The Information Security Policy of the National Superintendence of Insurance was Approved

The Administrative Decision No. 641/2021 established the "Minimum Information Security Requirements on the National Public Sector", applicable to those included in subsection a) of Article 8 of the Law No. 24156 –i.e., the National Administration, state-owned enterprises and corporations, public entities expressly excluded from the National Administration, and trust funds wholly or mainly composed of state funds– and to those third parties contracting with them.

The entities included in the Administrative Decision No. 641/2021 must create an Information Security Policy compatible with the primary responsibility and actions within their competence. In this sense, the National Cybersecurity Directorate approved the "Referential Model of Information Security Policy" through Resolution No. 1/2022.

The Resolution No. 31/2023 approved the Information Security Policy of the National Superintendence of Insurance based on the referential model of Resolution No. 1/2022.

The Information Security Policy contains the general objectives, basic principles, and specific guidelines adopted by the National Superintendence of Insurance to preserve the information security. Some of the specific guidelines include:

• IT security of human resources
• Asset management
• Access control
• Use of cryptography
• Acquisition, development, and maintenance of information systems
• Relationship with suppliers
• Security incident management

The Information Security Policy will be applicable to all internal and external subjects related to the National Superintendence of Insurance through contracts, agreements, covenants, or any other valid instrument.