Skip to content
Indene
en

Compliance e regulatório

2026 Penetration Test Results Must Reach the Board by March 2027

The annual cybersecurity report with a December 31 reference date is the first under CMN 5.274 and BCB 538. It must include the independent penetration test, the scans and the remediation plan, and go to the board by March 31.

By Rafael LimaCFO

3 min read

Páginas de norma empilhadas sobre fundo claro, com uma linha marcada em verde, e o título A test is a date, not a guarantee.
Páginas de norma empilhadas sobre fundo claro, com uma linha marcada em verde, e o título A test is a date, not a guarantee.

The annual cybersecurity report with a reference date of December 31, 2026 is the first that institutions regulated by the Central Bank of Brazil will close under CMN Resolution No. 5,274 and BCB Resolution No. 538, whose adaptation period ended on March 1. It must include the results of the annual penetration test and the remediation plan, and reach the board by March 31, 2027. In Indene's reading, the rule does not ask for a test; it asks for a cycle that can be proven: independent test, finding, plan, timely fix and five years of records.

What the rule requires

CMN Resolution No. 5,274, of December 18, 2025, amended CMN Resolution No. 4,893, which governs the cybersecurity policy of banks and other authorized institutions. BCB Resolution No. 538, of the same date, made the same change to the rule for payment institutions, broker-dealers and securities distributors (BCB Resolution No. 85). On testing and vulnerabilities, the text of both is identical:

requirement what the text says where
Frequency penetration test with a "minimum annual frequency" Art. 22-A, I
Who performs it a specialized individual or firm hired for the purpose, with independence and impartiality, in addition to any tests by the internal team Art. 22-A, II
Record documented results, with the vulnerabilities found and the action plans to fix them Art. 22-A, III
Routine between tests periodic tests and analyses, scans to find devices improperly connected to the network, and timely remediation of vulnerabilities Art. 3, § 8
Patching regular application of security patches Art. 3, § 10
Annual report results of the penetration test, scans and analyses, and the action plans Art. 8, § 1, V
Who receives it the risk committee, where one exists, and the board of directors or executive board, by March 31 of the following year Art. 8, § 2
Retention test documentation and action plans available to the Central Bank for five years, counted from the test date Art. 23, X

Two details change practice. The first is independence: a test run only by the internal team is still allowed, but it does not replace the contracted test. The second is the report: the test result stops being a technical document filed in the security area and becomes a mandatory item of a report the board receives by a set deadline.

What this means in practice

The annual penetration test shows the institution's state on one day of the year. Recent weeks showed how fast that snapshot ages. Between September and October 2026, flaws in VPNs, gateways and other edge devices from seven vendors entered CISA's catalog of exploited vulnerabilities, several of them exploited before a fix existed. According to Verizon's annual data breach report, published in May, vulnerability exploitation is now the entry point for 31% of breaches, ahead of stolen credentials for the first time in 19 years.

That is why the rule pairs the annual test with a continuous routine: scanning, periodic analysis and timely remediation. A report that shows only the March penetration test, without what happened to the flaws exploited in September, meets the letter of Art. 22-A and leaves out Art. 3.

Then there is the action plan. The rule asks for the plan to be documented; what matters to whoever reads the report is whether it was carried out. A critical finding from March still open in December, with no justification and no formal risk acceptance, is exactly the kind of information the board needs to see in the report, and it stays on file for five years.

Where to start

  1. Check whether the 2026 penetration test has already been done by an independent individual or firm; if not, hire one before year-end, because it goes into the report with a December 31 reference date.
  2. Define the scope by the assets that weigh most in potential loss (remote access, the Pix and STR environments, exposed applications, identity), not by the test provider's convenience.
  3. Link each finding to a plan with an owner, a deadline and evidence of the fix, and record the retest.
  4. Add to the report what happened between tests: scans, exploited flaws in CISA's catalog that affected the institution, and how long each one took to fix.
  5. Keep everything with date and source for five years, counted from the date of each test.

In Indene's reading, a penetration test is evidence like any other: it is worth its date, its source and what was done with it. A finding fixed and retested raises confidence in the control; a forgotten finding lowers it. Read the methodology.

References

Topics

Keep reading

All news