Brazil BACEN Resolution No. 4,893 — Cybersecurity Regulation

Why does it matter?

Brazil's regulator expects financial institutions to treat cyber risk and cloud outsourcing as board-level, documented, auditable matters. The Resolution sets one policy, one incident response plan, one accountable director and one annual report, then applies strict contracting rules to relevant data processing and cloud services (articles 2 to 17).

Key benefits include:

• One accountable director

A director must be designated for the cybersecurity policy and for executing the incident response plan, and may hold other roles if there is no conflict of interest (article 7).

• Board approval and annual review

The board of directors, or the executive board where none exists, approves the policy and the plan, and both are documented and reviewed at least annually (articles 9 and 10).

• Cloud contracting is regulated

Before contracting relevant cloud or data services, the institution checks the provider's ability to meet legal duties, data access, auditor reports and data segregation (article 12).

• Regulator access and notice

The BCB must be told of relevant cloud contracts within ten days, and contracts must allow the BCB access to data and documents (articles 15 and 17).

• Five-year evidence trail

Policy, plan, annual report, due diligence files and contracts stay available to the BCB for five years (article 23).

How does it work?

The Resolution has five chapters: object and scope (article 1); the cybersecurity policy, its publication and the incident response plan (articles 2 to 10); contracting of data processing, storage and cloud services (articles 11 to 18); general provisions on business continuity, monitoring and information sharing (articles 19 to 22-B); and final provisions on record keeping and the BCB's powers (articles 23 to 28).

The policy must fit the institution's size, risk profile and business model, the nature and complexity of its products and the sensitivity of its data (article 2). A prudential conglomerate or a credit cooperative system may adopt a single policy. The policy must be disclosed to staff and service providers, and a summary must be published to the public (articles 4 and 5).

Since the 2025 amendment, article 3 lists fourteen minimum controls, among them authentication, encryption, intrusion prevention and detection, data leak prevention, malware protection, traceability, backups, vulnerability management, access control, secure configuration profiles, network protection, digital certificate management, secure system integration and cyber threat intelligence.

Key Elements

• Cybersecurity policy content (article 3)

The policy states security objectives, controls to reduce vulnerability, controls for the traceability of sensitive information, and how relevant incidents are recorded, analyzed for cause and impact, and controlled. It sets guidelines for business continuity incident scenarios, for classifying data by relevance and for service providers that handle sensitive data, and covers staff training and incident information sharing.

• Incident response plan and responsible director (articles 6 and 7)

The plan covers the actions needed to align the organization with the policy, the routines, controls and technology used to prevent and respond to incidents, and the area responsible for recording and controlling the effects of relevant incidents. A designated director owns both the policy and the plan.

• Annual report (article 8)

The institution writes an annual report on the plan with a base date of December 31. It covers the effectiveness of planned actions, results of the routines and controls, relevant incidents, business continuity test results and, since the 2025 amendment, penetration and vulnerability test results with remediation plans. The risk committee receives it, and the board receives it by March 31 of the following year.

• Relevant cloud and data services (articles 11 to 17)

Relevant services are assessed before contracting and the procedure is documented. For providers abroad the BCB needs an information-exchange agreement with the foreign supervisor, or the institution must request BCB authorization at least sixty days ahead (article 16). Contracts must name the countries and regions of processing, segregate client data, allow BCB access and require exit data transfer and deletion.

• Business continuity, crisis and information sharing (articles 19 to 22)

Risk policies must cover relevant cyber incidents, provider outages and replacement scenarios. The institution documents the criteria that make a situation a crisis and notifies the BCB in a timely way when a relevant incident or service interruption becomes one (article 20). Institutions also take part in sharing information on relevant incidents (article 22).

• Penetration testing and Pix and STR rules (articles 22-A and 3-A)

Penetration tests run at least once a year, performed independently by a contracted person or specialized firm, with documented results and remediation plans. Institutions connected to the National Financial System Network apply extra controls, including multi-factor authentication for administrative access to the Pix and STR environments and isolation of those environments.

What does it cover?

The Resolution applies to institutions authorized to operate by the Central Bank of Brazil, such as banks. Payment institutions, consortium administrators, securities brokers and dealers and foreign exchange brokers are outside it and follow BCB Resolution 85 of 2021. It covers cybersecurity policy, incident response and the contracting of relevant data processing, storage and cloud services in Brazil or abroad.

What are its objectives?

The Resolution sets mandatory duties for cyber governance and cloud outsourcing.

Maintain a cybersecurity policy that protects the confidentiality, integrity and availability of data and information systems.

Approve, document and review the policy and the incident response plan each year.

Designate a director accountable for the policy and the plan.

Report each year on the plan as of December 31, with incident and test results.

Assess, contract and notify the BCB of relevant cloud and data processing services under articles 11 to 17.

Keep policy, plan, report and contract evidence available to the BCB for five years.

Framework in Context

The Resolution is part of Brazil's financial sector rules on risk management and outsourcing, and sits beside BCB Resolution 85 of 2021 for payment institutions and other firms. It was written for Brazil and is not the Digital Operational Resilience Act or ISO/IEC 27001, but institutions commonly map their controls to ISO/IEC 27001 and NIST to evidence the minimum controls in article 3. Personal data duties come separately from the LGPD.

Common Framework Mappings

Organizations map BACEN Resolution No. 4,893 to internationally recognized frameworks to harmonize controls, demonstrate regulatory alignment, and simplify cybersecurity, data protection, and operational resilience compliance across jurisdictions.

Mapped frameworks include:

Digital Operational Resilience Act (DORA)

ISO/IEC 27001

ISO/IEC 27002

Lei Geral de Proteção de Dados (LGPD)

NIST Cybersecurity Framework

NIST SP 800-53

SOC 2

SWIFT Customer Security Programme (CSP)