The purpose of the Communiqué on Information Systems Used in Payment and Securities Settlement Systems is to regulate the procedures and principles regarding the information systems used in carrying out activities related to payment and securities settlement systems.
Regarding the information systems used in these activities, this Communiqué covers the procedures and principles for general provisions on information systems management, information security management, security vulnerabilities and breaches, audit trails, authentication, access control and non-repudiation, risk management for information systems, information systems operations, the information systems continuity plan, outsourcing in information systems and other matters.
The details of the communiqué can be accessed from the link below:
Applying the information systems communiqué
Under this communiqué, system operators perform risk analysis, set security policies, restrict access rights and retain event logs. Backup, disaster recovery and business continuity plans must also be tested regularly.
Independent audits verify that these controls are actually applied. A corrective action plan is prepared for the findings.
For technology teams, the takeaway is that information security is not a project deliverable but an ongoing operational activity.
