Circular 2021 status not recorded
Circular SUSEP nº 638, de 27 de julho de 2021 (SUSEP Circular 638 on cyber security requirements for supervised insurance entities)
Issued by Superintendência de Seguros Privados
Effective: 1 Sep 2021
Plain-English summary
Sets cyber security requirements for insurers, open supplementary pension entities, capitalisation companies and local reinsurers: a cyber security policy (Art. 4), incident reporting to SUSEP within five business days (Art. 8) and notification of relevant data-processing and cloud outsourcing within 30 days of signing (Art. 10, III).
Who it applies to
Insurance
Topics
Cybersecurity & IT Risk Insurance & Pensions Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Cyber incident reporting to SUSEP | Deadline Within 5 business days of learning of the event | SUSEP | source | |
Art. 8 requires relevant cyber incidents to be reported to SUSEP within five business days of the entity learning of the event, describing the extent of the damage and the remediation under way. Art. 9 adds an annual incident report. |
||||
| Notification of cloud and data-processing outsourcing to SUSEP | Deadline Within 30 days after signing the contract | SUSEP | source | |
Art. 10, III requires insurers and other supervised entities to notify SUSEP of relevant data-processing or storage outsourcing, including cloud computing, within 30 days after the contract is signed, naming the provider, subcontractors and the countries and regions where data may be stored or processed. Changes must also be notified within 30 days. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.