SUSEP Circular 638: insurer cybersecurity

SUSEP Circular No. 638/2021 is the cybersecurity rule for the market supervised by SUSEP, Brazil’s Superintendence of Private Insurance. It requires a policy, controls to prevent and handle incidents, notice to SUSEP within five business days when a relevant incident occurs, and rules for contracting data processing and storage, including cloud services. In August 2026, a resolution changed the outsourcing part. Here is the text in force, what changed and a checklist.

What SUSEP Circular 638 is and who it applies to

SUSEP Circular No. 638 of 27 July 2021, published in Brazil’s Official Gazette (DOU) on 3 August 2021, sets cybersecurity requirements for four types of entity, which the rule calls supervised entities: insurance companies, open supplementary pension entities (EAPCs), capitalisation companies and local reinsurers. Insurance brokers are not on the list in article 2.

The circular does not create a parallel structure. Article 3 places cybersecurity inside the Internal Controls System and the Risk Management Structure the entity already runs. Cyber risk falls under operational risk, and the cybersecurity policy is treated as a policy complementary to the risk management policy. In practice, cyber risks sit in the same register as other operational risks. In the regulatory map of the guide to choosing a GRC platform in Brazil, Circular 638 is the rule that covers the insurance sector.

Three definitions that set the scope

Many requirements apply only to what is “relevant”, and the regulated entity sets the criteria. Classification is the first deliverable.

Concept (article 2)	What the rule says	Why it matters
Relevant data	Personal data, customer data or data on critical processes, and any other data the entity considers sensitive	Determines which outsourced services are relevant
Relevant processing or storage services	Services, including cloud, that access relevant data or support activities essential to business continuity	Trigger the strictest contracting requirements
Relevant incidents	Adverse events, malicious or not, that substantially compromise relevant data or relevant services, according to the entity’s criteria	These are the ones that must be reported to SUSEP

Objective criteria (number of records, downtime, type of data, affected system) stop the decision to report from being left until the crisis.

What the circular requires

The rule mentions a “programme” only for staff training; the rest is policy, processes and controls:

Topic	Requirement	Where
Controls	Good practice in eight domains: physical security, access, cryptography, malware, backup, logs, networks and systems development	Art. 3, I
Culture	Continuous training based on the sensitivity of the information handled	Art. 3, II
Policy	Objectives, management commitment and criteria for classification, controls and outsourcing, with approval authority for contracts	Art. 4
Prevention and response	Identify and reduce vulnerabilities proactively; detect, respond to and recover from incidents	Arts. 5 and 6
Continuity	Incident scenarios in the business continuity plan	Art. 7
Notification	Report relevant incidents to SUSEP within five business days	Art. 8
Annual report	Report on incident prevention and handling for management and the committees	Art. 9
Outsourcing	Contracting governance, minimum supplier requirements and an exit strategy	Arts. 10 to 14
Record keeping	Current and previous versions of policy, reports, contracts and evidence	Art. 15

Incidents: from the log to the notice to SUSEP

Article 6 sets the minimum: continuous network monitoring, impact assessment against criticality levels defined in advance, containment, secure restoration, logging, information sharing with other supervised entities, communication with those affected, especially customers, and remediation of the vulnerabilities exploited. Two details are often missing from playbooks: reconciling the incident log with the operational loss database, where one exists (paragraph 3), and alerting suppliers and partners during containment (paragraph 1).

Under article 8, a relevant incident must be reported to SUSEP within five business days of becoming aware of the event. The notice describes the extent of the damage and the actions under way, with owners and deadlines. The annual report in article 9 covers relevant incidents, statistics on all incidents, continuity tests and vulnerabilities being remediated, and its recipients must use it to assess how effective the controls are.

Contracting processing, storage and cloud

The outsourcing chapter covers any data processing and storage service, including cloud computing. The only exception is recording operations in a system approved by SUSEP and run by an accredited registry entity (article 14). The regulated entity must require suppliers to (article 11):

comply with laws and regulations;
provide information and management resources to monitor the service;
maintain security controls no weaker than the entity’s own for the same level of sensitivity;
segregate the data of the entity and its customers;
give notice of subcontracting of relevant services;
transfer and then delete the data when the contract ends;
not hinder SUSEP in any way, including giving it read access to the data, information and contracts when it asks.

For relevant services, the supplier’s controls are proven by independent certification of the service or by prior due diligence; the rule does not require a specific certification. Contracts, except standard-form ones, must spell out these requirements, and the entity must document a strategy for replacing the supplier or bringing the service in-house (article 13). Outsourcing does not transfer responsibility (article 12), the same logic as the banking rule discussed in the article on third-party risk under CMN 4,893.

What changed in 2026: SUSEP Resolution No. 90

SUSEP Resolution No. 90 of 18 August 2026, published in the DOU on 20 August and in force from publication, rewrote item III and the sole paragraph of article 10. In the original wording, the entity had to tell SUSEP, within 30 days of signing, which relevant services it had contracted, the supplier and any subcontractors and, whenever possible, the countries and regions where the data could be processed.

Under the new text, the obligation is to ensure that contracts, including amendments and addenda, are accessible when SUSEP asks for them, keeping on file and presenting the information and documents needed to assess the service, the risks and compliance. The change was foreseen in SUSEP’s 2026 regulatory plan as “minor amendments/additions” on contracts for relevant services. In practice, the work shifts from filing to readiness: contract, addenda, data location and supplier assessment gathered and ready to hand over. The other items of article 10 and article 11 did not change.

Proportionality and deadlines

The policy must be compatible with the entity’s size, the nature and complexity of its operations and its exposure to cyber risk (article 4, sole paragraph). The prudential segmentation into S1 to S4, created by CNSP Resolution No. 388/2020 for the proportional application of prudential regulation, appears in the circular only in the compliance deadlines. The minimum content applies to every segment.

Milestone	Date	Provision
Entry into force	1 September 2021	Art. 18
Compliance for segments S1 and S2	30 June 2022	Art. 17, I
Compliance for segments S3 and S4	1 September 2022	Art. 17, II
Adjustment of contracts signed before entry into force	1 September 2024	Art. 16
New wording of article 10 (SUSEP Resolution No. 90/2026)	20 August 2026	Art. 2 of the resolution

How Circular 638 sits alongside the LGPD

Personal data are, by definition, among the circular’s relevant data. A single incident may therefore lead to two notifications on different clocks. SUSEP receives notice of relevant incidents within five business days of becoming aware of the event. The ANPD, Brazil’s data protection authority, and the data subjects receive notice of incidents that may cause relevant risk or harm (article 48 of the LGPD, Brazil’s General Data Protection Law) within three business days of becoming aware that the incident affected personal data, under ANPD Resolution No. 15/2024. The ANPD also requires incident records to be kept for five years.

The playbook should separate the two tracks from triage, with an owner for each decision and each notice. The controls in article 3 of the circular also serve as evidence of the security measures in article 46 of the LGPD. The LGPD compliance checklist covers the privacy side in detail.

Groups with a bank and an insurer: Circular 638 and CMN 4,893

In a financial group, each entity answers to its own regulator. The bank and other institutions authorised by the Central Bank follow CMN Resolution No. 4,893/2021, amended by CMN Resolution No. 5,274/2025. The insurer, the open pension entity and the capitalisation company follow Circular 638. The details differ:

Point	SUSEP Circular No. 638/2021	CMN Resolution No. 4,893/2021
Single group policy	No equivalent provision	Allowed for a prudential conglomerate and a credit cooperative system (art. 2, para. 2)
Incident notice	Relevant incidents, within five business days (art. 8)	Timely notice of relevant incidents and interruptions that amount to a crisis (art. 20, III)
Contracting relevant services	Contracts and documents accessible when SUSEP asks (art. 10, III, since 2026)	Notice to the Central Bank within ten days of contracting (art. 15)
Annual report	On incident prevention and handling (art. 9)	On the action and incident response plan, with a 31 December reference date (art. 8)

A control model shared across the group avoids rework, provided each requirement is mapped to each entity’s evidence. For the banking side, see what changed with CMN Resolution 5,274.

Practical checklist

Classify data, services and incidents with objective criteria and record them in the policy.
Review the policy against the minimum content of article 4, including approval authority for signing and changing contracts.
Map the eight control domains in article 3 to existing controls, with an owner and evidence.
Record cyber risks as operational risk and formalise training by profile.
Test the playbook with SUSEP’s five-business-day clock and the ANPD’s three-business-day clock in the same exercise.
Reconcile incidents with the loss database and include the article 7 scenarios in the continuity plan.
Inventory suppliers of processing and storage, flag the relevant ones and keep each one’s certification or due diligence.
Review contracts against article 11 and build a file for each relevant contract, ready to hand over to SUSEP.
Prepare the annual report under article 9 and keep the versions required by article 15.

Eagle and SUSEP Circular 638

The Eagle GRC module, from Futture, was designed to centralise requirements, policies, controls, evidence and action plans, with custom requirements and a crosswalk between standards, which is how Circular 638 can be set up alongside the LGPD and CMN 4,893. The third-party risk module covers supplier criticality, contracts and reviews. Eagle does not send notifications to SUSEP or the ANPD, and the relevance classification remains the regulated entity’s decision. If you would like to test this mapping with your own case, request a demo.

Frequently asked questions

Is SUSEP Circular No. 638/2021 still in force?

Yes. It took effect on 1 September 2021 and has not been revoked. The only amendment published in the Official Gazette (DOU) up to 30 October 2026 is SUSEP Resolution No. 90/2026, which changed item III and the sole paragraph of article 10, on contracting relevant data processing and storage services.

What is the deadline for notifying SUSEP of an incident?

Five business days from becoming aware of the event, for relevant incidents (article 8). If personal data are involved, notification to the ANPD and to data subjects follows ANPD Resolution No. 15/2024, with its own deadline of three business days.

Do insurers still have to tell SUSEP about cloud contracts within 30 days?

Under the text of SUSEP Resolution No. 90/2026, in force since 20 August 2026, no. The 30-day notice in item III of article 10 was replaced by a duty to keep contracts, including amendments and addenda, accessible to SUSEP on request, with the documents needed to assess the service. Confirm this reading with your legal team.

Can an insurer in a banking group use the bank’s cybersecurity policy?

SUSEP Circular No. 638/2021 has no rule equivalent to the one in CMN Resolution No. 4,893/2021, which allows a single policy per prudential conglomerate. A group policy can serve as a basis, but the insurer must show that it covers the minimum content of Circular 638 and the insurer’s own relevance criteria.

SUSEP Circular 638: cybersecurity rules for Brazilian insurers