BRH Circular 126 imposes cybersecurity measures on financial institutions

The Bank of the Republic of Haiti (BRH) has issued a circular establishing cybersecurity requirements for financial institutions. This circular aims to protect data and to effectively prevent and manage cyberattacks such as ransomware.

Circular 126 requires financial institutions to ensure the confidentiality, integrity, and availability of information processed by their IT systems. It also mandates internal and external audits to verify that security measures are effective.

A contingency plan is mandatory in order to minimize the consequences of a cyberattack and to quickly restore service to customers. The BRH recommends implementing a two-factor authentication system to protect access, as well as regular backups in accordance with the "3-2-1" principle.

Furthermore, staff training is crucial for identifying and managing cybercrime attempts. The BRH has reminded financial institutions that they must not negotiate with the perpetrators of cyberattacks.

Specific measures

The circular sets out three key priorities: protecting access by using robust authentication methods, regularly testing backups, and training staff to spot cyberattack attempts. These measures aim to reduce vulnerability to cyberattacks.

Audits and local expertise

To ensure the effectiveness of the measures, it is recommended to have locally developed IT audit expertise. Restoration tests also make it possible to verify the time required to restore services after an incident.