Kyrgyzstan National Bank Proposes Mandatory International Cybersecurity Certification for Banks

Kyrgyzstan's National Bank is proposing stricter cybersecurity requirements for commercial banks, introducing a mandatory international standard to bolster defenses against digital threats.

A draft resolution put forth by the National Bank mandates that all commercial banks adopt the ISO 27001 international information security standard. Under the proposed regulations, banks must submit a plan for certification by the fourth quarter of 2026 and achieve full compliance by December 31, 2028. This initiative is part of a broader effort to align the country's banking regulations with the new Law on Cybersecurity.

Beyond the ISO 27001 requirement, the proposed measures include mandatory reporting of all information security incidents to the National Bank. The regulations also call for enhanced protection of mobile applications and banking systems, stricter measures against fraud, and more rigorous oversight of third-party IT service providers. These updates are intended to increase the banking system's resilience to cyberattacks and reduce the risks associated with financial fraud.

The National Bank stated that these new requirements are crucial for preparing the banking sector for the introduction of Kyrgyzstan's digital currency, the digital 'som'. By strengthening cybersecurity protocols, the authorities aim to ensure the reliable operation of digital financial services and maintain public trust in the evolving financial landscape.