Remote hands for banks: 4 CNBV requirements when using this service
If your data center operates without its own guard: when a power supply fails, someone from the provider arrives, repairs, and leaves. The problem appears two years later, when an inspector asks who authorized that entry and with what credentials.
That’s the point: remote hands don’t fail because of what they do inside the room, they fail because of what they don’t record. A bank can have the best contract in the world and still not respond to an audit.
Why the regulator asks about an external provider
When a credit institution delegates part of its data center operation, that third party enters the chain of custody of information. For the regulator this does not eliminate your responsibility: it transfers it to your entity. The bank remains responsible for continuity.
That’s why the review doesn’t stay with the provider’s paperwork. The inspector wants to see the described relationship, existing controls, and a clear person responsible when the service fails outside business hours. All of that is proven with documentation.
In practice, the review is supported on two planes: the security provisions the CNBV requires from credit institutions and the outsourcing contract, where the provider’s obligations, controls, and how it will report must be in writing.
Requirement 1: the provider is registered and formalized
The first question is not technical: it’s documentary. You will have to prove that the third party exists, that it is registered in the Public Registry of Commerce, that it has provable capital and tax domicile, and that the bank contracted it with an instrument that survives a provider change.
What they will ask you: is there a written contract? what services does it cover exactly? what happens if the contract ends tomorrow? who keeps the information and how is it returned or destroyed? who signed for the bank and with what authority?
How to demonstrate it: current contract with scope annexes and service levels, articles of incorporation, tax status certificate, civil liability insurance policy, and designated person responsible.
Add proof that the provider maintains certified controls, for example ISO/IEC 27001 or a valid SOC 2 type II report, with issue and expiration dates. That evidence separates a serious provider from a problem company.
Requirement 2: physical access to the room, recorded person by person
This is where control is most lost. The technician enters with a key or a shared badge, stays a whole weekend, and no one knows with what identity they were inside the computing room or at what time they left.
What they will ask you: who entered, with what document were they identified, who authorized them, and at what time? And the difficult version: can you reconstruct the list of all entries in the last twelve months?
How to demonstrate it: physical access log per room, with date, time, full name, credential used, reason for visit, authorizing person, and exit time. The credential must be nominative, non-transferable, and revocable. Add a companion record when the provider comes with its own staff.
Requirement 3: nominative credentials and least privilege
Remote access is controlled with the same principles as the physical door, but non-compliance weighs more: a shared account means an action has no author. The auditor doesn’t look at whether the system is secure; they look at whether they can attribute each action to a person.
What they will ask you: does each technician have their own account? is privilege limited to what the task requires? are there generic administrator accounts? what happens with accounts of those who leave? is there two-factor authentication and a separate channel from production?
How to demonstrate it: access matrix by position, with minimum justified permission per task; hire and termination log; quarterly privilege review; and second factor record.
Emergency or break-glass accounts should exist, but be labeled as such, with double approval and record of each use. A break-glass account without a log is the most privileged access and the least explained in the inventory.
Requirement 4: evidence of each intervention, retained for the corresponding period
The fourth requirement is the most underestimated. The auditor doesn’t ask to see a log from the day of the failure: they ask to be able to reconstruct what was done, who did it, and with what result; and also prove those records still exist after a year or more.
What they will ask you: how long do they keep the access log? is it signed or sealed so it cannot be altered? is evidence delivered complete or generated on request? who responds if the provider has already closed its contract?
How to demonstrate it: evidence retention policy aligned to the regulator’s required period, read-only log formats, timestamp sealing or electronic signature, and off-site backup. You must be able to request three months of logs and receive them the same day.
What to ask the provider to demonstrate compliance
- Registration and contract evidence. Articles of incorporation, tax status, contract with annexes and designated person responsible, plus control certificates it declares to maintain and their validity.
- Physical access procedure. How the technician is identified, who authorizes them, what log is generated and with what granularity you can review it.
- Remote access inventory. Nominative accounts, second factor, privileges by position, termination procedure, and date of last privilege review.
- Retention policy and delivery format. Conservation period, sealed logs, backup, and response time when requesting historical evidence.
If the provider responds with generic descriptions instead of procedures and deadlines, you already know what will happen in the audit: you will have to reconstruct what your own people did, with the time you already lost.
Sources
Want to master this?
Noxtel Academy →
