Trinidad and Tobago: Strengthening Cybersecurity in Financial Institutions
High-Level Summary Technical Assistance Reports, April 17, 2023
Source details
- Canonical URL
- Trinidad and Tobago: Strengthening Cybersecurity in Financial Institutions
Other formats
Bibliographic details
- Authors: Tamas Gaidosch, Rangachary Ravikumar
- Published: April 17, 2023
- Series: High-Level Summary Technical Assistance Reports
- DOI: https://doi.org/10.5089/9798400237836.029
Overview
- Technical assistance report focused on strengthening cybersecurity in financial institutions in Trinidad and Tobago.
- Cybersecurity governance at The Central Bank of Trinidad and Tobago (CBTT) is set up according to generally accepted practices with recently updated policies and procedures.
- The Identity and Access Management (IAM) project is in the preparatory stage; project arrangements were comparable to good practices observed elsewhere.
- A seminar on cyber risk regulation contributed to building capacity to draft a guideline on the topic.
Key findings
- Governance and organizational issues
- Information Technology (IT) governance responsibilities were comingled with the second line of defense.
- The information security function reported to the IT function.
- Resource constraints were noted within CBTT.
- Less focus on payment systems other than SWIFT.
- Regulatory environment
- CBTT’s regulatory environment on cyber is marked by instructions being part of several guidelines in an indirect way in the absence of a dedicated guidance on the subject.
- Supervisory practices
- Supervisory practices pertaining to cyber risk need strengthening.
- Specific supervisory gaps include addressing resource constraints, conducting regular risk-based onsite examinations, and setting up offsite supervision capabilities.
Recommendations and mission focus
- Strengthen the cyber posture of CBTT.
- Strengthen the cyber posture of the financial institutions supervised by CBTT.
- Address identified governance weaknesses:
- Separate IT governance responsibilities from the second line of defense.
- Reconsider reporting lines for the information security function.
- Advance the IAM project from preparatory stage following observed good-practice arrangements.
- Develop dedicated cyber guidance/guideline drawing on capacity built from the seminar on cyber risk regulation.
- Enhance supervisory capacity:
- Address resource constraints for supervision.
- Implement regular risk-based onsite examinations.
- Establish offsite supervision capabilities for cyber risk monitoring.
Content in this bundle
- Trinidad and Tobago — Strengthening Cybersecurity in Financial Institutions