Debate abierto A7724, Tesis UTN . Facundo Lisotto // Cyberfinance

### Overview In this panel session presenting his UTN thesis, Facundo Lisotto (Red Team at Banco Galicia) leads an open debate regarding the Central Bank of the Argentine Republic's (BCRA) Communication 'A' 7724. Joined by Mara Isoto Macías (Main Manager/Director of Security at the BCRA) and Santi Cabana (CISO of Microsoft for Latin America), the panel examines the fundamental shift from the previous, rigid Communication 4609 to a modern, principles-oriented regulatory framework designed to withstand rapid technological evolution and elevate the overall resilience of the financial ecosystem.

### Key Topics - **Transition from Prescriptive Rules to Principle-Oriented Standards**: Replacing rigid technical directives (such as specific password character mandates) with objective-focused principles that accommodate modern digital environments, cloud workflows, and artificial intelligence. - **Three Lines of Defense Model**: Emphasizing internal operational management controls (first line), inspection, compliance, and internal security policies (second line), internal audit (third line), as well as coordination with external auditing entities. - **Board Governance and Risk Ownership**: Transferring ultimate accountability for risk acceptance from IT and security teams to organizational boards and executive leadership, requiring consensus on business-critical processes. - **Standardized Risk Methodologies and Probability Estimation**: Moving away from ad-hoc internal threat assessments toward formal frameworks (e.g., NIST, ISO 27001/27002, ISO 853, CIS, Octave, and Magerit) to harmonize risk calculations across departments. - **Third-Party Risk and Shared Responsibility**: Managing reliance on external service providers, MFA platforms, SaaS, and cloud environments by clearly mapping shared responsibility matrices. - **Systemic Financial Resilience**: Broadening the focus beyond business continuity to encompass disruption, confidentiality, fraud, data leaks, and spillover impacts across critical financial infrastructure.

### Technical Details Communication 7724 establishes a structured framework requiring financial entities to formally designate a technology and security risk function. Instead of checking off static compliance lists, institutions must document the cost, impact, and benefit of their security controls and present these justifications directly to their boards.

The discussion highlighted the technical and cultural difficulty of estimating probabilities. While CISOs and security teams often model threats around insider risk—such as behavioral economics research suggesting 2% to 5% of employees may be disloyal or misuse common resources—technology and executive teams often assess risks differently. Adopting standardized risk assessment models like Spain's Magerit (accessible via agreements with INCIBE) or Octave provides an objective baseline of potential failure scenarios that institutions must evaluate or explicitly document if inapplicable.

Regarding third parties, the panel underscored that outsourcing to cloud and identity providers introduces transitive risk (e.g., compromised MFA provider credentials). Regulated entities must conduct vendor assessments, analyze data residency, define robust identity authentication processes, and clearly delineate custody, protection, and operational reporting responsibilities.

### Takeaways Communication 7724 represents a structural paradigm shift toward systemic resilience, requiring organizations to identify critical systems, govern risk transparently, and bridge communication silos between technical teams, compliance lawyers, auditors, and board directors. Regulators emphasize that the standard is designed to endure future technological change and invite continuous dialogue between financial institutions and the Central Bank rather than rigid, literal interpretations.