Beyond Cybersecurity: Data Privacy Risk in Mongolian Banking

Khan Bank has demonstrated its commitment to continuing with ISO/IEC 27001 for the Information Security Management System and ISO/IEC 27701 for the Privacy Information Management System. These two standards help the bank establish effective information security and data privacy controls.

Khan Bank remains the only bank in Mongolia to comply with ISO/IEC 27701. It highlights the bank’s dedication to protecting customers’ personal and confidential information while maintaining the highest data and information privacy controls.

Additionally, ISO/IEC 27001 Certification has become an unspoken asset in the Mongolian market, as every industry is seeking to comply with information security measures. However, ISO/IEC 27701 is no longer an extended version of ISO/IEC 27001; these two standards address different parameters and problems.  

How is securing data different from being accountable for it?

It is important to protect users' sensitive and confidential information, but at the same time accountability must be established. ISO/IEC 27001 does not merely focus on keeping data safe and secure; it introduces accountability by posing simple questions such as: Who has access to the information? What occurs when something goes wrong? And how can an organisation be sure that its security measures continue to work?

ISO/IEC 27701 enables organisations to look beyond personal data, as it focuses on how data is collected, used, shared, and managed throughout its lifecycle. ISO/IEC 27701 builds on the information security framework, aiming to protect users’ privacy and personal data.

Privacy Information Management System prepares organisations to respond when individuals exercise their privacy rights to correct or delete their data. 

A bank with strong information and data security controls can still face privacy challenges. ISO/IEC 27701 requires the bank to collect, keep, and share data with proper user insight and permission. 

Why is Mongolia Paying Closer Attention to Data Privacy?

Mongolia’s parliament passed the Cyber Security Law and the Personal Data Protection Law in December 2021. Together, these laws made data security and responsible use of personal information legal requirements.

The Law on Cyber Security takes a broad approach to critical information infrastructure, covering areas such as payments, energy, healthcare, databases and border ports. This means banks are clearly within its scope. Cybersecurity is an ongoing responsibility for these organisations. They must conduct regular security audits and monitor their systems. They must also manage vulnerabilities, test for weaknesses and report incidents. Business continuity planning is also required. The National Cyber Security Centre coordinates threat intelligence and the national response to cyber incidents. 

The Personal Data Protection Law sets out clear requirements for handling personal data. Organisations must have a lawful basis for each processing activity. They must also protect personal data and collect it only for legitimate purposes. They must keep records of how personal data is processed.

This last requirement can be challenging. A record of processing activities is not just a policy. It is an inventory of the personal data an organisation collects and uses. 

Cybersecurity Threats in Mongolia: What Happens After a Data Breach?

Mongolian organisations face many of the same cyber threats as businesses around the world. These include ransomware, phishing and online fraud. Employees can also misuse company systems. Attacks can also target suppliers and critical services. These risks are not unique to Mongolia.

What has changed is what happens after an incident. A breach is not just an IT problem with reputational consequences. It can also lead to reporting requirements and questions from regulators.

After an incident, organisations may need to answer basic questions. What personal data was exposed? Why was it being held? Who had access to it? Were these activities properly recorded?

An organisation that can answer these questions quickly is in a much stronger position than one that has to find the answers during an investigation.

Why Cybersecurity Certification Matters for Mongolian Banks?

A certificate alone will not stop a cyber incident. What really matters is the system behind it. A strong certification shows that an independent auditor has checked the system against a recognised standard.

For a bank, doing this properly brings three key benefits. First, it gives the bank a clear picture of the data it holds. Second, it puts clear procedures in place that do not rely on one person. Third, it creates evidence as part of everyday work rather than during an audit or after an incident.

The first certification is just the start. The real test comes when it is time to renew it. If the system still works well years later, it shows that it has become part of the bank’s everyday operations. It is not just something put in place for an audit.

The Growing need of ISO/IEC 27001 and ISO/IEC 27701 in Mongolia

ISO/IEC 27001 is becoming a common expectation in the Mongolian banking sector. ISO 27701 is not yet as widely adopted. This is not necessarily because banks are reluctant to adopt it, but Privacy management is simply harder to build into an organisation that is already operating.

ISO/IEC 27701 requires a clear understanding of how an organisation collects and uses personal data. It is not only about cybersecurity. It also affects how different parts of the business handle personal information. This can include product teams, marketing, collections and procurement.

Regulators across the region are moving towards privacy driven systems and the demand for ISO/IEC 27701 is growing. Correspondent banks are also asking more detailed questions during due diligence. Customers are paying closer attention to how their personal data is collected and used.

Preparing for ISO Certification in Mongolia

If you are considering ISO/IEC 27001 or ISO/IEC 27701, start by reviewing your data. Find out what personal data you hold, where it is stored and who can access it. This will show you what needs to be improved.

MSCi help organisations in Mongolia prepare for ISO/IEC 27001 and ISO/IEC 27701. Our services include gap analysis, implementation, training and audit preparation. Certification is carried out by an independent accredited body.

Need help with ISO certification? If a customer, regulator or correspondent bank has asked you to meet an ISO standard, talk to us. We can help you understand what is required and give you a clear view of the scope, timeline and cost.