Banrisul has an IT Security Unit, USTI in Portuguese, reporting to the Technology and Innovation Office. The USTI is responsible for Banrisul\u2019s internal and external security culture and its structure supports Bank’s other Units in the design of new solutions and businesses. It is also responsible for proposing improvements to specific information security solutions.<\/p>\n\n\n\n
The Unit participates in the Corporate Risk, Internal Controls & Compliance Management, and Information Technology Management Committees to evaluate whether information and cyber security issues were complied with in the propositions, new business solutions, internal control and risk assessments, and IT implementation and projects.<\/p>\n\n\n\n
The USTI is also responsible for defining and maintaining the Information and Cyber Security Policy based on best practices and international standards, reinforcing the internal security and communication culture, establishing standards and rules to preserve the Bank’s assets and those of its customers. This policy should be reviewed at least every year.<\/p>\n\n\n\n
To meet the ongoing and growing IT security demands, prevent and mitigate potential impacts and remediate actual impacts, the USTI: <\/p>\n\n\n\n
These campaigns are run every year and widely disseminated to customers on Banrisul\u2019s social media and website, as well as to the Company’s staff on the Intranet. For the internal public, Banrisul released a new Distance Learning Program called Information Security, which includes the Security Manual for Working from Home. Banrisul has also been alerting its customers to IT security. The protective initiatives used by the Bank have prevented “Account Take-over” (ATO) attacks in which the hacker gains control of the customer\u2019s checking account.<\/p>\n\n\n\n
This continuous work allowed Banrisul to disseminate the culture of security, raising awareness and engaging all hierarchical levels, starting with senior management. Security processes and procedures to access service channels have been well accepted by customers. This shows that customers have embraced the security culture in their daily lives.<\/p>\n\n\n\n
Positive impacts include participation in technology events that discuss security and the receipt of awards for solutions and products with outstanding security features.<\/p>\n\n\n\n
The process used to verify the effectiveness of IT security actions are mostly related to compliance with the Information and Cyber Security Policy and feedback received through the business channels. The Policy is an important instrument to control and manage information security. It also lays down part of the actions taken by Banrisul to protect its IT assets.<\/p>\n\n\n\n
Banrisul has not recorded relevant security incidents over the last few years. This shows the efficiency of the Bank’s anti-fraud procedures for its products such as Open Banking and API Market Place.<\/p>\n\n\n\n
Setting Information Security goals, targets and indicators is a major challenge for Banrisul, as most of them are directly or indirectly susceptible to external factors or actions that depend on multiple parties.<\/p>\n\n\n\n
| \n Impact <\/th>\n | \n Classification (positive or negative) <\/th>\n | \n Event (potential or actual) <\/th>\n | \n Time frame (short-term or long-term) <\/th>\n | \n Systemic or one-time impact <\/th>\n | \n Irreversibility (high, medium, low - only for negative impacts) <\/th>\n | \n Production chain process or activity that causes impact <\/th>\n | \n Resources \/ stakeholder group impacted <\/th>\n <\/tr>\n |
|---|---|---|---|---|---|---|---|
| \n Loss of information security certificates <\/td>\n | \n Negative <\/td>\n | \n Potential <\/td>\n | \n Long-term <\/td>\n | \n One-time <\/td>\n | \n Medium <\/td>\n | \n Provision of human resources, materials and IT infrastructure to keep the certifications <\/td>\n | \n Shareholders and Investors, Employees, Community, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Optimization and process efficiency <\/td>\n | \n Positive <\/td>\n | \n Actual <\/td>\n | \n Medium-term <\/td>\n | \n Systemic <\/td>\n | \n - <\/td>\n | \n In activities and processes that make services available with greater practicality and speed. <\/td>\n | \n Shareholders and Investors, Employees, Customers, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Services provided with better quality <\/td>\n | \n Positive <\/td>\n | \n Actual <\/td>\n | \n Medium-term <\/td>\n | \n Systemic <\/td>\n | \n - <\/td>\n | \n Customer satisfaction and reduction in the number of complaints. <\/td>\n | \n Shareholders and Investors, Employees, Customers, Community, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Greater need for investments in new technologies and business process <\/td>\n | \n Positive <\/td>\n | \n Actual <\/td>\n | \n Medium-term <\/td>\n | \n Systemic <\/td>\n | \n - <\/td>\n | \n Quality of service provided. <\/td>\n | \n Shareholders and Investors, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n <\/table>\n<\/div> |