Information security: new requirements set for providers of IT outsourcing and cloud services to financial institutions
Lawmakers have introduced regulation of IT outsourcing and cloud services provided to financial institutions. The Federation Council has approved the law that stipulates information security requirements, including in relation to restricted-access data, applicable to outsourcing companies. The new law will enter into force one year after its official publication.
Banks, insurers, and other organisations supervised by the Bank of Russia shall notify the regulator if they intend to engage such providers. Both providers and financial institutions will be liable for any disclosure of the information they exchange.
IT and cloud service providers will be required to annually confirm their compliance with the established requirements. To this end, they shall engage an audit firm licensed by the Federal Security Service of Russia or the Federal Service for Technical and Export Control of Russia.
The new law also sets requirements for agreements concluded between financial institutions and their contractors.
The law should therefore help financial institutions strengthen their protection against cyberattacks conducted through providers’ infrastructure and reduce the risk of client data leaks.