Ensuring the security of information assets and protecting their confidentiality remain important tasks within the Bank's activities. The relevance of these tasks is emphasized by the need to comply with Resolution of the Government of the Republic of Kazakhstan No. 832 dated December 20, 2016 "On Approval of Uniform Requirements in the Field of Information and Communication Technologies and Ensuring Information Security", Resolution of the Management Board of the National Bank of the Republic of Kazakhstan No. 48 dated March 27, 2018 "On Approval of Requirements for Ensuring Information Security of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan, and Organizations Engaging in Certain Types of Banking Operations, and the Rules and Timelines for Providing Information on Information Security Incidents, Including Data on Violations and Failures in Information Systems", as well as compliance with the requirements of other regulatory legal acts of the Republic of Kazakhstan and internal regulatory documents of the Bank's Sole Shareholder.

The main conceptual areas for strengthening information security are:

1)   monitoring of information security events;

2)   registration and resolution of information security incidents, as well as the development of a knowledge base for them;

3)   controlling the circulation of critical information subject to protection (personal data and banking secrets);

4)   controlling access management in the Bank's application information systems;

5)   vulnerability management in the Bank's information technology infrastructure;

6)   data protection in databases;

7)   controlling privileged access;

8)   protection of e-mail and users when working with the Internet;

9)   protection of the Bank's web applications and mobile applications;

10)  defense-in-depth antivirus protection of the Bank's information technology infrastructure;

11) controlling changes on the Bank's critical hosts and application control.

-     conducting penetration tests, social engineering tests, and source code analysis of the Bank's critical applications to obtain a third-party view on the actual security of the Bank's assets.

-     carrying out continuous search for potential malicious threats through automatic anomaly detection tools and investigating identified suspicious actions for a possible incident;

-     carrying out constant analysis of the Bank's digital assets to identify vulnerabilities according to international CVE2 and CVE3 standards using the relevant specialized systems operated by the Bank;

-     carrying out proactive threat hunting and data analysis to identify potential threats that may not be covered by current security tools;

-     implementing measures to prevent/localize information security threats;

-     formulating and assigning tasks for the localization and prevention of threats to the relevant responsible units of the Bank;

-     conducting analysis of alerts on new threats to determine the initial area of impact and the level of severity.

To ensure information security, protection systems against data leaks, cyberattacks, virus activity, unauthorized login to the Bank's resources, copying, unauthorized changes, and others are utilized.

The number of data leak cases in the reporting year is 0. The total amount of fines paid in connection with violations in the field of information security is 0.