Australia |
Large liquidity buffer provides the flexibility to step away from markets for a number of weeks without impeding capacity of Government to meet its obligations. Overdraft facility available through the central bank as well. |
X |
|
as AOFM systems are housed within the Commonwealth Treasury's network we rely on their cyber security arrangements and leverage their reporting measures. Additionally, we comply with and report on the Attorney-General's Department's Protective Security Policy Framework, which requires us to monitor the cyber security arrangements of our service providers. |
Austria |
There is a fallback data center which houses the fallback system. In the case of an emergency this will be utilized to continue the regular business of the DMO. |
X |
|
Internal network ranges, applications and clients are managed by DMO staff. |
Belgium |
All of our payments are made by our national bank, so we mostly rely on their systems and the Target infrastructure. Our internal business continuity group does take into account situations where the normal exchanges and communications with our central bank are hampered. |
X |
|
The BDA relies on IT material, network and safety measures (a.o. firewall, parallel servers, …) of the Belgian State |
Brazil |
The major IT payments systems use a dedicated network environment, preventing from general cyberattacks. Also, there is a strong backup strategy to prevent data loss. |
X |
|
|
Bulgaria |
The Bulgarian National Bank acts as a fiscal and paying agent of the government and organizes the government securities auctions. The Ministry of Finance has established links with the Bulgarian National Bank. |
X |
|
|
Canada |
Cyber threats represent a continued vulnerability given the interconnected nature of the financial system. With the ongoing war in Ukraine, state-sponsored cyber-attacks are occurring with greater frequency and sophistication, increasing the risk of a successful attack on a Canadian financial institution or financial market infrastructure. Such an attack could have far-reaching effects on the broader financial system. The following measures are in place to address these contingencies: • Multiple Data Centres able to be leveraged. • Internal Cyber Response Team provides 24/7 monitoring and response capabilities and fully integrated into the Bank’s Incident Management Team. • DMO has contingency plans in place for alternate processing capabilities in the full/partial absence of technology. |
|
X |
• Fully functioning internal Cyber Security group. • Internal Cyber Response Team provides 24/7 monitoring and response capabilities and fully integrated into the Bank’s Incident Management Team. • We also work hand-in-hand with our federal governments Cyber Security departments and employ various third parties providing additional cyber protection (e.g., DDOS protection, etc.) |
Chile |
The back office functions are performed by our Treasury Department, which has a business continuity plan in case of cyberattack |
|
X |
|
Colombia |
There is an alternate site that has connection with the Central Bank. In the event of a cyberattack, operations will be carried out through the alternate site. |
|
|
|
Costa Rica |
The service providers for negotiation, placement, registration and payment of internal debt (and external only payment), which are the Central Bank of Costa Rica, the National Stock Exchange, activated contingency or business continuity mechanisms, so as not to interrupt the service at the country level. The internal processes of affectations and budgetary records, suffered problems, and delays due to the fall of internal systems of the Ministry of Finance.
The Technology Department of the Ministry of Finance immediately activates containment and recovery protocols for the systems, which have been implemented in environments with reinforced security measures to guarantee business continuity. |
|
X |
|
Croatia |
|
X |
|
|
Czech Republic |
|
X |
|
|
Denmark |
It’s outside our domain – But sufficient contingencies is in place. |
X |
|
The Centralbank handles these risk. |
Estonia |
Government owned IT systems have a central protection by government agencies. DMO operations depend also on the general internet connectivity (although some contingency procedures are also in place) and cyber security level of commercial banks/national central bank that are used for debt and other payments. |
X |
|
|
Finland |
We have implemented various measures to safeguard funding and payments during possible cyber attack. |
X |
X |
|
France |
We regularly improve our cyber security lines of defense. |
X |
|
Our cyber security is directly managed by the ministry of finance and economy. |
Germany |
We take several actions to prevent, detect and stop cyberattacks and to restore systems and data in case of incidents following the BSI IT-Grundschutzstandards |
|
X |
|
Greece |
Follow the procedures of the disaster plan |
X |
X |
|
Hungary |
-
Intraday database/file system back-up
-
Secondary location (geographically different from the DMO’s headquarters)
-
The possibility to hold auctions at the premises of the Budapest Stock Exchange
|
|
X |
|
Iceland |
|
|
|
|
Ireland |
Large cash balances Business continuity site |
|
X |
|
Israel |
The Government Debt Management Unit has emergency protocols; during cyberattacks there are alternative methods in place to maintain critical functionality |
X |
|
|
Italy |
Through a structured and collaborative model (with all government Entities in charge), which makes use of suitable professionals, custom software and hardware and software market products, all the activities that affect the infrastructures are analyzed daily and those not recognized as reliable are blocked in advance. Furthermore, to ensure the continuity of services, the infrastructure is distributed over two datacenters, located in two distinct geographic locations, which operate under business continuity. The Department of the Treasury can therefore bear the loss of an entire datacenter plus half of the infrastructure of the second datacenter without interruption of service. Finally, in the unlikely event that both datacenters become unavailable, the Department of Treasury has updated copies of all data, stored in special fireproof safes, available for immediate recovery of systems, services and data. |
X |
|
Although the Department of the Treasury makes use of dedicated technologies and services, the cybersecurity strategy, the measures to be adopted and the other aspects relating to cybersecurity are always shared with the relevant government Entities, in a bidirectional collaborative regime. |
Japan |
Based on the government information security regulations, we implement the security measures. And, we operate systems related to JGBs, including the JGB auction system, in an offline environment. In addition, we are prepared to respond to unforeseen circumstances by applying software security patches and implementing their version upgrades, updating anti-virus software and conducting regular scans, and backing up data |
X |
|
|
Korea |
|
X |
|
BOK-Wire+ (financial network of the Bank of Korea) is used for the issuance process |
Republic of Latvia |
We have taken precautions to protect sensitive information against unauthorized access and its processing. Also we have certification to the International Information Security Standard ISO 27001 which provides reassurance |
X |
|
|
Lithuania |
|
X |
|
|
Luxembourg |
|
X |
|
|
Mexico (Local) |
In Mexico exists the National Digital Strategy 2021-2024, which among other objectives promotes a general information security policy that seeks to preserve the confidentiality, availability and integrity of the information protected by the Institutions, for this, it has been implemented an Approved Protocol for the Management of Cyber Incidents among all the Institutions of the Public Sector, in addition, security evaluations are coordinated in the Institutions for the detection of threats and thus improve the management of information security risks. There is also the National Cyber Incident Response Center that promotes good prevention and reaction practices. |
X |
|
|
Mexico (External) |
|
|
|
|
Netherlands |
Business continuity plan, including back-up and recovery, as well as alternative procedures for doing transactions and settlements. |
|
X |
Shared arrangements with the government/ministry, with exceptions on specific areas such as security monitoring |
New Zealand |
In addition to a range of technology controls, we would look to our transactional banker and other government financial institutions to initiate payments under our instruction. |
X |
x |
Security is actively managed by DMO staff, leveraging cross-government and vendor capability. |
Norway |
The DMO is organized as a separate unit in Norges Bank and we share cyber security measures with the rest of the central bank. |
|
|
The DMO is organized as a separate unit in Norges Bank and we share cyber security measures with the rest of the central bank. |
Poland |
1) Information security management system and solutions regarding rules of information security are developed 2) As far as the debt payments are considered in the case of cyberattack (understood as WAN failure) agreements between MoF and National Depository for Securities and State Treasury Payment Agents (National Bank of Poland and Bank Gospodarstwa Krajowego) make it possible to deliver payment instruction using alternative channels to provide information. It is also possible to deliver the instructions in paper form, duly signed and stamped. |
X |
|
Public Debt Department is a part of Ministry of Finance. There are 2 Departments responsible for cyber security: Security and Data Protection Department (sets the rules) and IT and Projects Management Department (coordinates tasks related to cybersecurity). Ministry of Finance cooperates with IT Center of the Ministry of Finance, Computer Security Incident Response Team (CSIRT GOV) and the Government Plenipotentiary for Cybersecurity. |
Portugal |
Data backup A Disaster Recovery Center where backup of critical system are hosted and daily updated Redundant connections (different routes). |
X |
x |
Among others SIEM, endpoint security, network segregation, security awareness, strong authentication |
Romania |
The Ministry of Finance owns a secondary data center from which payment operations can be carried out. In addition, the auctions are carried out through the NBR, which has the necessary infrastructure to carry out these operations under the conditions of a cyberattack |
|
X |
|
Slovak Republic |
2 back up sites. Continuity plan |
X |
X |
We are using both or mixed arrangements |
Slovenia |
The legal basis of information security and regulation of measures to achieve a high level of network and IS security: Information Security Act (ZInfV) - http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7707
Resolution on the national security strategy of the Republic of Slovenia (ReSNV-2)- http://www.pisrs.si/Pis.web/pregledPredpisa?id=RESO124
Adopted cyber security strategy, which establishes a system for ensuring a high level of cyber security- https://www.gov.si/assets/organi-v-sestavi/URSIV/Datoteke/Dokumenti/2022-03-NOKI.pdfhttps://www.gov.si/assets/ministrstva/MJU/DID/Cyber_Security_Strategy_Slovenia.pdf
National Cyber Incident Response Plan- https://www.gov.si/assets/organi-v-sestavi/URSIV/Datoteke/Dokumenti/2022-03-NOKI.pdf
Cyber risk assessment https://www.gov.si/assets/organi-v-sestavi/URSIV/Datoteke/Dokumenti/Ocena_kibernetskih_tveganj_v1_0_Fina_P.pdf
|
X |
|
The Government Information Security Office (GISO) is the competent national authority in the field of information security, which acts as a government office. Its core mission is to increase resilience to cyber threats that can threaten individuals, businesses, government and society at large. GISO connects stakeholders in the national information security system and coordinates the operational capabilities of the system at a strategic level. It pays particular attention to subjects under the Information Security Act (ZInfV) from the group of essential service providers in the fields of energy, digital infrastructure, drinking water supply and distribution, healthcare, transport, banking, financial market infrastructure, food supply and environmental protection, from a group of digital service providers and from a group of state administration authorities. GISO is also the single point of contact to ensure cross-border cooperation with the relevant authorities of other EU Member States and with the European CSIRT Network and other international cooperation tasks. Through its own inspection service, it oversees the implementation of ZInfV. Due to being tasked with informing the Government and the National Security Council (NSC) in the case of critical incident or cyber attack, GISO is also placed within the national security system. SI-CERT (Slovenian Computer Emergency Response Team) is a designated national computer security incident response team (CSIRT) that operates within the framework of the ARNES (Academic and Research Network of Slovenia) public institute. According to tasks and responsibilities identified by NIS Directive it monitors incidents at a national level, provides early warning, alerts, announcements and dissemination of information to relevant stakeholders about risks and incidents, responds to incidents and provides risk and incident analysis and situational awareness. SI-CERT performs risk and incident handling in accordance with Article 28 of the Information Security Act, which defines following responsibilities: To the subjects for which it is responsible SI-CERT offers methodological support, help and cooperation in case of an incident; Accepts data about risks and vulnerabilities in the area of information security, shares the data with the affected systems administrators, and issues warnings; Cooperates in the network of CSIRT groups and also in other international cooperation networks; Cooperates with CSIRT groups and security-operations centers in the Republic of Slovenia and CSIRT groups in other EU Member States; Raises awareness of users in the area of information security; Issues warnings about the risks and vulnerabilities in the area of information security; Cooperates with the competent national authority and offers information upon request about performing SI-CERT’s competencies on the basis of this Act. SI-CERT also independently operates the Safe on the Internet national awareness programme on information security and participates in the SAFE-SI project. The SI-CERT response centre’s services are available to the general public. SI-CERT is financed from the fund provided to the Arnes public institute by the Government Information Security Office, which is the competent national authority in the field of cyber-security. Measurement and monitoring of incidents is published in semi-annual reports |
Spain |
The Spanish Ministry for Economic Affairs has multiple cyberattack measures put in place, with secure internal networks, 2-factor authentications and secure digital signatures, among others. Additionally, as our financial agent, the Bank of Spain also contributes other cyber-security measures. They have protocols put in place to guarantee the safety of our primary market issuance, with all transactions occurring inside their own safe networks. Similarly, with payments on our outstanding debt, there are multiple measures put in place together with the Bank of Spain as our payments agent, so that we can guarantee the safety of these procedures.
Despite the safety of the measures currently in place, there are also contingencies in the case our network were compromised. The fact that we use an internal network would allow us to isolate from any problems. And in the case the private network itself were compromised, there are redundancies in place to continue operations as normal, both for payments and for primary market issuance. |
X |
|
The management of our cyber security is something done on the level of the entire Ministry for Economic Affairs and Digital Transformation. The Spanish Treasury has its own IT staff, but they function as a part of the Ministry for Economic Affairs. Aside from our Ministry, the Bank of Spain’s cyber security is also key for the DMO. Since they act as our financial agent, their security measures are vital for our operations. Their cyber security management doesn’t fall under our control, but since they’re a part of the Eurosystem, their security measures are up to the highest standards and we coordinate with them on this topic. |
Sweden |
Dialogue with Central bank and commercial counterparts |
X |
X |
|
Switzerland |
The Swiss DMO is part of the Federal Administration and uses the infrastructure of the Federal Government. The DMO is not responsible for cybersecurity on its own. For our funding activities, we mainly use the infrastructure provided by the SIX Swiss Exchange and the Swiss National Bank. |
X |
|
The Swiss DMO is part of the Federal Administration and uses the infrastructure of the Federal Government. The DMO is not responsible for cybersecurity on its own. |
Türkiye |
General Directorate of Information Technologies is responsible for ensuring the continuity of operations in case of a cyberattack event. |
X |
|
|
UK |
The DMO has implemented number of security controls and contingency measures to protect the confidentiality, integrity and availability of the DMO IT systems that support the business operations. The DMO has two data centres. Additionally, the DMO has a Cyber Incident Response retainer - an external cyber incident management service provider to help restore and recover from cyber-attack incidents.
The DMO has also put in place security tools to identify, detect, protect, respond and recover from cyber incidents |
|
X |
The DMO has purchased security software but managed by the DMO internal security team. Security measures are verified by external assessments like SWIFT CAF, penetration testing, third party reviews and Departmental Security Health Checks (DSHC). |