Provides financial services, in Angola

Aviso n.º 8/20 (BNA), Artigo 8.º · Read the law's page

• This binds the financial institutions under the supervision of the Banco Nacional de Angola (article 2); you are reached by declaring that you provide financial services.
• Report to the Banco Nacional de Angola any breach of your networks and information systems, or loss of integrity, that significantly affects how those networks and services function (article 8).
• Make that report after you detect the incident, then send situation updates every 4 hours until normal service is restored (article 8).
• Where necessary, and without prejudice to professional secrecy and free competition, develop initiatives to share information on relevant incidents, to limit their impact and strengthen the financial system's resilience to cyber-attacks (article 8).

Aviso n.º 8/20 (BNA), Artigos 4.º a 7.º e 9.º a 12.º · Read the law's page

• This binds the financial institutions under the supervision of the Banco Nacional de Angola (article 2); you are reached by declaring that you provide financial services.
• Define, implement and maintain a cybersecurity policy built on internationally accepted standards that ensures the confidentiality, integrity and availability of your networks, data and information systems (article 4).
• Build into that policy authentication, authorization, encryption, intrusion prevention and detection, prevention of information leakage, and periodic tests and audits to detect vulnerabilities (article 4).
• Publish the policy to the public, your staff and your service providers in clear language (article 5).
• Draw up an action plan to respond to incidents, with a procedures manual approved by your management body and reviewed every year or when relevant changes occur (article 6).
• Set up a dedicated structure or team responsible for the cybersecurity policy and for running the action and incident-response plan (article 7).
• Before contracting cloud-computing services, tell the Banco Nacional de Angola at least 60 days ahead, for appraisal and approval, giving the details article 10 lists (article 10).
• Before contracting cloud-computing services, check and document that the provider can ensure confidentiality, integrity, availability and recovery of your data (article 11).
• Classify the information you consider essential to the security of society, your clients and the State by confidentiality level, and decide from that classification what may migrate to the cloud (article 12).