## TRINIDAD AND TOBAGO — STRENGTHENING CYBERSECURITY IN FINANCIAL INSTITUTIONS

## Source details

**Canonical URL:** [TRINIDAD AND TOBAGO — STRENGTHENING CYBERSECURITY IN FINANCIAL INSTITUTIONS](https://www.imf.org/-/media/files/publications/hls/2023/english/hlsea2023003.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/hls/2023/english/hlsea2023003.pdf.md)
- [Structured JSON version](/-/media/files/publications/hls/2023/english/hlsea2023003.pdf.json)

---

### Abstract
- Central Bank of Trinidad and Tobago requested for technical assistance to: (i)  strengthen the cybersecurity posture of the Central Bank, and (ii) strengthen the cybersecurity of the financial institutions.  
- The mission provided support in a project aimed at enhancing its cybersecurity posture focusing on governance and Identity and Access Management (IAM), provided guidance in drafting a guideline applicable to financial institutions and conducted a seminar on regulations.  
- The recommendations focused on strengthening governance aspects, defining the IAM project and drafting a regulation for the financial institutions.  
- JEL Classification Numbers: G21, G28  
- Keywords: Cyber risk, Cybersecurity, Identity and Access Management

### Background
- The Central Bank of Trinidad and Tobago (CBTT) requested technical assistance (TA) to: (i) strengthen the cybersecurity posture of the Central Bank, and (ii) strengthen the cybersecurity of the financial institutions under the supervisory ambit of CBTT and other financial sector regulators and build supervisory capacity for the effective supervision of cybersecurity of its regulated institutions.  
- In response, a TA mission visited Port of Spain, Trinidad and Tobago during the period October 31–November 4, 2022, to provide support to the CBTT in a project aimed at enhancing its cybersecurity posture focusing on governance and Identity and Access Management (IAM), providing guidance in drafting a guideline applicable to financial institutions, conducting a seminar on regulations, and assessing the supervisory capacity.  
- Other financial sector regulators included the Trinidad and Tobago Securities and Exchange Commission, the Commissioner of Cooperative Development, and the Financial Intelligence Unit of Trinidad and Tobago.

### Summary of Findings
- Cybersecurity governance at CBTT is set up according to generally accepted practices with recently updated policies and procedures.  
- Concerns identified by the Mission included:
  - Information Technology (IT) governance responsibilities comingled with the second line of defense.
  - Resource constraints.
  - Information security function reporting to IT function.
  - Less focus on payment systems other than SWIFT.
- The IAM project is in the preparatory stage, and the project arrangements were comparable to good practices observed elsewhere.  
- CBTT’s regulatory environment on cyber is marked by instructions being part of several guidelines in an indirect way in the absence of a dedicated guidance on the subject.  
- The seminar on cyber risk regulation contributed to building capacity to draft a guideline on the topic.  
- Supervisory practices pertaining to cyber risk need strengthening with focus on:
  - addressing resource constraints,
  - conducting regular risk-based onsite examinations,
  - setting up offsite supervision capabilities.

### Summary of Recommendations
- Strengthen the cyber posture of the CBTT as well as the financial institutions supervised by CBTT through the following:
  - Address weaknesses in the governance process, improve Board level discussions, increase resources, adopt security hardening baselines, and commission security reviews of payment system.
  - Define Phase II of IAM project, coordinate with business units to define access roles, ensure adequate resources in project management, and adopt a phased approach with good governing practices.
  - Draft a focused cybersecurity guideline based on seminar inputs and international best practices, allocate resources, improve supervisory intensity and practices.

*IMF | High Level Summary – Trinidad and Tobago Strengthening Cybersecurity in Financial Institutions | 2023 International Monetary Fund HLS/2023/03*

---


_Source: https://www.imf.org/-/media/files/publications/hls/2023/english/hlsea2023003.pdf_