Cybersikkerhed for branchen Finans og investeringer

BaFin IT Requirements for Capital Management Companies

Sanktioner: Regulatory measures by BaFin including license revocation

KAIT (BaFin Rundschreiben 11/2019)

Kapitalverwaltungsgesellschaften (KVG). Authority: BaFin.

Myndighed: BaFin

Frist: 1. oktober 2019

Banco de Portugal Notice 1/2021 - ICT Risk Management

Sanktioner: Regulatory sanctions by Banco de Portugal

Aviso BdP n. 1/2021

Instituicoes de credito e empresas de investimento. Authority: Banco de Portugal.

Myndighed: Banco de Portugal

Frist: 1. januar 2021

Bank of Greece IT Risk Management Framework

Sanktioner: Regulatory sanctions by Bank of Greece

BoG Governor Act 2577/2006 (as amended)

Pistotika idrymata kai epicheiriseis ependyseon. Authority: Trapeza tis Ellados (Bank of Greece).

Myndighed: Trapeza tis Ellados (Bank of Greece)

Frist: 9. marts 2006

Bank of Lithuania Resolution on ICT Management Requirements

Sanktioner: Regulatory sanctions by Bank of Lithuania

LB Nutarimas Nr. 03-18 (2020)

Kredito istaigas, draudimo imones, mokejimo istaigas. Authority: Lietuvos bankas (Bank of Lithuania).

Myndighed: Lietuvos bankas (Bank of Lithuania)

Frist: 1. juni 2020

Bank of Slovenia Decision on Information Security Management

Sanktioner: Regulatory sanctions by Bank of Slovenia

Sklep BS (Ur. l. RS 73/2018)

Kreditne institucije in poddruznice tujih bank. Authority: Banka Slovenije.

Myndighed: Banka Slovenije

Frist: 1. december 2018

Bank of Spain Circular 2/2023 on Technology Risk Supervision

Sanktioner: Regulatory sanctions by Banco de Espana

Circular 2/2023 BdE

Entidades de credito y proveedores de servicios de pago. Authority: Banco de Espana.

Myndighed: Banco de Espana

Frist: 30. juni 2023

Bankaufsichtliche Anforderungen an die IT

BAIT

Banks and financial service providers. Authority: BaFin.

Myndighed: BaFin

Frist: 6. november 2017

Sanktioner: Nationale sanktioner gælder

Bankitalia 285 - Disposizioni di Vigilanza Banche (Titolo IV)

2 guider

BANKITALIA285

Nationale cybersikkerheds- og complianceforpligtelser for organisationer, der er omfattet af denne regulering.

Myndighed: Banca d'Italia

Frist: 17. december 2013

Bankwesengesetz - IT security provisions

BWG

Banks, credit institutions. Authority: FMA / OeNB.

Myndighed: FMA / OeNB

Frist: 1. januar 1993

BNR Norm 4/2018 on IT Operational Risk Management

Sanktioner: Regulatory sanctions by BNR

Norma BNR nr. 4/2018

Institutii de credit si institutii financiare. Authority: Banca Nationala a Romaniei (BNR).

Myndighed: Banca Nationala a Romaniei (BNR)

Frist: 1. juni 2018

CBI Cross-Industry Guidance on IT and Cybersecurity Risks

CBICROSS

Financial services firms regulated by CBI. Authority: CBI.

Myndighed: CBI

Frist: 1. september 2016

CBI Operational Resilience Guidelines

CBIOPRES

Banks, insurance companies, investment firms. Authority: CBI.

Myndighed: CBI

Frist: 1. december 2021

CSIRT KNF - Financial Sector CSIRT

CSIRTKNF

Financial sector entities. Authority: KNF.

Myndighed: KNF

Frist: 1. januar 2020

CSSF Circulars on IT outsourcing and cybersecurity (17/654, 22/806)

CSSFCIRC

Financial sector entities. Authority: CSSF.

Myndighed: CSSF

Frist: 1. juni 2017

DNB Good Practice Information Security

Sanktioner: DNB regulatory measures

DNB Guidance 2019

Financiele instellingen onder toezicht van DNB. Authority: De Nederlandsche Bank (DNB).

Myndighed: De Nederlandsche Bank (DNB)

Frist: 1. april 2019

Sanktioner: Op til 10 mio. EUR eller 5% af årlig omsætning

DORA

3 guider

EU-forordning 2022/2554

Digital operationel modstandsdygtighed for den finansielle sektor

Myndighed: EBA, ESMA, EIOPA (ESA'erne) - Nationalbanken i Danmark

Frist: 17. januar 2025

EFSA Guidelines on IT Risk Management for Financial Sector

Sanktioner: Regulatory sanctions by EFSA

Finantsinspektsiooni soovituslik juhend (2020)

Krediidiasutused, kindlustusseltsid, investeerimisettevotted. Authority: Finantsinspektsioon (EFSA).

Myndighed: Finantsinspektsioon (EFSA)

Frist: 1. januar 2020

FCMC Regulations on IT and Security Risk Management

Sanktioner: Regulatory sanctions by Latvijas Banka

FKTK normativie noteikumi 233 (2020)

Kreditiestades, apdrosinasanas sabiedribas, ieguldijumu uznemumi. Authority: FKTK (Finansu un kapitala tirgus komisija) / Latvijas Banka.

Myndighed: FKTK (Finansu un kapitala tirgus komisija) / Latvijas Banka

Frist: 1. september 2020

FFFS 2014:5 Informationssaekerhet, it-verksamhet

FFFS20145

Banks, securities companies, credit market companies. Authority: Finansinspektionen.

Myndighed: Finansinspektionen

Frist: 1. maj 2014

Finanssivalvonta Standards and Regulations on IT risk management

FINFSASTANDARDS

Banks, insurance companies, pension funds, investment firms. Authority: Finanssivalvonta.

Myndighed: Finanssivalvonta

Frist: 1. januar 2004

Finanstilsynets vejledning om it-sikkerhed (Bekendtgoerelse nr. 1580/2019)

Sanktioner: Regulatory measures by Finanstilsynet

BEK nr. 1580 af 17/12/2019

Pengeinstitutter, forsikringsselskaber og vaerdipapirhandlere. Authority: Finanstilsynet.

Myndighed: Finanstilsynet

Frist: 1. januar 2020

FMA IT Security Regulation for Financial Sector

Sanktioner: Regulatory measures by FMA

FMA-IT-SichV 2021

Kreditinstitute, Versicherungsunternehmen, Wertpapierfirmen. Authority: FMA (Finanzmarktaufsicht).

Myndighed: FMA (Finanzmarktaufsicht)

Frist: 1. september 2021

Sanktioner: Op til 20 mio. EUR eller 4% af global årlig omsætning

GDPR

4 guider

EU-forordning 2016/679

Beskyttelse af personoplysninger i Den Europæiske Union

Myndighed: Datatilsynet

IKT-forskrift for finansforetak (IKT regulation for financial entities)

IKT_FORSKRIFT

Banks, insurance, pension, securities firms. Authority: Finanstilsynet.

Myndighed: Finanstilsynet

Frist: 21. maj 2003

Sanktioner: Ikke relevant (frivillig standard)

ISO 27001

2 guider

ISO/IEC 27001:2022 - International standard

Informationssikkerhedsledelsessystem (ISMS)

Myndighed: Akkrediterede certificeringsorganer

KNF Recommendation D - Management of IT and ICT Environment

KNFREKOM

Banks, credit institutions. Authority: KNF.

Myndighed: KNF

Frist: 1. januar 2013

Legislative Decree 138/2024 - NIS2 Transposition

Sanktioner: Fino a 10 milioni di euro o 2% del fatturato mondiale annuo

D.Lgs. 138/2024

Soggetti essenziali e importanti nei 18 settori NIS2 (50+ dipendenti o 10M+ fatturato). Authority: ACN - Agenzia per la Cybersicurezza Nazionale.

Myndighed: ACN - Agenzia per la Cybersicurezza Nazionale

Frist: 16. oktober 2024

MFSA ICT Risk Management Requirements for Financial Sector

Sanktioner: Regulatory sanctions by MFSA

MFSA Banking Rule BR/22

Credit institutions, insurance undertakings, investment services licensees. Authority: MFSA (Malta Financial Services Authority).

Myndighed: MFSA (Malta Financial Services Authority)

Frist: 1. januar 2021

MNB Recommendation on IT Security for Financial Institutions

Sanktioner: Regulatory sanctions by MNB

MNB Ajnlas 8/2020

Hitelintezetek, biztositok, penzugyi valalatok. Authority: Magyar Nemzeti Bank (MNB).

Myndighed: Magyar Nemzeti Bank (MNB)

Frist: 1. oktober 2020

NBB Circular on ICT Security Expectations for Financial Institutions

Sanktioner: Regulatory sanctions by NBB

Circulaire NBB_2015_32

Etablissements de credit, entreprises d'assurance, institutions de paiement. Authority: Banque Nationale de Belgique (NBB/BNB).

Myndighed: Banque Nationale de Belgique (NBB/BNB)

Frist: 18. november 2015

NBS Measure 3/2018 on IT Risk Management

Sanktioner: Regulatory sanctions by NBS

Opatrenie NBS c. 3/2018

Banky, poistovne, investicne spolocnosti. Authority: Narodna banka Slovenska (NBS).

Myndighed: Narodna banka Slovenska (NBS)

Frist: 1. juli 2018

Sanktioner: Op til 10 mio. EUR eller 2% af årlig omsætning

NIS2

4 guider

EU-direktiv 2022/2555

Net- og informationssikkerhed for væsentlige og vigtige enheder

Myndighed: CFCS - Center for Cybersikkerhed

Frist: 17. oktober 2024

Ordinance on Minimum Network and Information Security Requirements

Sanktioner: BGN 5,000 to BGN 25,000 for first offence

Naredba za MMIS (prieta s PMS 186/2019)

Operators of essential services and digital service providers. Authority: State Agency for Cybersecurity.

Myndighed: State Agency for Cybersecurity

Frist: 2. august 2019

Sanktioner: Bøder fra kortorganisationer (Visa, Mastercard) op til 500.000 USD/måned + tilbagekaldelse

PCI-DSS

2 guider

PCI-DSS v4.0 (gælder fra 31. marts 2024)

Sikkerhedsstandard for enheder, der håndterer, behandler eller transmitterer betalingskortdata

Myndighed: PCI Security Standards Council