## EXECUTIVE SUMMARY ## Source details **Canonical URL:** [EXECUTIVE SUMMARY](https://www.imf.org/-/media/files/publications/cr/2022/english/1mexea2022005.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2022/english/1mexea2022005.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2022/english/1mexea2022005.pdf.json) --- ### Introduction and Systemic Concern - Mexico’s financial system is digitalizing rapidly, increasing exposure to cyber risk. - Internet and mobile banking users in Mexico have increased substantially; cyber incidents have surged in recent years. - Tight interdependencies within the financial system, and beyond, make Mexico vulnerable to evolving cyber threats. - The Financial System Stability Council (CESF) has recognized cyber as a risk with potential to impact financial stability. ### Institutional Capacity, Strategy, and Governance - Banxico and CNBV have dedicated divisions promoting cybersecurity and cyber resilience. - Formal agreements to improve coordination and cooperation in cybersecurity (the Bases of Coordination and the GRI) exist but lack formal operational structures and a lead agency. - Banxico: - Has developed a cybersecurity strategy (2021) with four key focus areas: Continuous Reinforcement Program; expand Cybersecurity Directorate powers; enhance threat intelligence and response capabilities; improve collaboration and communication with other authorities. - DCIB (Directorate of Cybersecurity) structured into Compliance; Intelligence and Response; Policy and Innovation divisions. - DITI (Directorate of IT Infrastructure) and DGSPIM (oversight division) share supervision responsibilities; oversight division lacks dedicated cyber specialists and is not performing formal external oversight of Banxico-operated SPEI. - Applied three lines of defense model to operate SPEI (operations, risk management, internal audit) and validates 136 security controls on a 3-year workplan; internal audit reviews systems every two years. - CNBV: - Established the General Direction of Information Security Supervision (DG-ISS) in 2022 and separated it from DG-OTR. - DG-ISS comprised of 18 staff members; the regulation team for technological matters consists of 3 staff members. - No formal cyber strategy; limited operational progress across its focus areas (unit setup, regulation for banks and fintech, authorization assessments, supervision methodologies). - Resources: - Banxico’s DCIB is comprised of 43 staff members. - Given breadth of mandates, both Banxico and CNBV need substantial additional resources, approaches, and tools. ### Cyber Regulation and Supervisory Practices - CNBV regulatory coverage: - Current enforceable cyber regulation applies to banks, brokerage houses, and financial technology institutions only; significant supervised entities lack enforceable cyber regulation. - Current bank regulation spans approximately 600 pages with cybersecurity/technology requirements scattered. - CNBV is undertaking an initiative to develop a single, unified regulatory document; timelines are unclear. - Supervisory practice: - CNBV began onsite inspections in April 2022; offsite supervision is under-resourced and lacks tools. - CNBV has a supervisory methodology “Rating of Financial Entities with an Information Security Risk Approach” (CEFER-SI). - CNBV does not currently mandate or routinely use independent third-party reviews as part of its supervisory toolkit. - Recommendations for CNBV (selected): - Issue enforceable guidance or regulation to all supervised entities on cyber risk, based on international standards. - Adopt a structured, risk-based cyber supervision approach combining offsite, on-site, thematic supervision and a diverse toolkit (questionnaires, self-assessments, desktop reviews, on-site inspections, technical “deep dives”). - Given resource constraints, maximize assurance via independent third-party reviews. ### Financial Market Infrastructure (FMI) Oversight - Banxico’s roles span regulator, overseer, operator, and user across FMIs; four statutes authorize Banxico oversight. - Formal oversight responsibilities include SPEI, SIAC, CCEN, Clearinghouses for card transactions, Clearinghouses for mobile payments, Banxico’s Derivative Trade Repository; joint oversight-supervision for DALI, CCV, and Asigna with CNBV. - Gaps identified: - No formal, independent, continuous oversight of SPEI as a systemically important payment system in the context of CPMI/IOSCO principles. - FMIs under Banxico are not subject to harmonized, enforceable cyber guidelines; FMIs have not been assessed via offsite or onsite oversight. - No structured methodology for cyber onsite/offsite oversight of FMIs; no joint cyber oversight of DALI, CCV, and Asigna. - Recommended Banxico actions: - Set clear regulatory requirements for all FMIs under its mandate, leveraging CPMI-IOSCO guidance. - Provide cyber training to FMI overseers and adopt a structured, comprehensive cyber oversight approach using a portfolio of tools. - Grant adequate independence and resources to the oversight division within the Directorate General of Payment Systems and Market Infrastructures (or otherwise ensure separation between overseer and operator of SPEI). ### Financial System Cyber Mapping and Third-Party Risk - Neither Banxico nor CNBV have developed a comprehensive cyber map of the financial system. - Mapping would: - Deepen understanding of operational and technological interconnections among financial entities and FMIs. - Identify critical service providers and concentration risk (including cloud providers and other third parties). - Support development of contagion scenarios, playbooks, exercises, and potential stress testing scenarios. - CNBV’s visibility on third-party/cloud migration: - CNBV collects information on third-party providers but does not maintain a specific database of critical third-party providers of systemically important entities. - CNBV does not have a database to quantify the share of supervised entities migrated to the cloud. - Recommendations: - CNBV should maintain a specific database of third-party service providers for systemically important entities and analyze concentration risk. - Banxico and CNBV should develop a cyber map, analyze transmission channels, document contagion scenarios, and integrate third-party lists into the cyber map. ### Monitoring, Response, Recovery, and Testing - Threat intelligence sources: - Banxico: open sources; Group-IB, FS-ISAC, SWIFT ISAC; other authorities (CERT-Mexico, international OSSAT). - CNBV: open sources; commercial source Minsait; other Mexican authorities (CERT-Mexico); reports from supervised entities. - Recommendation: develop a Generic Threat Landscape (GTL) Report to elaborate the Mexican financial system’s specific threat landscape and support scenario development and playbooks. - Red team testing: - Banxico conducts red team tests limited to specific applications/systems; recommendation to conduct a full-scope red team test on central infrastructure to test protection, detection, and response controls. - Exercises and preparedness: - Banxico conducted two cyber crisis simulation exercises in 2021 with five systemically important banks; exercises tested incident response, communication, crisis management, and recovery. - CNBV has not coordinated industry-wide cyber crisis simulation exercises with supervised entities. - Recommendation: Banxico and CNBV should regularly conduct market-wide cyber crisis table-top simulation exercises involving relevant agencies (e.g., Ministry of Finance and Public Credit and IPAB), financial entities, and FMIs, based on extreme but plausible scenarios. - Crisis communications: - Banxico has documented crisis communication protocols and playbooks; CNBV has not documented crisis communication protocols or playbooks and should develop them. ### Incident Reporting, Data, and Trends - Both authorities have incident reporting regimes and collect routine data. - Incident definitions: - Banxico definition (Bases of Coordination): “An assessed event that actually or potentially jeopardizes the confidentiality, integrity or availability of a component or the entire technology infrastructure or information that is processed, stored or transmitted; that may represent a loss, alteration or misplacement of information; or that constitutes a violation or an imminent threat of violation of the security policies, security procedures or acceptable use policies; that may result in interruption of the service or in damage or loss to the customers of the affected Entity, to the general public, to its counterparties or to the Entity itself”. - CNBV definition: “Any event, internal or external, that: compromises the confidentiality, integrity, or availability of information; vulnerates the technology infrastructure compromising the information that it processes, stores or transmits; or constitutes a violation of information security policies and procedures”. - Severity criteria follow Bases of Coordination (impact on more than one Entity; customers; stability of the financial system; central payment systems/CSDs) and features (economic loss; replicable mode of operation; reputational risk; public distrust). - Data fields collected differ in granularity; CNBV collects duration, amount recovered, number of records exposed, threat vector, vulnerabilities exploited, malware signatures, containment and recovery results. - 2020–2021 incident examples (summary): - 2020: multiple ransomware incidents affecting internet banking, bank teller systems, brokerage firm servers; estimated losses: Pending. - 2021: multiple ATM infrastructure attacks with reported estimated losses: 0.63; 0.13; 8.10; 0.80; 3.01; 4; 0.73; and application attacks with estimated loss: 79; a transfers-on-branches incident with estimated losses: 474.40; several ransomware incidents with estimated losses: Pending. ### Information Sharing and Cyber Deterrence - Information sharing: - Bases of Coordination requires secure exchange between members and authorities but remains high level and not fully operationalized. - Positive industry steps: consortium of seven large banks (ABM) established a private information sharing network; Banxico setting a MISP instance to connect to the ABM network. - Challenges: network excludes most entities; reluctance to share information where regulators/supervisors participate. - Recommendation: Banxico should work with the financial sector to develop an industry-wide cyber information and intelligence sharing network with a Terms of Reference/Rulebook, operational platform (e.g., MISP), CISO network for trust building, and clear principles and types of information to share. Consider excluding supervisors/regulators to address industry concerns while ensuring authorities receive key systemic information when needed. - Cyber deterrence and law enforcement: - Legal instruments: Federal Penal Code; State Penal Codes; laws on financial entities (e.g., Credit Institutions Law); Organic Law of the Judicial Power of the Federation; National Code of Criminal Procedures. - Authorities are considering a Cybersecurity Law to address fragmentation. - Challenges: - Financial entities reluctant to file complaints with FGR due to risk of confiscation of assets. - Investigators and prosecutors lack technical expertise for forensic analysis. - Crimes are fragmented across laws and not clearly defined. - Lack of guidance for entities on storing and handling evidence. - Recommendation: Banxico and CNBV could issue guidance on evidence handling; engage FGR and law enforcement to develop practical guidance for filing complaints and forensic collaboration. ### Consolidated Recommendations (selected, with timing and responsibility) - Banxico, CNBV: develop cyber strategies for their mandates and joint functions with clear vision, objectives, roles, implementation roadmap, timelines, and resource estimates (¶31). Timing: I - Banxico, CNBV: clarify their different roles and responsibilities for cyber risk internal coordination and external cooperation (¶32, 33). Timing: NT - Banxico, CNBV: formalize operational structures, policies, and procedures to operationalize the Bases of Coordination and GRI, with clear roles and responsibilities and clarity on lead agency/ies (¶34). Timing: NT - Banxico, CNBV: increase capacity via resources and tools to strengthen cyber resilience of the financial sector (¶35). Timing: NT - Banxico, CNBV: consider developing a cyber map of the financial sector to analyze transmission channels, document contagion scenarios, develop playbooks, conduct exercises, and consider stress testing scenarios (¶45). Timing: MT - CNBV: maintain database of third-party service providers for systemically important entities and FMIs and analyze concentration risk (¶46). Timing: NT - Banxico: develop and issue regulatory requirements, based on CPMI-IOSCO guidance and its cyber strategy, for FMIs under its oversight mandate, including SPEI (¶61). Timing: I - Banxico: follow a structured and comprehensive process for cyber risk oversight, utilize a portfolio of tools and techniques, reach clear conclusions and remedial measures, and provide cyber training to overseers (¶61). Timing: NT - Banxico: give the oversight division within the Directorate General of Payment Systems and Market Infrastructures enough independence and resources to conduct thorough oversight of SPEI or fulfill oversight under any other organizational arrangement (¶62). Timing: NT - Banxico, CNBV: collaborate to operationalize oversight and supervisory responsibilities for DALI, CCV, and Asigna and develop an effective joint cyber oversight process (¶61). Timing: NT - CNBV: issue enforceable guidance or regulation to all supervised financial entities on cyber risk, based on international standards (¶63). Timing: I - CNBV: adopt a more structured approach for cyber supervision, including more intrusive onsite inspections and structured offsite supervision; use independent third-party reviews given resource limitations (¶64). Timing: NT - Banxico, CNBV: consider developing a Generic Threat Landscape (GTL) Report (¶75). Timing: MT - Banxico: consider a full scope red team test on its IT environment (¶76). Timing: MT - Banxico, CNBV: regularly conduct market-wide cyber crisis simulation exercises (¶77). Timing: NT - CNBV: develop and document crisis communication protocols and playbooks for different cyber scenarios (¶78, 85). Timing: NT - Banxico: work with the financial sector to develop and operationalize a cyber information and intelligence sharing network (¶84). Timing: MT - Banxico, CNBV: issue guidance on evidence handling to enhance cyber deterrence and support investigations (¶90). Timing: MT - Timing legend: I Immediate (within 1 year); NT Near Term (within 1-2 years); MT Medium Term (within 3−5 years). *Source: 1mexea2022005 - EXECUTIVE SUMMARY (https://www.imf.org/-/media/files/publications/cr/2022/english/1mexea2022005.pdf)* ### EXECUTIVE SUMMARY __________________________________________________________________________ 6 ### EXECUTIVE SUMMARY ### Introduction and Systemic Concern - Mexico’s financial system is digitalizing rapidly, increasing exposure to cyber risk. - Internet and mobile banking users in Mexico have increased substantially; cyber incidents have surged in recent years. - Tight interdependencies within the financial system, and beyond, make Mexico vulnerable to evolving cyber threats. - The Financial System Stability Council (CESF) has recognized cyber as a risk with potential to impact financial stability. ### Institutional Capacity, Strategy, and Governance - Banco de México (Banxico) and Comisión Nacional Bancaria y de Valores (CNBV) have dedicated divisions promoting cybersecurity and cyber resilience. - Formal agreements to improve coordination and cooperation in cybersecurity are an excellent example compared to international peers. - Banxico has developed a cybersecurity strategy but needs enhancement to specify how to identify, manage, and reduce cyber risk for the financial sector and FMIs in an integrated and comprehensive systemic manner. - Banxico should strengthen cyber risk oversight of Financial Market Infrastructures (FMIs): - Banxico’s supervision of participants connecting to SPEI is strong, but Banxico should set clear regulatory requirements for all FMIs under its mandate, leveraging CPMI-IOSCO guidance. - Intensive cyber training of overseers and a structured, comprehensive cyber oversight approach with adequate tools would increase oversight capabilities and effectiveness. - Payment system oversight: - Banxico applies the three lines of defense model to operate SPEI (operations, risk management, internal audit), secured transmission of information, and accountability rules, with strong cybersecurity and operations units. - There is no formal, independent, continuous, and intensive oversight of SPEI as a systemically important payment system in the context of CPMI/IOSCO principles. - Recommendation: grant adequate independence and resources to the oversight division within the Directorate General of Payment Systems and Market Infrastructures to fulfill Banxico’s mandate for all payment systems, including SPEI. ### Cyber Regulation and Supervisory Practices - Cyber risk regulation and supervisory practice need significant improvements. - CNBV is encouraged to issue enforceable guidance or regulation to all its supervised financial entities on cyber risk, not only for credit institutions and fintech. - CNBV should implement a more structured, risk-based approach to cyber supervision, supported by adequate tools. - Onsite inspections of financial entities began in April 2022; offsite supervision would benefit from clear identification of risks (e.g., unsecured transmission of information, lack of accountability rules). - The cyber supervision unit should be given sufficient resources and use a mix of regulatory tools (e.g., independent auditors) to maximize efficiency given limited resources. ### Financial System Cyber Mapping and Third-Party Risk - Banxico and CNBV would benefit from developing a cyber map of the financial system to: - Deepen understanding of operational and technological interconnections among financial entities and FMIs. - Assess steps taken to guarantee information security and identify transmission channels that could trigger financial instability via cyber-attacks. - Develop a range of cyber contagion scenarios and use them for sector-wide crisis preparedness. - CNBV should maintain a specific database of third-party service providers of systemically important financial entities and FMIs and conduct analysis to identify critical third-party providers and concentration risk. ### Monitoring, Response, and Recovery - Improvements in response and recovery capabilities are recommended. - CNBV would benefit from formalizing internal and cross-border crisis management protocols for cyber incidents. - Banxico and CNBV should operationalize concrete actions connected to the Bases of Coordination to improve the cross-agency cyber crisis management framework. - Both authorities in their joint faculties should regularly conduct market-wide cyber crisis table-top simulation exercises, including relevant agencies (e.g., Ministry of Finance and Public Credit and IPAB), financial entities, and FMIs, based on extreme but plausible scenarios. - Banxico and CNBV should consider developing a Generic Threat Landscape (GTL) Report to set out the specific threat landscape of the Mexican financial system, taking into account geopolitical and criminal threats unique to the jurisdiction. - Banxico should consider conducting a full scope red team test on its IT environment to test protection, detection, and response controls. ### Information Sharing, Incident Reporting, and Cyber Deterrence - Mexico would benefit from improving public and private platforms for threat intelligence and information sharing. - By exchanging cyber information and intelligence within a sharing community, financial entities can improve defensive capabilities, threat detection, and mitigation strategies. - Recommendation: Banxico should work with the financial sector to develop an industry-wide cyber information and intelligence sharing network. - Authorities need to increase awareness within the financial sector on cyber deterrence processes embodied in the Bases of Coordination: - Bases of Coordination sets protocols for cyber deterrence and investigation/prosecution of cybercriminals; responsibility for investigation and prosecution lies with the General Attorney (FGR). - Challenges: financial entities are reluctant to formally request investigations because it can lead to confiscation of key assets; there is a need to build technical expertise among judges and investigators to analyze crimes and evidence. - Banxico and CNBV could issue guidance to financial entities on how to store, handle, and administer evidence to facilitate investigations and raise awareness of investigative needs. - Implementation processes around the Bases of Coordination should be improved: - The Bases provides a good basis for coordination, but no lead agency is formally responsible for overall implementation. - It needs translation into operational structures, policies, and procedures with clear leadership. - Banxico and CNBV are proposing to take on leadership between themselves; implementing these structures and processes should be a priority. ### Consolidated Recommendations (selected, with timing and responsibility) - Banxico, CNBV: develop cyber strategies for their mandates and joint functions with clear vision, objectives, roles, implementation roadmap, timelines, and resource estimates (¶31). Timing: I - Banxico, CNBV: clarify their different roles and responsibilities for cyber risk internal coordination and external cooperation (¶32, 33). Timing: NT - Banxico, CNBV: formalize operational structures, policies, and procedures to operationalize the Bases of Coordination and GRI, with clear roles and responsibilities and clarity on lead agency/ies (¶34). Timing: NT - Banxico, CNBV: increase capacity via resources and tools to strengthen cyber resilience of the financial sector (¶35). Timing: NT - Banxico, CNBV: consider developing a cyber map of the financial sector to analyze transmission channels, document contagion scenarios, develop playbooks, conduct exercises, and consider stress testing scenarios (¶45). Timing: MT - CNBV: maintain database of third-party service providers for systemically important entities and FMIs and analyze concentration risk (¶46). Timing: NT - Banxico: develop and issue regulatory requirements, based on CPMI-IOSCO guidance and its cyber strategy, for FMIs under its oversight mandate, including SPEI (¶61). Timing: I - Banxico: follow a structured and comprehensive process for cyber risk oversight, utilize a portfolio of tools and techniques, reach clear conclusions and remedial measures, and provide cyber training to overseers (¶61). Timing: NT - Banxico: give the oversight division within the Directorate General of Payment Systems and Market Infrastructures enough independence and resources to conduct thorough oversight of SPEI or fulfill oversight under any other organizational arrangement (¶62). Timing: NT - Banxico, CNBV: collaborate to operationalize oversight and supervisory responsibilities for DALI, CCV, and Asigna and develop an effective joint cyber oversight process (¶61). Timing: NT - CNBV: issue enforceable guidance or regulation to all supervised financial entities on cyber risk, based on international standards (¶63). Timing: I - CNBV: adopt a more structured approach for cyber supervision, including more intrusive onsite inspections and structured offsite supervision; use independent third-party reviews given resource limitations (¶64). Timing: NT - Banxico, CNBV: consider developing a Generic Threat Landscape (GTL) Report (¶75). Timing: MT - Banxico: consider a full scope red team test on its IT environment (¶76). Timing: MT - Banxico, CNBV: regularly conduct market-wide cyber crisis simulation exercises (¶77). Timing: NT - CNBV: develop and document crisis communication protocols and playbooks for different cyber scenarios (¶78, 85). Timing: NT - Banxico: work with the financial sector to develop and operationalize a cyber information and intelligence sharing network (¶84). Timing: MT - Banxico, CNBV: issue guidance on evidence handling to enhance cyber deterrence and support investigations (¶90). Timing: MT - Timing legend: I Immediate (within 1 year); NT Near Term (within 1-2 years); MT Medium Term (within 3−5 years). *Source: 1mexea2022005 - EXECUTIVE SUMMARY (https://www.imf.org/-/media/files/publications/cr/2022/english/1mexea2022005.pdf)* ### INTRODUCTION ### INTRODUCTION ### A. Background: Cyber Risk as a Financial Stability Concern - Constantly evolving cyber threats require vigilance from financial entities, regulators, and supervisory authorities. Malicious cyber actors continue to evolve and innovate their tactics, techniques, and procedures (TTP). - Recent global threat landscape elements mentioned: exploitation of critical zero-day vulnerabilities (e.g., in F5 Big-IP, MS Exchange, and Pulse Secure), supply chain attacks, ransomware attacks and distributed denial-of-service attacks. - Non-malicious incidents (accidental data disclosures and configuration, implementation, or processing errors) remain an important source of cyber risk. - COVID-19 related shifts increased vulnerability: - Malicious actors exploited pandemic themes in phishing campaigns. - Attack surface grew due to increased use of potentially vulnerable services and personal devices. - Systemic ramifications: - Not every cyber incident at a systemically important financial entity threatens jurisdictional financial stability, but systemic impact is conceivable under certain conditions. - Critical supply chains as systemic risk amplifiers: - Technology diversity between entities is decreasing due to economies-of-scale and network effects. - Financial entities adopt common software, similar hardware, and migrate to a select set of global cloud service providers (CSPs). - FMIs increasingly rely on critical service providers (e.g., messaging providers). A cyber incident in the supply chain could propagate via confidence and financial contagion channels. - Need for continuous enhancement of cyber resilience: strong capabilities to timely detect anomalies and compromises, and to respond and recover, are critical. *Footnote references in source: definition of zero-day vulnerabilities; reference to a Banxico publication.* ### B. Review Scope: Banks, Nonbanks, and Financial Market Infrastructures - Scope of the note: - Reviews key elements of the cyber regulatory and supervisory framework for the financial sector in Mexico, including: - the role and practices of Mexican authorities in developing a cyber strategy for the financial sector; - development and maintenance of the cyber regulatory framework; - on-site and off-site supervisory processes; - cyber mapping and financial stability; - cyber risk related information and intelligence sharing; - cyber incident reporting, monitoring, response and recovery; - cyber deterrence. - Coverage limitations: - Review limited to framework for financial entities within the mandate of Banxico and CNBV. - Excluded from scope: supervisory practices for insurance companies (CNSF), pension funds (CONSAR), conduct matters (CONDUSEF). - Designation of critical national infrastructure in the financial sector and additional expectations regarding their cybersecurity posture were out of scope. - Review does not include a full or targeted assessment of FMIs on observance with the CPSS-IOSCO Principles for Financial Market Infrastructures (PFMIs). - Information sources for the FSAP team: - Questionnaire answers from Banxico and CNBV, interviews with both authorities, national laws and reports published by the authorities, and documentation of their work. - Benchmarking and good practice used: - FSB “Stocktake of Publicly Released Cybersecurity Regulations, Guidance and Supervisory Practices” (2017); - BCBS “Cyber-resilience: Range of practices” (2018); - IMF Departmental Paper on “Cybersecurity Risk Supervision”; - G7 “Fundamental Elements for Effective Assessment of Cybersecurity in the Financial Sector”; - For FMIs: the PFMIs and CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures. - Clarification: the term “Mexican authorities” refers to Banxico and CNBV in this TN. ### STRATEGY AND GOVERNANCE #### A. Cyber Strategy - National-level strategy developments: - 2017: Mexican government developed a national cyber strategy driven by the Inter-Ministerial Commission for the Development of Electronic Government (CIDGE), based on the National Development Plan (2013-18). - Five strategic objectives: society and rights; economics and innovation; public institutions; public safety; national security. - Eight areas of work: cybersecurity culture; capacity building; coordination and collaboration; ICT research, development, and innovation; standards and technical criteria; critical infrastructures; legal framework and self-regulation; measurement and monitoring. - 2018/2019: Incoming government published National Development Plan (2019-2024) with revisions toward ICT approach and the National Digital Strategy. - National Digital Strategy (2021-24) by the Office of the President: - Priorities: increasing internet access, increasing digitalization, reducing poverty. - Cybersecurity addressed at a high level by requiring a “culture of information security that generates certainty and trust among users of institutional and governmental technology services”. - Progress in operationalizing this strategy has been slow, with limited focus on strengthening cyber resilience of the financial sector. - Banxico actions in absence of an effective national cyber strategy for the financial sector: - 2016: Banxico hired an international consulting firm to review its cybersecurity approach which concluded the need to strengthen approach and capabilities. - 2017-2020: Banxico focused on protecting information and assets; building proactive defense and risk prevention; strengthening information security governance; improving end-point security of financial entities connecting to Banxico’s infrastructure. - 2021 Banxico cyber strategy cited four key focus areas: 1. improve its internal control functions through the Continuous Reinforcement Program; 2. expand the powers of the Cybersecurity Directorate; 3. enhance the threat intelligence function and further develop detection, analysis, containment, response and recovery capabilities for cybersecurity incidents; 4. improve collaboration and communication with other authorities in the event of cybersecurity incidents in the financial system. - Progress: significant enhancements in maturity, infrastructure, governance arrangements, and supervision of participants that connect to Banxico-operated infrastructure; slower progress on developing resilience of the financial system or FMIs as a whole. - CNBV actions: - CNBV has no formal cyber strategy for supervised financial entities. - CNBV focused efforts in four areas: 1. setting up a specific internal unit for cyber supervision; 2. issuing cyber regulation for the most relevant sectors (banks and fintech companies); 3. executing cyber assessments as part of authorization processes for new financial entities and third-party service providers; 4. developing supervision processes, including methodologies for rating and prioritizing entities’ supervision and establishing supervision procedures. - Progress in operationalizing these four areas has been limited. #### B. Institutional Framework - Banxico mandate: - Promotes sound development of financial system and proper functioning of payment systems; entitles central bank in cybersecurity matters. - Article 2 of the Banxico Law: primary purpose provision of national currency and main objective to procure stability of purchasing power; also to promote sound development of the financial system and foster proper functioning of payment systems. - Banxico seeks to develop an adequate cybersecurity framework as part of responsibilities around financial sector and payment systems, whether as financial regulator, operator of payment systems, or overseer of FMIs within its scope. - CNBV mandate: - Supervise and regulate financial entities in Mexican financial system to ensure stability and proper functioning; "maintains and promotes the sound and balanced development of such system as a whole, for the protection of the interests of the public". - Financial entities under CNBV scope include: credit institutions, brokerage firms, stock exchanges, investment funds, investment fund operating companies, investment fund share distribution companies, general deposit warehouses, credit unions, exchange houses, regulated multiple purpose financial companies, popular financial companies, securities depository institutions, central counterparties, securities rating institutions, financial technology institutions, credit information companies and community financial companies, amongst others. - Prudential supervision includes operational and technology risk, including cyber risk. - Non-financial authorities with roles in financial sector cybersecurity: - CERT-Mexico (part of the National Guard, Ministry of Security and Civilian Protection): - Mission: support entities with critical information infrastructure during cyber incidents: identify threats and manage incidents; serve as contact and coordination point; conduct digital forensic investigations; provide police with technical analysis to support prosecutors. - Information Security Specialized Committee (CESI): - Objective: develop information security policies applicable to national security agencies and critical infrastructures; acts as information-sharing group when relevant cyber threats are detected. - National Institute of Transparency, Access to Information and Protection of Personal Data (INAI): - Role: monitor compliance by public and private sectors of regulations regarding access to information and protection of personal data. #### C. Governance Arrangements - Banxico internal governance for cyber risk: - Directorate of Cybersecurity (DCIB) within Directorate General of Comptroller and Risk Management holds key responsibility for defining and operationalizing cyber strategies for the central bank and the financial sector. - DCIB comprised of three divisions with mandates applying internally and to the financial sector: - Compliance: - Design, propose and coordinate activities to assess compliance with internal regulations on cyber security and cyber resilience applicable to systems supporting the Bank's operations and processes; review activities and verification of information technology controls; represents the 2nd line of defense; supervision and participation in sanction processes related to non-compliance with regulation on information security, cybersecurity, and cyber resilience applicable to financial intermediaries connected to the Bank's infrastructure. - Intelligence and Response: - Identify risk scenarios based on cyber threat intelligence; design, propose, implement protocols for response and reaction plans to cyber incidents within Banxico and the broader financial system; coordinate cyber resilience simulation exercises including financial entities; promote information sharing between authorities and financial entities; develop guidelines to strengthen cybersecurity and cyber resilience (e.g., digital forensics). - Policy and Innovation: - Define, design, and propose policies, standards, guidelines, institutional strategies, and regulation for financial intermediaries or third parties regulated by the Bank in terms of cybersecurity and cyber resilience; assess compliance before authorizing participation in Banxico-operated payment systems. - Directorate of IT Infrastructure (DITI): - Coordinates activities to assess compliance with SPEI regulations on ICT. - Can supervise ICT requirements for systems supporting the Bank's operations, including supervision of SPEI participants. - Can verify compliance of ICT regulation before authorizing participants to connect to systems managed by Banxico. - Supervision responsibilities: - Supervision of cybersecurity requirements is shared among DITI (telecom infrastructure), DGSPIM (applications of participants in payment systems and market infrastructures), and DCIB (organizational cybersecurity, computing infrastructure, and cyber resilience). - These units carry out on-site examinations and off-site reviews according to applicable legal provisions. - Within DGSPIM there is an oversight division for FMIs within Banxico’s mandate; however, the oversight function is not currently performed on the central bank operated SPEI system. - Governance improvements: - Banxico is reviewing governance structures for better internal coordination and collaboration aligned with cybersecurity strategy. - Banxico is working on changes to its by-laws to clarify roles and responsibilities of units involved in cybersecurity and cyber resilience. - CNBV governance for cyber supervision: - 2022: CNBV formally established the General Direction of Information Security Supervision (DG-ISS), responsible for cyber supervision of financial entities. - This places CNBV ahead of many international peers that lack a dedicated cyber supervision unit. - Restructuring separated DG-ISS from the General Direction of Operational and Technology Risk Supervision (DG-OTR). - DG-ISS and DG-OTR are established within the same directorate and work closely together given synergies between responsibilities. *Italicized source attribution:* _Source: 1mexea2022005 - INTRODUCTION (IMF mission note content)._ ### Box 1. Mexico: Responsibilities of DG-ISS and DG-OTR at CNBV ### Box 1. Mexico: Responsibilities of DG-ISS and DG-OTR at CNBV ### Responsibilities of DG-ISS - Supervising and assessing that all the entities regulated by CNBV implement the risk management system related to cybersecurity which includes, among others, vulnerability and penetration tests on computing’s equipment, facilities, and components; communication networks; operating systems; databases, applications, and systems that support entities’ operation; and to preserve information security according to regulation. - Supervising and assessing internal controls and regulation compliance related to cybersecurity from entities regulated by CNBV; including aspects related to confidentiality, integrity, and availability of information processed, transmitted, or stored in their own technology infrastructure and that hired from third parties. - Establishing measures and mechanisms to preserve information security in entities regulated by CNBV, as well as coordinate with the General Direction of Information Technology the measures and mechanisms to preserve information security at CNBV. - Coordinate with other financial and law enforcement authorities, as well as entities, actions to prevent and detect irregular operations related to information security. - Providing opinion in cybersecurity risk matters required by CNBV’s supervising general directions related to authorizations (third parties are included here). ### Responsibilities of DG-OTR - Supervise and assess computing equipment, facilities, and components; communication networks; operating systems; databases, applications and systems that support entities regulated by CNBV. - Supervise and assess internal controls and compliance with regulation related to automated systems from entities regulated by CNBV. - Supervise and assess entities’ capacity to identify, measure, monitor, limit, control, inform and disclose operational and technology risk according to regulation. - Propose measures to entities regulated by CNBV to implement preventive, control, and audit mechanisms to timely prevent and detect irregular transactions processed through computing equipment, facilities, and components; communication networks; operating systems; databases, applications and systems that support entities’ operation, or failures in their operation that can put at risk entities’ or clients’ resources. - Provide opinion in operational and technology risk matters required by CNBV’s supervising general directions related to authorizations (third parties are included here). ### Assessment of roles and need for clarification - Although the roles and responsibilities of the cyber supervision unit are defined, CNBV would benefit from further clarifying how DG-ISS and DG-OTR should engage with other supervisory functions, given technology and cyber are horizontal risks. - Example: In the case of a major cyber incident, DG-ISS would need to work closely with the supervisor of the specific bank that has suffered the incident. - Clarifying the roles and responsibilities of all functions, and how they should liaise with each other in supervision and during crisis, would enhance CNBV’s ability to enhance the cyber resilience of the financial sector in an integrated and holistic manner. ### Bases of Coordination (formal agreement) - The Bases of Coordination is a formal agreement signed by public and private stakeholders to improve coordination and cooperation within the financial sector in the field of cybersecurity. Signatories include SHCP, Banxico, CNBV, CONDUSEF, CONSAR, CNSF, FGR, Association of Banks of Mexico (ABM), Mexican Association of Brokerage Institutions (AMIB), Mexican Association of Popular Financial Companies (AMSOFIPO), Confederation of Savings and Loan Cooperatives of Mexico (CONCAMEX), and FinTech Mexico Association. - The Bases of Coordination established the Information Security Sensitive Incident Response Group (GRI) to coordinate measures to prevent and resolve severe crisis situations. GRI comprised CNBV, Banxico, CNSF, CONSAR, CONDUSEF and SHCP, with the key objective to collaborate and coordinate in case of a major cyber incident. ### Five key principles of the Bases of Coordination - Adopt and maintain updated policies, methods, and controls to identify, assess, prevent, and mitigate cybersecurity risks, which are identified, evaluated, prevented, and mitigated by the highest decision-making bodies and permeate all levels of the organization. - Establish secure mechanisms for the exchange of information between members of the financial system and the authorities on attacks that have occurred in real time and their mode of operations, response strategies, new threats, as well as the results of investigations and studies that allow entities to anticipate actions to mitigate the risks of cyber-attacks, while protecting the confidentiality of the information. - Promote initiatives to update the regulatory and legal frameworks that support and converge the actions and efforts of the parties, considering best practices and international agreements. - Collaborate in projects to strengthen the security controls of the different components of the infrastructure and operating platforms that support the country's financial services, promoting the use of information technologies to prevent, identify, react, communicate, typify, and make a common front in the face of present and future threats. - Promote cybersecurity education and culture among end users and the personnel of the entities themselves that, through continuous training, will result in an active participation to mitigate the current risks of cyber-attacks. ### Implementation gaps and operationalization - The Bases of Coordination is high level and does not have specifics on formal operational structures, policies, and procedures. Banxico and CNBV staff have drafted more detailed documentation on how to operationalize the Bases of Coordination, but endorsement by institutional leadership from CNBV, Banxico, and other authorities is pending. - The GRI’s policies and operational procedures are still being formalized. Banxico and CNBV would benefit from formalizing the operational arrangements for cross-agency information sharing to improve crisis management and timely sharing of vital information. - The Bases of Coordination has no lead agency, although informally Banxico and CNBV have taken on roles of leadership and in their draft operational protocols they have suggested taking on the role of presidency of the GRI. A clearer leadership structure is important for effectiveness. ### Resources and capacity constraints - The team in charge of cyber regulation and supervision of the financial sector (CNBV) is under-resourced: - The regulation team responsible of all technological matters consists of 3 staff members. - Offsite supervision has been limited across all financial entities and onsite inspections have just started in April 2022. - DG-ISS is comprised of 18 staff members. - Banxico’s cybersecurity responsibilities rest largely with DCIB, comprised of 43 staff members. - Given the criticality and breadth of mandates, there is a critical need for substantial additional resources, approaches, and tools for Banxico and CNBV to effectively mitigate cyber risk to acceptable risk tolerance levels. ### Recommendations (summary) - Banxico should enhance its current cyber strategy, and CNBV should develop a cyber strategy, including: - Clear vision and objectives, that consider all financial entities and include FMIs. - Clear articulation of roles and responsibilities in operationalizing the strategy. - Initiatives and tools required to operationalize the strategy. - Roadmap for implementation and timelines. - Resources and investment required to implement the strategy. - Banxico should finalize work to clarify the different roles and responsibilities of the different units within the central bank with regards to cybersecurity; by-law changes are being considered to add more clarity. - CNBV should clarify the cybersecurity roles and responsibilities of DG-ISS, DG-OTR, and other supervisory functions within CNBV to ensure integrated cooperation in supervision and crisis management. - Banxico and CNBV should formalize the operational structures, policies, and procedures to operationalize the Bases of Coordination and the GRI, with clarity on the leadership structure and roles and responsibilities of stakeholders. - Banxico and CNBV in their joint faculties should explore means of increasing capacity, considering approaches such as: - increasing specialized staff numbers, - recruiting highly-skilled personnel for the emission and continuous updating of the regulation, - upskilling generalist supervisors and overseers in cyber risk, - increased use of third party independent assurance reports. ### Cyber mapping, stress testing, and systemic analysis - Banxico and CNBV would benefit from developing a cyber map of the financial system; mapping is currently not in place. - Mapping financial and technology connections helps identify potential systemic risks from interconnectedness and concentrations and identify key nodes (e.g., payment and settlement system, clearing services, underpinning technology systems). - Banxico carries out analysis of interconnectedness in the financial system; expanding this into the cyber domain would assist in managing potential systemic cyber risk. - Banxico and CNBV have not analyzed and documented the different transmission channels that could trigger financial instability via cyber-attacks, nor the range of different contagion scenarios. - Example transmission channels noted by staff: participant banks connecting into Banxico infrastructure (e.g., SPEI system); cloud providers and financial market infrastructures. - Example contagion scenario noted by Banxico: disruption to the most critical services (e.g., open market operations or payment systems services). - The Financial System Stability Council (CESF) determined in the last months of 2019 to carry out a stress test exercise considering a scenario with the materialization of a cyber incident; execution was suspended due to the COVID-19 outbreak. - CNBV carries out a capital adequacy assessment exercise that includes a cybersecurity section, but this exercise does not currently inform the pillar one capital charge determination. - CNBV’s cyber stress tests do not include impact calculations on capital and liquidity buffers; data scarcity and modeling difficulties are noted, though research and early examples exist. - From Banxico’s perspective, cyber stress testing can assist FMIs evaluate their ability to withstand cyber incidents with potential systemic impact; a key scenario is disruption of payments. CPMI-IOSCO expects the FMI to honor critical payment obligations by the end of the value date in the event of a cyber incident. ### Outsourcing and third-party risk - Banxico and CNBV have strong controls to ensure financial entities manage outsourcing and third-party risk. - Banxico cannot directly access third-party service providers of supervised entities but can oblige financial entities to include specific contractual requirements with critical third parties. - CNBV’s regulatory suite empowers CNBV to manage risks from third-party service providers and requires: - Financial entities to ensure contractual clauses that allow CNBV to carry out inspections of third-party service providers, or financial entities themselves to carry out audits of the third parties. - Financial entities to report to CNBV, in advance, any change in the core activity of the service provider to allow an evaluation and subsequent approval. - Financial entities to ensure that third-party service providers are subject to strict confidentiality terms regarding the operations of the financial entity and clients’ information. - Financial entities to evaluate the criticality of the outsourced service and estimate the impact that it would have on their operations if that provider would no longer be available. - Financial entities to establish policies for the proper management, control and security of information related to third-party services. - Contracts to stipulate restrictions and conditions of sub-contracting by the third party. - CNBV to approve the outsourcing to third-party service providers. *Source: Box 1. Mexico: Responsibilities of DG-ISS and DG-OTR at CNBV* ### 43. In the case of banks and financial technology firms, the regulations apply to the use of ### 1mexea2022005 - 43. In the case of banks and financial technology firms, the regulations apply to the use of ### Cloud outsourcing and cross-border data/transmission requirements - Banks and financial technology firms must notify CNBV in advance (for approval) if they seek to outsource to a cloud provider in a foreign jurisdiction. - Conditions for foreign cloud providers: - The cloud provider must be based in countries whose internal law provides client’s data protection, safeguarding their confidentiality, or there must be an international agreement with Mexico in such matters. - Their financial supervisory bodies must have collaboration agreements with the Mexican financial authorities for the exchange of information. - When contracting foreign providers, banks must assure CNBV that by contracting such services: - (i) their regulatory compliance is not at risk, - (ii) the business practices of the third-party service provider are consistent with those of the entity itself, and - (iii) there would be no impact on the financial stability or operational continuity of the entity, due to the geographical distance or language. ### CNBV’s visibility on third-party and cloud migration - CNBV collects information related to all third-party service providers but: - Does not maintain a specific database of critical third-party service providers of systemically important financial entities. - Does not have a specific list or database to quantify the percentage or number of its supervised financial entities that have migrated to the cloud. - Risks identified: - Large and concentrated third-party service providers can act as a transmission channel for financial instability, particularly if subject to a major cyber incident causing operational disruption or data loss across a large customer base. - Recommendation specific to CNBV: - CNBV should maintain a specific database of third-party service providers of systemically important financial entities. - CNBV should conduct analysis to identify the critical third-party service providers and determine whether there is concentration risk in the Mexican financial system. - Additional operational recommendation: - Aggregating the list of third-party service providers (including cloud providers) and integrating it into the cyber map would enable CNBV (and Banxico) to identify critical nodes, determine concentration risk, and build contagion scenarios to inform policy decisions to reduce systemic risks. ### Joint recommendations for Banxico and CNBV (paragraph 45) - Develop a cyber map of the financial sector, which includes identification of critical service providers to FMIs and financial entities. - Analyze the different transmission channels and document a range of different contagion scenarios. - Analyze the steps that financial institutions have taken to secure the information transmitted and to establish accountability rules for all point-to-point connections between all systems. - Develop playbooks and conduct exercises, and consider potential stress testing scenarios, based on these scenarios. - In developing the cyber map, Banxico and CNBV could consider the approach in Figure 1 (as presented in the source). ### FMI cyber oversight landscape and statutes - Banxico’s roles: regulator, overseer, operator, and user across national FMIs. - Four statutes authorizing Banxico to oversee FMIs: - (i) the Banxico Law, - (ii) the Payment Systems Law, - (iii) the Securities Market Law, - (iv) the Transparency and Regulation of Financial Services Law. - Banxico has formal oversight responsibilities for: SPEI, SIAC, CCEN, Clearinghouses for card transactions, Clearinghouses for mobile payments, Banxico’s Derivative Trade Repository; and joint oversight-supervision responsibilities for DALI, CCV and Asigna with CNBV. - Oversight is carried out by the oversight division within DGSPIM; the division is staffed with FMI overseers but lacks dedicated cyber specialists and works closely with DCIB for technical expertise. ### Gaps and improvements needed in Banxico’s cyber oversight - Identified weaknesses: - No formal external oversight of Banxico-operated systems (e.g., SPEI), although internal rules apply for non-financial risks, business continuity and cybersecurity for systems operated by Banxico. - FMIs under Banxico’s mandate are not subject to specific, harmonized, and enforceable cyber guidelines or expectations—including DALI, CCV, and Asigna. - FMIs have not been assessed for their cybersecurity through offsite nor onsite oversight. - No structured process and methodology for cyber onsite and offsite oversight of the FMIs. - Banxico and CNBV have not conducted any joint cyber oversight of DALI, CCV, and Asigna. - Despite gaps, Banxico applies a three lines of defense model for Banxico-operated systems (including SPEI): - The model includes operations, risk management, internal control/compliance and internal audit. - Security requirements are based on NIST 800-53 and ISO 27000. - The DCIB issues cybersecurity requirements for the SPEI system operation and reviews compliance as a second line of defense. - The second line validates 136 security controls, which encompass people, processes, and technology, and assesses the effectiveness of these controls on a 3-year workplan to ensure all controls are reviewed within this timespan. - Internal audit reviews Banxico systems every two years as part of their audit plan. - Policy recommendation: - Banxico should adopt the CPSS-IOSCO PFMIs and ensure these principles are, at a minimum, applied consistently to all systemically important payment systems, CSDs, SSS, CCPs, and TRs to improve observance of Responsibility A and D of the PFMI. ### Banxico supervision of participants into Banxico infrastructure - Banxico has set security requirements for participant banks connecting into Banxico infrastructure, based on NIST 800-53 and ISO 27000. - Supervision methods: - Off-site supervision: reviews cybersecurity controls in telecommunications and computer infrastructure and systems applications using information that financial entities provide; questionnaires use yes or no questions and require supporting evidence. - On-site examinations: visits to facilities to verify compliance; inspectors can conduct interviews and gather evidence; entities must prepare working plans to remediate findings. - Controls evaluated in offsite and onsite reviews include: - Cybersecurity organizational structure - Access control - Internet access - Network segmentation - Network access - Antivirus and malware protection - Vulnerability assessment and management - Penetration test assessment for third parties - Software and services management - Cyber incident response and report - Encryption of sensitive information - Integrity and non-repudiation mechanisms - Encrypted communications - File Integrity monitoring - Audit logs - Activity metric: - Since 2018, Banxico has conducted 126 reviews of financial entities’ cybersecurity compliance with the system rules. - Observed coordination gap: - Results of reviews conducted by Banxico are not shared with CNBV, the prudential supervisors of these financial entities. ### CNBV cyber regulation and supervision gaps - Current scope: - CNBV has regulation on cybersecurity only for banks, brokerage houses, and financial technology institutions. - Significant entities under CNBV’s supervision are not currently subject to enforceable cyber regulation or guidelines. - Regulatory fragmentation: - Current regulation applicable to banks spans approximately 600 pages and cybersecurity/technology requirements are scattered throughout, making it difficult to access a clear suite of requirements. - Core regulatory requirements for banks (current regulation focuses on): - implementing an Internal Control System for Information Security. - designing, implementing, and maintaining a strategy. - designing and executing penetration tests and vulnerability scanning, and their respective remediation plans. - designing, implementing, and monitoring information security training programs. - roles and responsibilities of a Chief Information Security Officer (CISO). - roles and responsibilities of the CEO. - operation and security configurations of each component of the infrastructure, from acquisition or development to implementation, changes and, where appropriate, replacement. - security measures for components of the infrastructure. - security measures for the information that is transmitted, stored, and processed (including identification and authentication mechanisms, encryption processes, access keys, controls for physical access, environmental and electrical energy controls). - assessing information security risk level through key risk indicators. - security measures for transactions’ end points. - backups and recovery of information. - audit trails. - information security incident management processes. - setting up an incident response team. - mechanisms to prevent the loss, alteration, and extraction of information. - processes to measure and ensure availability levels and response times. - manual and automated mechanisms to detect and prevent information security events and incidents. - Planned improvements: - CNBV is undertaking a regulatory initiative to update and standardize existing cyber regulation and to extend it to other sectors by developing a single, unified regulatory document containing all relevant cybersecurity aspects applicable to financial entities. Timelines are unclear. - Suggested categories to cover: governance; risk assessment and identification; protection; detection; response and recovery; testing; outsourcing; and situational awareness. ### CNBV supervisory practice shortcomings and recommendations - Shortcomings in CNBV’s cyber supervision: - CNBV only started cyber onsite inspections in April 2022, largely due to resource limitations. - CNBV has developed effective supervisory manuals/processes and a robust methodology “Rating of Financial Entities with an Information Security Risk Approach” (CEFER-SI), which provides a basis for future cyber supervision. - CNBV relies heavily on offsite supervision but lacks adequate processes and tools to administer offsite supervision comprehensively. - Financial entities have not provided CNBV with any self-assessment against the regulations; regulatory information provided is limited in scope and does not allow comprehensive monitoring of cybersecurity posture. - CNBV does not use third-party independent reviews as part of its supervisory toolkit; such reviews could increase assurance and efficiency given resource constraints. - Examples from other jurisdictions indicate supervisors may have powers to mandate independent reviews at the expense of the entity (e.g., U.K. Banking Act 2009 and ECB SIPS Regulation). - Banxico and CNBV have not conducted any joint cyber supervision of DALI, CCV, and Asigna. _Italic source: excerpts from 1mexea2022005 (IMF staff)._ ### 60. Given the interconnectedness of the financial entities under the mandate of CNBV, it is ### 1mexea2022005 - 60. Given the interconnectedness of the financial entities under the mandate of CNBV, it is ### Cyber regulation and supervision: overall findings - CNBV must establish a comprehensive cyber regulatory framework and operationalize a cyber supervisory framework combining effective offsite, on-site, and thematic supervision using a diverse range of tools. - Regulation and supervision should set consistent minimum standards for financial entities, promoting good cyber hygiene and setting expectations for: - risk management practices; - incident reporting; - response and recovery protocols; - internal governance procedures. - Effective cyber regulation and supervision would allow CNBV to identify entities with weak cybersecurity and take appropriate remedial action, increasing overall financial system resilience. ### FMI cyber risk oversight (Banxico) — findings and recommended actions - Enhance cyber risk oversight of FMIs significantly. Specific recommended actions for Banxico: - Provide cyber training to its FMI overseers, and as needed, leverage capacity and expertise on cybersecurity in the DCIB and the authorities' cyber strategy. - Set clear regulatory requirements for all FMIs under its mandate, leveraging the CPMI-IOSCO cyber guidance and the new enhanced cyber strategy. By setting clear requirements, Banxico will: - (i) provide its overseen FMIs with detailed steps on how to operationalize the CPMI-IOSCO guidance, ensuring they are able to foster improvements and enhance their cyber resilience over a sustained period of time; - (ii) establish a clear basis against which it can assess the FMIs it is responsible for; and - (iii) provide the basis for a meaningful discussion between the FMIs and the overseers. - When establishing these expectations, Banxico should ensure they are communicated clearly to the FMIs. - Develop and operationalize a more structured and comprehensive cyber oversight approach using a diverse portfolio of tools and techniques to assess against the set requirements, culminating in clear conclusions and identifying specific remedial measures and/or thematic findings that can lead to future action. Toolkit may include, but is not limited to: - questionnaires; - self-assessments; - desktop reviews of documentation; - on-site inspections and walkthroughs; - technical reviews (“deep dives”) on key risk areas. - Collaborate with CNBV to operationalize oversight responsibilities for DALI, CCV, and Asigna, setting clear regulatory requirements and developing an effective process for overseeing and supervising these FMIs. - Note: Banxico should take note of issues reported to the CPMI-IOSCO Level 3 assessment relevant to Mexican FMIs, including development of cyber response and recovery plans to meet the two-hour recovery time objective, cyber resilience testing, comprehensive scenario-based testing, and inclusion of FMI participants, critical service providers and linked FMIs in testing of response, resumption, and recovery plans. ### Organizational and resourcing recommendations - The payment system oversight division within DGSPIM should be given adequate independence and resources to conduct thorough oversight of the Banxico operated systems (e.g., SPEI), or oversight should be conducted in any other organizational arrangement Banxico defines. - Independence should ensure clear separation between the overseer of the SPEI and the operator of SPEI to avoid conflicts of interest and establish a level playing field. A central bank should protect confidential information collected in its role as overseer and avoid misuse. ### CNBV supervisory approach — findings and recommendations - CNBV should issue enforceable guidance or regulation to all supervised entities on cyber risk, based on international standards and best practices. - CNBV should follow a more structured approach for cyber supervision, including: - more intrusive on-site cyber risk inspections; - a more structured approach to offsite supervision; - utilization of a diverse portfolio of assessment tools and techniques to reach clear conclusions and identify remedial measures and/or thematic findings. - Given resource limitations, CNBV should consider maximizing assurance via independent third-party reviews (conducted by auditors) as a supervisory tool. - Recommended toolkit for CNBV cybersecurity assessment may include: - questionnaires; - self-assessments against the regulation; - desktop reviews of documentation; - on-site inspections and walkthroughs; - technical reviews (“deep dives”) on key risk areas. ### Monitoring — threat intelligence collection and analysis - Banxico gathers cyber threat intelligence from three types of sources: - (i) open sources like the internet, social media, deep web and dark web; - (ii) sources like Group-IB (their current commercial threat intelligence provider), the Financial Services Information Sharing and Analysis Center (FS-ISAC) and SWIFT ISAC; - (iii) other authorities, both domestic (e.g., CERT-Mexico) and international (e.g., OSSAT). - CNBV gathers cyber threat intelligence from three types of sources: - (i) open sources like Internet, social media, deep web and dark web; - (ii) commercial sources like Minsait (their current commercial threat intelligence provider); - (iii) other Mexican financial authorities, such as CERT-Mexico. - CNBV also receives security event and incident information from reports of supervised entities. - Banxico and CNBV confirmed cyber threat evolution during the COVID-19 crisis mirrored other jurisdictions, including DDoS attacks, ransomware, advanced persistent threats (APTs) in electronic funds transfer applications, and ATM malware injection combined with physical damage to devices. During the pandemic, ransomware was a major concern for financial entities in Mexico. - Both authorities have a broad range of sources and, combined with incident information, have a good basis to understand the threat landscape. However, they could improve analysis by combining sources to develop a Generic Threat Landscape (GTL) Report that: - elaborates on the specific threat landscape of the Mexican financial system, considering geopolitical and criminal threats unique to the jurisdiction; - considers key financial market participants and their critical functions (wholesale and retail banks, broker-dealers, FMIs, financial market utilities, and other critical third parties); - details threat actors (including tactics, techniques, and procedures) and common vulnerabilities; - supports scenario development, playbooks, and exercising to foresee attack patterns and prepare defenses. ### Red team testing - Banxico conducts red team tests but scope has been limited to specific applications and systems. - A full-scope red team test is recommended to test the full range of protection, detection, and response controls across Banxico’s central infrastructure to identify weaknesses and vulnerabilities needing remediation. ### Incident reporting — 2020–2021 incidents (Table 3 summary) - 2020 incidents (ransomware): - Ransomware — Targets: Internet banking — Estimated losses: Pending — Servers of a commercial bank were infected with ransomware. - Ransomware — Targets: Bank tellers — Estimated losses: Pending — Computers of a commercial bank branch were infected with ransomware. - Ransomware — Targets: Dispersal of funds — Estimated losses: Pending — Servers of a brokerage firm were infected with ransomware. - Ransomware — Targets: Internet banking, foreign exchange operations, dispersal of funds — Estimated losses: Pending — Servers of a financial group were infected with ransomware. - 2021 incidents: - Infrastructure — Targets: ATM — Estimated losses: 0.63 — ATMs of a credit institution were attacked. - Infrastructure — Targets: ATM — Estimated losses: 0.13 — ATMs of a credit institution were attacked. - Ransomware — Targets: Internet banking — Estimated losses: Pending — Servers and terminals of a credit institution were infected with ransomware (REvil, also known as Sodinokibi). - Infrastructure — Targets: ATM — Estimated losses: 8.10 — ATMs of a credit institution were attacked. - Infrastructure — Targets: ATM — Estimated losses: 0.80 — ATMs of a credit institution were attacked. - Infrastructure — Targets: ATM — Estimated losses: 3.01 — ATMs of a credit institution were attacked. - Infrastructure — Targets: Transfers on branches — Estimated losses: 474.40 — The transfer of funds on branches system of a credit institutions and its brokerage firm. - Infrastructure — Targets: ATM — Estimated losses: 4 — ATMs of a credit institution were attacked. - Infrastructure — Targets: ATM — Estimated losses: 0. 73 — ATMs of a credit institution were attacked. - Applications — Targets: ATM — Estimated losses: 79 — The funds transfer application of a credit institution was attacked to withdraw cash from ATMs without the need of a card. ### Response and recovery — exercises and preparedness - Banxico has conducted two cyber crisis simulation exercises during 2021, including the five systemically important banks, with two consultants assisting. Table-top scenarios included ransomware, APT attack, and data breach in Banxico IT infrastructure supporting: - (i) international funds transfers to administer the international Reserves; - (ii) auctions for monetary policy implementation; - (iii) the web-based regulatory information reporting system. - Exercises tested incident response, communication, crisis management, and recovery capabilities; they were well structured and provide a basis for further exercises. - CNBV has not been involved in industry-wide cyber crisis simulation exercises and does not coordinate exercises with supervised entities. CNBV participated in a March 2021 exercise by other federal agencies and CERT-Mexico (financial entities did not participate). CNBV exchanged public keys for secure distribution of information and assessed a simulated attack impact with participants. - CNBV intends to carry out a cyber crisis simulation exercise with some financial entities as part of Pacific Alliance international collaboration initiatives. - Industry-wide cyber crisis simulation exercises aim to rehearse collective response to major operational disruption by: - testing effectiveness of decision-making and crisis communication arrangements; - validating collective contingencies; - enabling participants to practice response protocols; - improving sector-level response coordination between public and private entities and other jurisdictions. - Recommendation: Banxico and CNBV should conduct regular exercises with each other, other authorities, and a broader selection of financial entities (e.g., banks, FMIs, insurance companies, third-party providers). ### Crisis communications and playbooks - CNBV has not documented crisis communication protocols or playbooks for different cyber scenarios. - Banxico has crisis communication protocols and developed playbooks for ransomware, advanced persistent threats, web attacks, data breaches, and denial of services based on exercises. - Recommendation: Conduct regular exercises to develop or enhance crisis communication protocols and playbooks and test their effectiveness. ### Information sharing — findings and recommendations - Banxico participates in international information sharing groups (FS-ISAC, SWIFT ISAC, OSSAT), but there is no effective industry-wide information and intelligence sharing network in the Mexican financial sector. - The Bases of Coordination sets out requirement for public and private sector collaboration to strengthen financial system cybersecurity, including information sharing, but this requirement has not been fully operationalized. - Positive steps: - A consortium of seven large banks from the ABM established an information sharing network among themselves. - Banxico is setting a MISP instance to connect into the information sharing network run by the ABM. - Challenges: - The consortium network excludes most financial entities in Mexico. - Market reluctance to share information in a network that may include regulators and supervisors. - Recommendation: Financial entities should have effective cyber threat intelligence processes and actively participate in information and intelligence sharing arrangements with trusted stakeholders. Banxico should engage with the financial sector to develop an industry-wide information and intelligence sharing network to leverage collective knowledge for threat-informed defensive and mitigation strategies. ### Consolidated recommendations (selected) - CNBV: establish comprehensive cyber regulatory and supervisory frameworks; issue enforceable guidance/regulation; adopt structured, intrusive supervision supported by a cybersecurity assessment toolkit; consider independent third-party reviews where appropriate. - Banxico: provide FMI cyber training; set clear regulatory requirements for FMIs aligned with CPMI-IOSCO guidance; develop and operationalize structured oversight with diverse tools; collaborate with CNBV on FMI oversight (DALI, CCV, Asigna); conduct a full-scope red team test; conduct regular market-wide cyber crisis simulation exercises with CNBV and broader sector participation. - Both authorities: develop a Generic Threat Landscape (GTL) Report; conduct regular market-wide cyber crisis simulation exercises; improve industry-wide information sharing arrangements; document crisis communication protocols and playbooks. *Source: 1mexea2022005 - 60. Given the interconnectedness of the financial entities under the mandate of CNBV, it is* ### 82. Banxico and CNBV have comprehensive cyber incident reporting regimes in place. ### 82. Banxico and CNBV have comprehensive cyber incident reporting regimes in place. ### Overview and key findings - Banxico and CNBV have established cyber incident reporting regimes; financial entities must report cyber incidents to their respective financial authorities. - The authorities collect routine data on cyber incidents. - Banxico has a documented incident response framework and crisis communication protocols; CNBV does not have documented crisis communication protocols and currently relies on informal incident management processes led by its cyber supervision unit. - CNBV coordinates with Banxico to publish a summary of incidents by year on the central bank’s website. ### Definitions and severity criteria (as used in reporting) - Banxico incident definition (from the Bases of Coordination): - “An assessed event that actually or potentially jeopardizes the confidentiality, integrity or availability of a component or the entire technology infrastructure or information that is processed, stored or transmitted; that may represent a loss, alteration or misplacement of information; or that constitutes a violation or an imminent threat of violation of the security policies, security procedures or acceptable use policies; that may result in interruption of the service or in damage or loss to the customers of the affected Entity, to the general public, to its counterparties or to the Entity itself”. - CNBV incident definition: - “Any event, internal or external, that: compromises the confidentiality, integrity, or availability of information; vulnerates the technology infrastructure compromising the information that it processes, stores or transmits; or constitutes a violation of information security policies and procedures”. - Both Banxico and CNBV categorize severity using the Bases of Coordination criteria: - (i) Impact on: - More than one Entity; - Customers of the Entities; - The stability of the financial system, or, - To central payment systems, clearing houses or central securities depositories; - (ii) Features: - Generates economic loss, loss of information or interruption of the services of the Entity in question; - Its mode of operation can be replicated in other entities; - May represent a high reputational risk for the Entities or other participants in the financial system, or, - May generate public distrust. ### Data fields collected during incident reporting - Banxico requires financial entities to report: - Date of incident - Financial institution involved - Breach description - Services affected and financial loss - CNBV requires financial entities to report: - Date of incident - Duration of incident - Description - Impact assessment to systems, networks, protocols, services, customers, reputation, and financial loss - Amount recovered - Reports to other authorities - Number of records exposed - Threat vector, vulnerabilities exploited and malware signatures - Containment actions taken - Results of recovery actions and any other information shared by entities ### Channels, templates, and reporting outputs - Both Banxico and CNBV: - Issue a cyber incident reporting template to supervised entities. - Use Email as the channel of communication for reporting. - CNBV coordinates with Banxico to publish an annual summary of incidents on the central bank’s website. ### Recommendations (operational and policy) - From paragraph 84 (Banxico): - Banxico should work with the financial sector to develop and operationalize a cyber information and intelligence sharing network, taking a structured approach and engaging closely with the industry. Recommended actions include: - Drafting a Terms of Reference and Rulebook for its participants. - Developing an operational platform (e.g., MISP) and creating a CISO network for in-person meetings to foster trust and sharing. - Detailing the types of strategic, operational, and tactical information and intelligence to be shared. - Setting out the principles for sharing and analyzing information. - The network should include a broad range of financial entities and exclude supervisors and regulators to address industry concerns about sharing freely without potential supervisory repercussions, while still providing authorities with key information if a cyber threat could become systemic. - From paragraph 85 (CNBV): - CNBV should develop and document crisis communication protocols, setting out the roles and responsibilities of all relevant stakeholders during an incident, and procedures to manage an incident, whether domestic or international. - From paragraph 90 (collaboration with law enforcement and FGR): - Banxico and CNBV could propose working with law enforcement agencies and the FGR to improve forensic investigation and criminal prosecution processes by: - Issuing guidance for financial entities on how to store, handle and administer evidence to facilitate investigations. - Fostering the development of guidance by the FGR for financial entities on how to file a complaint and collaborate on the investigation. - Raising awareness amongst law enforcement agencies and the FGR on the importance of effective investigations of cyber incidents in the financial sector. ### Cyber deterrence, legal framework, and investigative challenges - Existing legal instruments addressing cybercrime in Mexico include: - The Federal Penal Code (defines crimes of federal jurisdiction, including "Disclosure of secrets and illicit access to computer systems and equipment."). - State Penal Codes (establish crimes of local jurisdictions, including, in some cases, those related to cybercrimes). - Laws on financial entities (e.g., the Credit Institutions Law) that define crimes of federal jurisdiction committed against such entities, including those related to cybercrimes. - The Organic Law of the Judicial Power of the Federation (establishes rules to determine when investigation, prosecution, and punishment of crimes, including cybercrimes, are of federal jurisdiction). - The National Code of Criminal Procedures (establishes rules to be observed in investigation, prosecution, and punishment of crimes, including cybercrimes). - Authorities are considering a Cybersecurity Law to legislate cybercrimes at the federal level to address fragmentation. - Key challenges identified (paragraph 89): - Financial entities are reluctant to formally file a criminal complaint with the FGR following a cyber incident because it may lead to confiscation of key servers and hardware, which may hinder operations. - Investigators and prosecutors lack the technical expertise to analyze the crime and forensic evidence. - Crimes surrounding cybercrime are not clearly defined in law due to fragmentation across different laws. - There is a lack of guidance for financial entities on how to store, handle and administer evidence to facilitate investigations. - Institutional roles: - Clause 7 of the Bases of Coordination establishes that the FGR is responsible for investigating cybercrimes on financial entities based on forensic investigations and thereafter prosecuting cybercriminals, collaborating with financial authorities and entities through the Office of the Special Attorney for Federal Crimes Investigation (Subprocuraduría Especializada en Investigación de Delitos Federales—SEIDF). *Source: MEXICO, INTERNATIONAL MONETARY FUND.* --- _Source: https://www.imf.org/-/media/files/publications/cr/2022/english/1mexea2022005.pdf_