Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 9.0 INFORMATION TECHNOLOGY (IT) SYSTEMS, SECURITY AND CONTROLS For all e-payment service providers, the integrity and adequacy of IT and Security Systems should at minimum cover the following: a) Architecture of Information Technology to be deployed; b) Security of IT systems: i. Appropriate security policies and measures intended to safeguard the integrity, authenticity, confidentiality of data operating systems; ii. Physical and Logical Access Controls iii. Backup infrastructure iv. Business continuity and disaster recovery plan v. Effective audit function to provide a review of the security control environment and critical systems; vi. IT systems vulnerability assessment report; vii. A satisfactory report from an ICT Certification Authority in respect of Information Security in accordance with the Payment Systems Act; c) The system should be hosted locally to provide ease of support and guarantee data ownership; however, if the system is hosted in another jurisdiction, licensed institutions shall ensure that the information requested are provide promptly and that the CBL has unfettered access to reports generated by the system. d) For business continuity, the system should have online synchronization to a backup location that assumes operations in case the primary site is down; e) Where the system is usually integrating with other systems a schema security level should be discussed with CBL technical team; f) Put in place a system capable of immediately informing their support team as well as customers when the system goes offline. 9.1 Information Systems and Cyber Security a) All e-payment service providers shall ensure that personal information of customers obtained during the course of operations is used, disclosed, retained and protected as agreed. b) They shall ensure the security, Integrity, Confidentiality and Availability of data and services by adopting prevailing international standard(s) as well as those prescribed by Central Bank of Liberia from time to time. c) They shall implement a cyber-security policy that conforms with international standards and any other cyber-security standards that the Central Bank will issue from time to time; 10