EN
Contact us

Regulatory · BCB 85/2022

Cybersecurity Policy

Cumbuca's main cybersecurity guidelines, aligned with the institution's size, risk profile and business model. They guide the management of information systems and ensure the confidentiality, integrity and availability of data and services.

Version
1.0
Date
March 2023
Owner
Information Security

Courtesy translation. The Portuguese version is the legally binding document.

Objective

To present the main cybersecurity guidelines aligned with Cumbuca's size, risk profile and business model. The policy guides the management of information systems and ensures the three fundamental pillars: confidentiality, integrity and availability.

Overview

Cumbuca provides payment and financial organization services, which require secure communication channels between users and systems, with effective controls and with this policy implemented across the entire operational chain.

Scope

Applies to all stakeholders in the procedures Cumbuca adopts to protect data and systems, including employees, service providers, suppliers, integration partners and end users.

Applicable rules and standards

The policy observes the following regulatory framework:

  • Law No. 13,709/2018 (LGPD), the General Personal Data Protection Law
  • Law No. 12,965/2014, the Brazilian Internet Civil Rights Framework
  • CMN Resolution No. 4,893, of February 26, 2021
  • BCB Resolution No. 85, of April 8, 2022
  • Internal standards reviewed periodically by the Information Security team

Guidelines

Cumbuca operates under the following guidelines, audited at least annually by the Information Security team:

  1. Dedicated team for cyber protection, with formally assigned responsibilities
  2. Secure data management across the full lifecycle (collection, processing, storage, disposal)
  3. Periodic training of employees in cybersecurity and data protection
  4. LGPD compliance in every process involving personal data
  5. Secure software development, with code review, static analysis and security testing
  6. Malware protection on workstations, servers and applications
  7. Data integrity through checksums, immutable logs and audit controls
  8. Continuous monitoring of the infrastructure, with automated alerts for anomalous events
  9. Access management based on least privilege and periodic review
  10. Information classification by sensitivity, with proportional controls
  11. Partner due diligence, cyber risk analysis before integration
  12. Incident prevention, with playbooks and periodic simulations
  13. Business continuity plan (BCP) with defined RTO and RPO targets
  14. Technological control of endpoints, network and remote access
  15. Prevention of unauthorized disclosure of information (DLP)
  16. Incident response with timely notification to regulators where applicable
  17. Continuous review of critical suppliers and supply-chain dependencies

Maintenance

This policy is reviewed at least annually, or whenever there are relevant regulatory updates, significant changes to the business model, or security incidents that call for a review of controls.

Contact

Vulnerability reports, incidents or questions about this policy should be addressed to the Information Security team:

Information security
security@cumbuca.com
Responsible disclosure
/.well-known/security.txt