The classification of data as to relevance must be done according to guidelines defined in the Cyber Security Policy (article 3, V, “c”). The standard does not define which types of data are to be considered relevant.

At the very least, registration data and information enabling identification of clients or their transactions and positions must be considered relevant/sensitive (article 35-E, sole paragraph).

The Policy should bring in a number of provisions on cyber security, including vulnerability assessment, cyber security objectives, and specific procedures for them to be met (article 3).

The Policy should also provide for a mapping of the cyber risks to which the brokerage firm is exposed (article 35-H, I).

The classification of incidents as to relevance must be established in accordance with the guidelines defined in the Policy (article 3, V, “d”). There is no definition of the types of incidents that should necessarily be deemed relevant.

As a minimum, incidents affecting critical processes or sensitive information, as well as those with significant impacts on clients must mandatorily be considered relevant (article 35-D, paragraph 4).

The Policy should provide for procedures to be adopted in the event of relevant incidents, but the standard does not define minimum mandatory procedures, but only requires provisions on mitigation of effects of incidents and business continuity in risk management policies. Specific actions would be defined in the Policy (article 19 and 20).

Guidelines should also be established to carry out business continuity tests, but there is no mandatory minimum frequency (article 3, V, “a” and article 19, III).

In the procedures defined in the Policy, internal and external communication actions should be included, including those aimed at clients and managers of organized markets. Also specified are some services that must necessarily be covered by continuity plans: receipt and execution of client orders, settlement with clearing houses and clients and reconciliation of positions (article 35-A).

In addition, a minimum frequency of one year has been established for continuity tests (article 35-A).

The BCB should be informed of relevant incidents causing a crisis at the institution. In theory, if an incident is not provided for in the Policy as relevant, it need not be reported.

The minimum content of the communication is the information on the occurrence and the measures taken to remedy it (article 20, III).

In addition to material incidents (including those affecting critical systems and having a significant impact on clients), episodes that cause the triggering of continuity plans, whether defined as material incidents or not, must be reported to the CVM's Market and Broker Relations Bureau (SMI) (article 35-A, paragraph 4, article 35-C, paragraph 1, and article 35-I, paragraph 1).

The minimum content of the communication to the SMI is more extensive. In addition to a description of the incident and the remedial measures, the following must be included: (i) the data affected, (ii) the clients potentially affected, and (iii) the time taken to resolve the event or deadline for doing so, as well as any other relevant information (article 35-A, paragraph 4, article 35-C, paragraph 1, and article 35-I, paragraph 1).

The Policy should provide for training programs and personnel evaluation as mechanisms to disseminate the culture of cyber security (article 3, VI, "a"), without further specification in that regard.

The frequency of training becomes mandatory content in the Policy (article 35-D, paragraph 2, III).

The Policy shall be disclosed in its entirety to employees and third parties. An abstract should be published on the institution's website (articles 4 and 5).

The content to be published on the website must contain, as a minimum, guidelines on the main practices adopted, including access controls and confidentiality of personal information, and cyber security precautions to be taken by clients when accessing their systems (article 35-G).

An annual report shall be prepared on the effectiveness of the implementation of the Policy, the results obtained in the performance of prevention and response procedures, the relevant incidents that occurred in the period, and the results of business continuity tests (article 8).

The annual report shall also contain statements by the officer in charge regarding the deficiencies found and the remedying thereof; the results of the remedying of deficiencies found in prior years; a reasoned evaluation of the compliance with ICVM 505; and an evaluation on the adequacy of the business continuity plan and any improvements (article 4, paragraph 7).

It does not bring in any specific obligation regarding critical systems, although this topic is already partially covered in some points of the Policy, especially in the procedures and controls adopted to reduce the institution's vulnerability (article 3, paragraph 2).

Specific policies should be created for critical systems to ensure their integrity, security, and availability, including guidelines for assessing the relevance of incidents (article 35-C).

Regarding the hiring of third party services in general, the Policy should provide guidelines for the definition of procedures and controls adopted by providers handling sensitive or relevant data of the institution (article 3, V. “b”).

There are a number of rules for engaging cloud services, including various pre-contract checks, mandatory contract terms, reporting to the BCB, and permits to be obtained, among others (article 11 to 17).

Brokerage firms must list the most relevant providers and assess their ability to store the information required by ICVM 505 and keep it available to the SMI. They must also assure the institution’s access to the data processed and the confidentiality, completeness, availability, and recoverability of the data (article 35-J).

Contracts with cloud providers must also comply with the requirements of Resolution 4,658/2018.

It provides a list of the information that must be available to the BCB for a period of five years (article 23).

The rule is broader: brokerage firms must store and keep at the SMI's disposal all documents related to compliance with ICVM 505, in addition to all internal or external correspondence and all work papers, reports, and opinions related to the exercise of their functions, whether physical or electronic, as well as all recordings of conversations with clients (article 36).