Data Breach Prevention and Control

OFFICE OF THE DEPUTY GOVERNOR FINANCIAL SUPERVISION SECTOR MEMORANDUM NO. M-2021-__ 043 To : All BSP-Supervised Financial Institutions (BSFIs) Subject : Data Breach Prevention and Control As BSFIs increasingly leverage on digital platforms in the provision of essential financial services, massive amounts of data and information are being accessed, stored, processed, and/or transmitted across various systems and networks by BSFIs' customers, third party providers and other external stakeholders. Moreover, alternative working arrangements allow BSFIs' employees to remotely access internal systems and applications which may potentially expose sensitive and confidential information, if not properly secured and managed. Likewise, the adoption of cloud computing platforms and services by BSFIs adds complexity and challenges in ensuring data security, integrity and privacy. With these emerging trends in the technology and cybersecurity landscape, risks on data breaches or data leaks become a significant concern leading to reputational, operational, legal, and regulatory risks, among others. Data breach is the intentional or unintentional disclosure of sensitive information to unauthorized recipients or a cyber-incident involving the theft of data and/or information. This may occur due to simple errors such as sending an email to incorrect recipients, misplacing or theft of an unencrypted storage media, or utilizing a free digital platform without understanding the terms and conditions of its use. Data breach may also arise from exploits on systems and network vulnerabilities, improper access rights management, or insider misuse of information. Appendix 75 of Section 148 of the Manual of Regulations for Banks (MORB) and Appendix Q-62 of Sections 147-Q/145-S/142-P/126-N of the Manual of Regulations for Non-Bank Financial Institutions (MORNBFI) lay down the framework to protect data and information throughout its life cycle. To further strengthen data breach prevention and control mechanisms, BSFIs are reminded on the following: 1. Regular conduct of information security education and awareness campaigns incorporating data protection standards and procedures.

2. Adequate security policies, procedures, and standards on: a. Data classification and control; b. Identity and access management following the principles on least privilege and segregation of duties/functions; c. Remote work arrangements and bring your own device (BYOD); d. Vulnerability and patch management; e. Outsourcing and vendor management; f. Enhanced screening and hiring practices for officers and employees handling sensitive information; g. Secure destruction and disposal of data and media; and h. Activity monitoring, auditing, and logging. 3. Implementation of security technologies and solutions such as: a. Encryption for both data-at-rest and data-in-transit; b. Automated data discovery and classification; c. Data Loss Prevention (DLP); d. Database Activity Monitoring (DAM); and e. Endpoint security. 4. Proper identification of systems and processes involving sensitive information and commensurate implementation of controls. 5. Adoption of a defense in depth approach in managing cybersecurity. The fight against data breaches, and cyber-attacks in general, continues to depend on the BSFI's ability to raise the level of its situational awareness against latest tactics, techniques and procedures of cyber threat actors, and enhancing their security capabilities as part of their overall defense-in-depth cyber security strategy. Please be reminded that significant data loss or massive data breach and other cyber-related incidents should be promptly reported to the BSP in accordance with Sections 148 of the MORB and Sections 147-Q/145-S/142- P/126-N of the MORNBFI. BSFIs should likewise notify the National Privacy Commission and their customers for data breaches involving sensitive personal information pursuant to applicable data privacy laws and regulations. For information and guidance. Digitally signed by Chuchi G. Fonacier Date: 2021.08.05 17:37:30 +08'00' CHUCHI G. FONACIER Deputy Governor 05 August 2021