IT and cloud providers face annual security compliance checks
IT outsourcing and cloud providers serving financial institutions must meet new information security requirements, the Bank of Russia says. The law requires annual compliance checks and makes both parties liable for disclosure of exchanged information.
Security duties extend to contractors
The Federation Council has approved a law regulating IT outsourcing and cloud services supplied to financial institutions.
It establishes information security requirements for providers, including protection of restricted-access data.
Banks, insurers and other organisations supervised by the Bank of Russia must notify the regulator if they intend to engage these providers.
Both the providers and financial institutions will be liable for disclosure of information exchanged between them.
The law also sets requirements for agreements between financial institutions and their contractors.
It will enter into force one year after its official publication; the notice gives no exact effective date.
Annual checks require licensed auditors
IT and cloud service providers must confirm compliance with the established requirements every year.
They must engage an audit firm licensed by either the Federal Security Service of Russia or the Federal Service for Technical and Export Control of Russia.
The Bank of Russia says the law is intended to strengthen financial institutions' protection against cyberattacks conducted through providers' infrastructure and reduce the risk of client data leaks.
Outsourcing retains shared responsibility
The law places security obligations on providers while retaining financial institutions' liability for disclosure of exchanged information.
Annual audits add recurring compliance checks.
The stated aim is protection against provider-based attacks and client data leaks.