Cybersecurity Measures for Financial Institutions in Argentina: A Guide to Strategic Planning

As the digital landscape continues to evolve, financial services provided through online channels are expanding rapidly, requiring new technologies and increased interconnection among participants in the financial system. However, this growth poses significant challenges to the entire ecosystem, including financial institutions, network operators, clearing houses, third-party service providers, and fintechs.

The Challenge of Cybersecurity in Financial Services

To address these risks, the Central Bank of the Argentine Republic (BCRA) has developed guidelines for cybersecurity and cyber resilience that aim to help organizations set and include these measures into their strategic planning. These guidelines are designed to be tailored to each organization’s size, complexity, risk profile, culture, and current threats and vulnerabilities.

Key Components of Cybersecurity Strategy

The BCRA guidelines emphasize the importance of a comprehensive cybersecurity strategy and framework, which should include:

1. Governance

Clear structures, roles, and responsibilities for handling cybersecurity issues
Preventive measures in each project to ensure that cybersecurity is integrated into every aspect of the organization

2. Risk and Control Assessment

Analysis of risks posed by natural persons, processes, technology, and data
Assessments of an organization’s own risks from its functions, activities, channels, products, and services

3. Monitoring

Maintenance of risks at a level acceptable to the organization’s governing body
Regular testing, exercising, and auditing protocols to ensure that cybersecurity measures are effective

4. Response

Implementation of incident response processes and other controls to streamline timely and appropriate responses
Training for employees on how to respond to cybersecurity incidents

5. Recovery

Prompt and effective recovery of operations based on prioritization of critical functions and in accordance with objectives set by authorities responsible for the financial institution or organization
Regular review and update of disaster recovery plans to ensure that they remain effective

Exchange of technical information, such as threat indicators, frauds, and vulnerability exploitation methods
Collaboration with other organizations to share knowledge and best practices in cybersecurity

7. Continuous Learning

Regular review and update of cybersecurity strategies and frameworks to address changes in control environments, threats, good practices, and technical standards
Training for employees on new technologies and emerging threats to ensure that they remain up-to-date in their skills and knowledge

Implementation and Adoption

These guidelines are expected to be adopted by all institutions subject to BCRA’s regulation to build a financial ecosystem committed to cybersecurity. The implementation should rely on the organization’s characteristic features, risk profiles, and business impact analysis (BIA), as applicable.

In addition to these principles, the BCRA has uploaded the Cyber Lexicon, a document containing definitions to ensure that everyone involved in the cyber security process shares the same language.

By following these guidelines, financial institutions in Argentina can strengthen their cybersecurity measures and contribute to the development of a secure and trustworthy financial ecosystem.