Segments / Notary offices
IT and security for notary offices: compliance with CNJ Provisions 213 and 243
Forte Security brings Brazilian notary and registry offices into compliance with CNJ Provision 213/2026, amended by Provision 243/2026. We run the assessment, deploy the required infrastructure and security controls and build the evidence dossier for inspection, with our own technical team and service across Brazil.
Notary offices hold acts with public faith, personal data and records that cannot be lost. The CNJ rule turned good technology practices into an obligation, with stages, deadlines and a declaration signed by the office holder. Our job is to make that requirement work in the office's daily routine.
What changed with Provision 243
- New classification by gross semiannual revenue: fees and other revenue from the delegated service count, only third-party amounts and mandatory legal transfers are excluded. Classes 1, 2 and 3 gained subclasses and higher limits.
- New deadlines counted from the effective date of Provision 243, 30 days after its publication on July 23, 2026: 180 days for Class 3, 240 days for Class 2 and 300 days for Class 1 to complete Stages 1 and 2.
- Evidence required: the technical bar is the same and proof became stricter. Up-to-date documentation, including vendor support status, must be kept and each stage declared in the Justiça Aberta system.
- Outsourcing does not transfer responsibility: selecting, hiring and supervising IT providers remains the office holder's duty.
What we deliver
Each office has a different size, systems and history. The work starts by understanding the environment and continues with deliverables covering governance, infrastructure and continuity, always recorded.
Gap assessment
We compare the current environment with each requirement of Provision 213, as amended by 243, and show what is missing and in what order to act.
Asset inventory
Survey of computers, servers, systems, accounts and network equipment, with version, owner and vendor support status.
Security policy
An information security policy written for the office, approved by the holder and shared with the team.
MFA and individual accounts
No more shared credentials, two-factor authentication on critical access and control over who accesses each system.
Firewall and segmentation
Perimeter protection, network separation and access rules so an incident on one device does not reach the whole office.
Encrypted backup with restore testing
Encrypted offsite copies with periodic restore tests recorded as evidence.
Continuity plan (BCP/DRP)
RTO and RPO, recovery procedures and owners, so the office resumes service with the least impact.
Incident response plan
What to do, whom to call and how to record it when something happens, including LGPD notifications.
LGPD compliance
Personal data mapping, legal bases, data subject rights and DPO support.
Staff training
Practical training on passwords, email and WhatsApp scams, correct system use and data protection.
Evidence dossier
Documents, reports and records proving each control, organized and ready for inspection.
Technical deployment, not just paperwork
Many consultancies hand over policies and spreadsheets and leave the hard part to the office. The rule is not met with documents alone: it requires working MFA, restorable backup, supported equipment and recorded audit trails.
Forte runs the infrastructure. Our technical team deploys and maintains firewall, backup and monitoring, and each action produces the record that later goes into the dossier.
Firewall and network
Configuration, segmentation and ongoing management of the office perimeter.
Acronis backup
As an Acronis Platinum Service Provider, we run encrypted backup with tested and recorded restores.
24x7 monitoring
Continuous security and availability monitoring, with alerts handled by our team.
Frequently asked questions
What is the Provision 213 deadline for my office?+
It depends on the office class, defined by gross semiannual revenue. Under Provision 243, Stages 1 and 2 count from the new rule's effective date: 180 days for Class 3, 240 days for Class 2 and 300 days for Class 1. Later stages also count from that date.
Can the office outsource IT?+
Yes. The rule allows own, contracted, shared or collective solutions. Responsibility for selecting, hiring and supervising the provider stays with the office holder.
What is the evidence dossier?+
An organized set of documents, reports, test records and settings proving each requirement was implemented. It supports the holder's signed declaration and eases inspection.
Do you also handle LGPD?+
Yes. LGPD compliance is part of the work, with data mapping, policies, incident response plan and DPO support.
Let's understand your office's situation
The first step is a no-cost commercial conversation to understand the office size, current environment and applicable deadlines. The Provision 213 technical assessment is a separate step, with scope and proposal defined after this conversation.
Talk to a specialist