Complying with SUSEP Circular 638/2021: A Guide for Brazil's Regulated Insurance Sector

As Brazil's insurance market moves deeper into digital channels and shared infrastructure, compliance with Circular SUSEP nº 638/2021 has become a core operational requirement, not merely a documentation exercise. Issued by the Superintendência de Seguros Privados (SUSEP), the circular establishes a framework for managing cyber risk within each entity's Internal Controls System (SCI) and Risk Management Framework (EGR), built around a documented cybersecurity policy, classification of data and services by relevance, and processes to detect, respond to, and recover from incidents, with heightened expectations around incident reporting, business continuity, and oversight of outsourced and cloud services. Supervised entities must show that their controls are proportional to their size and risk, that relevant incidents reach SUSEP within five business days, and that providers handling their data are held to controls no weaker than their own. This guide breaks down the circular's essential requirements and shows how ManageEngine AD360 and Log360 help your organization implement, operationalize, and strengthen SUSEP 638 compliance with confidence.

What you’ll learn

• What SUSEP Circular 638/2021 covers, who it applies to, and why it matters to insurers, EAPCs, capitalization companies, and local reinsurers.
• How cyber risk fits within the Internal Controls System and Risk Management Framework, and what the mandatory cybersecurity policy must contain.
• How vulnerability management, incident detection and response, and business continuity planning support compliance for your most relevant data and services.
• What the incident reporting duties mean in practice, including the five-business-day SUSEP notification and the annual incident report.
• How identity governance and security monitoring help strengthen access control, provider oversight, and record retention.