{"id":3818,"date":"2024-09-10T13:12:27","date_gmt":"2024-09-10T11:12:27","guid":{"rendered":"https:\/\/www.bayoosoft.com\/?p=3818"},"modified":"2024-09-10T13:12:27","modified_gmt":"2024-09-10T11:12:27","slug":"bait-these-are-the-requirements-that-banking-supervision-places-on-it","status":"publish","type":"post","link":"https:\/\/www.bayoosoft.com\/en\/bayoosoft-access-manager-en\/bait-these-are-the-requirements-that-banking-supervision-places-on-it\/","title":{"rendered":"BAIT: These are the requirements that banking supervision places on IT"},"content":{"rendered":"

These are the requirements that banking supervision places on banks’ IT<\/h1><\/h1><\/div>

In 2017, the German Federal Financial Supervisory Authority (BaFin) issued the circular “Banking Supervisory Requirements for IT” (BAIT), which sets out requirements that banks and credit institutions must comply with in terms of information security.
\nThe BAIT requirements now comprise a total of 12 chapters, which include both governance and technical measures.
\nWe will show you what steps you need to take as a financial services provider to ensure BAIT compliance.<\/p>\n<\/div><\/div><\/div>

What is BAIT?<\/h2><\/h2><\/div>

In 2017, the German Federal Financial Supervisory Authority (BaFin) sent out the first version of the “Banking Supervisory Requirements for IT” (BAIT).
\nBased on Section 25a of the German Banking Act (KWG), this imposes obligations on banks with regard to risk management and the establishment of internal control procedures. BAIT specifies the requirements that financial service providers must meet with regard to their information security.
\nThese only apply to financial companies in Germany, although it should be noted that they must also comply with international regulations. BAIT is to be distinguished from MaRisk, the minimum requirements for risk management.
\nThis is also a BaFin circular, but dates back to 2005 and deals primarily with the topic of risk management and does not address IT security in more detail.<\/p>\n<\/div><\/div><\/div>

Current changes to BAIT<\/h2><\/h2><\/div>

Two updates supplement the original circular from 2017.
\nRequirements for critical infrastructures were added in 2018.
\nThe new section contains measures to achieve the KRITIS protection targets.
\nOnce certain thresholds are reached, banks are considered critical infrastructure.
\nThese are 15 million transactions for cash supply and 100 million transactions for account management.
\nAs a result of the NIS2 directive, financial companies with more than 50 employees or an annual turnover of more than 10 million euros are now also considered critical infrastructure.
\nThree new chapters were added in 2021: Operational information security, IT emergency management and management of relationships with payment service users.
\nSecurity measures were further specified and requirements on outsourcing were added.<\/p>\n<\/div><\/div><\/div>

BAIT requirements at a glance<\/h2><\/h2><\/div>

Below we give you an overview of the 12 chapters of BAIT.<\/p>\n<\/div>