IT Security from the point of view of KNF Directives and Recommendations

By Piotr Kowalski, Kancelaria Pałucki Truściński Prawo i Podatki SP. J. IT security is a field featuring a special hybrid of solutions, including strict IT and legal solutions. On one hand, legal regulation itself does not guarantee security. On the other hand, the implementation of specialized IT tools as such, without development, and more importantly, without the observation of appropriate standards and procedures, does not provide an adequate basis to claim that an sufficient level of security has been ensured within the given entity. Let us remember, that in the end, we attempt to look after security for each and every one of us: our funds, personal data or simple privacy. The subject of IT security has not received appropriate legal regulation in Poland. Because nature proverbially abhors a vacuum, the directives and recommendations of the Financial Supervision Authority (KNF) are considered a “panacea” for the indicated problems. However, is compliance obligatory? This question applies both to the legal nature of such regulations, but also to the scope of their subject and object (thus answering the question: to whom and what do they apply). The directives and recommendations of the FSA may not be considered sources of effective law according to the catalogue provided for in the Constitution (art. 87): they are not an act, a ratified international treaty, a resolution nor a local law act. On the other hand, however, the Authority is considered to be a so-called regulatory body, which performs its regulatory function by implementing acts resulting in standards applicable to specific entities. These competences have been granted to the Committee on the basis of legal regulation equivalent to acts, i.e. acts considered to be generally applicable. Thus, according to specific regulations of banking law, the act on savings and credit unions and the act on payment services, the Authority has been given the ability to issue recommendations (and, what should be noted) “good practices” related to cautious and stable management. One should not also forget the main role of the Authority, which is to ensure correct market functions, its stability, security and trust, as well as the protection of the interests of its participants through reliable information related to market functions (included in art. 2 of the act on financial market supervision). FSA recommendations and directives are, briefly speaking, a set of good practices related to strategy and organization of information technology areas and security of the IT environment, its development, maintenance, operation and management. These practices apply mainly to the IT structure of the given entity, i.e. to the set of devices and transmission connections (various server types, matrices, workstations), the IT network (all routers, switches, firewalls) or software. They apply to many levels, beginning with the indication of the role of management boards and supervisory boards, the development of systems within a company, and finally, to the improvement of competencies of employees and user education. It is beyond any doubt, that observation of such “good practices” should be in the interest of their recipients: public pension funds, insurance and financial security companies, investment funds, entities operating within the infrastructure of the financial market and investment companies – thus, the entities subjected to the highest levels of security were related to correct, efficient and safe support of activity by IT environments operating within such entities. In summary, IT security is regulated mainly by so-called “soft” laws (namely, by the aforementioned recommendations and directives of the FSA), however, they are laws with a “hard,” real impact. They are an attempt at keeping up with reality through fixed legal regulations. Regardless of how successful the attempt is, it should be stated that it is the correct direction, and demand for complex services (e.g. for legal-IT services) related to this issue will certainly see a continuous increase in each subsequent year.