> ## Content Index
> Fetch the complete content index at: https://economist.kg/llms.txt
> Use this file to discover other available public pages before exploring further.

# National Bank prepares mandatory ISO 27001 certification for Kyrgyzstan's banks
- URL: https://economist.kg/en/national-bank-prepares-mandatory-iso-27001-certification/
- Published: 2026-11-08T17:19:39.000Z
- Updated: 2026-11-08T17:19:39.000Z
- Description: The National Bank of Kyrgyzstan is shifting from recommending the international information security standard ISO/IEC 27001:2022 to making it mandatory for commercial banks.
- Author: Азиза Капар кызы
- Tags: #en

**The National Bank of Kyrgyzstan is shifting from recommending the international information security standard ISO/IEC 27001:2022 to making it mandatory for commercial banks. The draft of the new rules has already undergone public discussion and is at the final stage of preparation. This was announced by Davran Dzhumabayev, head of the regulator's cyber threat response department, at FinConference 2026 in Bishkek.**

According to him, the National Bank updated the information security requirements for commercial banks back in **2021**, bringing them into compliance with international standards.

> *"In 2021, we updated the information security requirements in commercial banks. In principle, all these requirements are synchronized with these standards," Dzhumabayev said.*

At the initial stage, the regulator allowed banks to adopt the international standard on a voluntary basis. Now the National Bank intends to **make it mandatory**.

> *"We laid down the idea that we are sending a signal to the sector that you can comply with this standard. This period was recommendatory. Now we are moving on to mandatory requirements," he stated.*

According to Dzhumabayev, the draft amendments have already passed public discussion. The regulator has also agreed on key issues with commercial banks and is finalizing the document.

> *"We have already passed the public discussion stage, worked through the project with banks, and are now at the final stage," Dzhumabayev said.*

At the same time, some commercial banks in Kyrgyzstan have already implemented international information security standards.

---

As a reminder, in July 2026 the National Bank [submitted](https://economist.kg/banki/2026/07/07/natsbank-kiberbezopasnost-bankov/) a draft of amendments to the bank information security requirements for public discussion. The document provides for **mandatory ISO 27001 certification** and regular confirmation of compliance with the standard.

According to the published [draft](https://www.nbkr.kg/contout.jsp?item=3526&lang=RUS&material=132944&ref=economist.kg), banks will have to submit a certification schedule in the **fourth quarter of 2026**, and obtain the certificate **by December 31, 2028**.

The new requirements will also affect the protection of mobile applications, software, and data centers. Banks will be required to have **primary and backup data centers** for storing customer information and processing payments, and to ensure their physical protection, backup power supply, and cooling.

In addition, the regulator intends to strengthen control over **cyber incidents**. Banks will be required to report information security breaches, classify them by criticality level, and document the results of investigations.

> At the same time, the National Bank itself has already undergone international certification. In December 2023, the regulator announced that it received a certificate of compliance for its information security management system with the **ISO/IEC 27001:2013** standard.