersecurity centers
BANKS and financial entities must set up round-the-clock centers that will actively monitor and prevent cyber-attacks, as part of the stricter guidelines issued by the central bank to boost cybersecurity measures.
The Monetary Board last week approved a circular covering information security management, which elevates expectations on the safeguards employed by these firms.
“This is to address the growing concerns on the fast-evolving cyber-threats that continue to confront global as well as domestic financial communities,” the Bangko Sentral ng Pilipinas (BSP) said in a statement issued over the weekend.
“If not properly managed, cyber-threats and attacks launched against Bangko Sentral supervised financial institutions (BSFIs) may result in operational, legal, reputational, and systemic risks.”
The new regulations seek to upgrade Circular 808 issued four years ago, which set minimum standards on information technology (IT) risk management. The BSP has been actively beefing up cybersecurity rules, having introduced multi-factor authentication and the creation of internal rules on social media use earlier this year.
The new rules require financial firms to adopt “advanced” controls and countermeasures versus hacking and other digital crimes, and even mandates the creation a 24/7 security operations center to “proactively monitor emerging and highly sophisticated cyber-threats and attacks.”
In general, standards imposed on banks and financial firms will be classified into “simple,” “moderate,” and “complex” exposures to cyber-related threats, which would likewise determine the intricacy of cybersecurity measures required of them. BSFIs with complex IT profile classification have to adopt “advanced cybersecurity tools and processes” such as the monitoring centers.
Cybersecurity should also be a board-level concern by enforcing sound information security governance and culture within an organization.
All financial firms will be given one year to fully comply with the new regulation, the BSP said, although plans of action and timelines will be collected by the regulator by next month. – Melissa Luz T. Lopez
