Advance Suptech Engine for Risk-based Compliance (ASTERisC*) Rollout

BANGKO SENTRAL NG PILIPINAS OFFICE OF THE DEPUW COVERNOR I FINANCIAL SUPERVISION SECTOR M E MORAN DU M NO. tA2g22SA5 to : ALL BSP SUPERVISED FINANCIAI INSTITUTIONS (BSFls) Subject : Advance Suptech Engine for Risk-based Compliance (ASTERisC*) Rollout ln line with the thrust to digitalize the supervisory and regulatory processes, the Bangko Sentral ng Pililpinas (BSP) is implementing the Advance Suptech Engine for Risk-based Compliance or ASTEFIisC* effective Ol January 2023. ASTERiSC' is a unified Regulatory and Supervisory Technology solution that streamlines and automates regulatory supervision, reporting, and compliance assessment of BSFIs' cybersecurity risk management systems and processes. Initial implementation covers select BSFIs which meet the pre-defined criteria set by the BSP. This memorandum provides information on the general requirements on the use of ASTERisC* and the preparatory activities prior to rollout. Detailed system guide and other documentation shall be directly coordinated with the participating BSFIs and shall also be available in the ASTERiSC* platform. General Description and Scope The ASTERisC* is a cloud-based solution which supports the BSP's end-to-end process on cybersecurity supervision and oversight to include cyber-profiling, cyber incident reporting and cybersecurity control self-assessments, among others. With this platform, BSFIs can directly access and transmit cybersecurity-related reports and information in real-time. The system likewise enables deeper analyses and correlation capabilities to help the BSP implement risk-based and proactive supervisory decisions and set policy d i rection on cybersecu rity. ASTER|SC* will initially be deployed to select BSFIs which meet the BSP's predefined criteria. The system scope, features and functionalities may be further expanded in the future to cover additional participating BSFls, other key risk areas and/or modules in line with supervisory priorities and/or requirements. B. Procedural Overview Participating BSFIs can access the system via a cloud-based web application by providing the necessary credentials. Authorized users can then submit cyber- related reports and assessments through web-based forms and can have access to the following: (l) a dashboard which summarizes the status of submissions and summary reports; (2) global reports predefined by the BSP, which contain charts, summary reports, or raw data; and (3) email notification for report due dates and BSP acknowledgement receipt. Pagel of3

The RSP shall directly coordinate with the participating BSFts for the provision of login credentials authentication setup and schedule of training on the use of the systern. Minimum Technical Requirements The minimum technical requirement for the use of ASTER|sC* are as follows: '1. Internet access: 2. Latest versions of web browser such as Microsoft Edge, Firefox, and Google Chrome; and 3. Mobile device for second factor authentication. D. lmplementation l. Initial scope of ASTER|sC is as follows: llFRRGfelcnc'e".' .,r . r. -.-..i j --,,: :,1,.; . lT Profile Report Section 148 of the MORB and Section 147- eh4s-slr42-p /126-N of the MoR N B Fl o Event Driven Report Section 148 of the ^25-T MORB and Section 147- and Notification (EDRN) QA4'-51142-P n25-T of the MOR N B Fl . Report on Crimes and Section 148 ^26-Nand 173 of the MORB and Losses (RCL) Section 147-QJ145-s^42-p1126-Nn6g-T and v2-Qln62-Sn 6r -Pl901 -N of the MOR N BFI . Cybersecurity Control Compliance self-assessment against Self-Assessment (CCSA ) Appendix 75 and Q-62 of the MORB and MORNFI, respectivelv. At the initial phase of deployment, a single user account is provisioned for each BSFI participant. Requests and justification for additional accounts may be submitted to the Technology Risk and Innovation Supervision Department (TRISD) at [email protected]. The assigned users are required to undergo the ASTERisC' training to be conducted by TRISD prior to user account creation. The BSFI Chief Compliance Officer (CCO) or any authorized personnel is required to immediately notiff the BSP should there be separation/transfer or permanent change of the assigned ASTERisC user. 4. Reporting through ASTER|sC shall be effective starting I January 2023. Nonetheless, BSFIs may access the system in advance to prepare the lT Profif e data for submission on 25 January 2023. BSFIs not yet covered in the initial implementation shall continue to submit the regulatory reports through the default processes established by the BSP. Page 2 of3

For information and guidance. Digitally signed by . Chuchi G. Fonacier Date:2022.10.27 l0:31:38 +08'00' CHUCHI G. FONACIER Deputy Governor 27 October 2022 Page 3 of3