The Central Bank of Russia has outlined a law approved by the Federation Council that introduces information security requirements for IT outsourcing and cloud service providers serving financial institutions. The requirements cover data subject to access restrictions and address risks from cyberattacks through providers’ infrastructure and leaks of client data. Banks, insurers and other institutions supervised by the central bank must notify the regulator if they intend to engage these providers. Both financial institutions and providers will be liable for disclosure of information exchanged between them, and the law also sets requirements for their contracts. Providers must confirm compliance annually by engaging an audit firm licensed by either the Federal Security Service of Russia or the Federal Service for Technical and Export Control of Russia.
Central Bank of Russia outlines new security requirements for financial sector IT outsourcing and cloud services
The Central Bank of Russia has detailed legislation approved by the Federation Council establishing information security requirements for financial institutions’ IT outsourcing and cloud providers. Supervised institutions must notify the regulator before engaging providers, and both parties will be liable for disclosure of information they exchange. Providers must confirm compliance annually through an appropriately licensed audit firm.