Cyberattacks: what the BRH requires of banks under Circular 126

As cyberattacks rise, the Bank of the Republic of Haiti (BRH) is reminding the country's banks and other financial institutions that they are bound by IT security rules. Those rules are set by Circular 126, in force since February 1, 2022.

In a public notice on October 19, Governor Ronald Gabriel also stressed that no financial institution is allowed to negotiate with cybercriminals demanding a ransom. After an attack, an institution must activate its contingency and business continuity plan, then strengthen its systems based on the findings of the incident analysis.

A written policy and an independent security officer

The circular first requires an organization. Each institution must have a written IT security policy, updated every year and approved by its board. Banks must also have an IT security committee.

It must appoint an IT security officer who is independent of the IT department and reports to risk management or senior management. It must also train its staff on the risks.

Protecting customer data

The text requires institutions to ensure the availability, integrity, confidentiality and traceability of data. They must classify their information by level of confidentiality, protect against malicious code, secure remote access and control physical access to their server rooms.

When a contractor handles data on a bank's behalf, it is the bank's job to check that the contractor follows these rules.

A tested backup plan

Each institution must prepare, test and maintain a contingency plan to keep operating in all circumstances. It must have a backup IT site far from the main one, and backups that are checked regularly so no data is lost. A backup power supply is also required.

An audit every three years

The security of the IT system must be audited at least every three years. An institution that fails to do so faces a fine of 200,000 gourdes, and the BRH can order the audit at the institution's expense. If it does not fix the problems found, the fine is 100,000 gourdes a day.

In early October, Capital Bank closed its branches for several days after an IT incident. The LockBit hacking group claimed an attack, but the bank did not confirm the link.