Provides financial services, in the Gambia

Cybersecurity Guidelines for Financial Institutions (Central Bank of The Gambia), parts 3 and 4 · Read the law's page

• This reaches you where you are a deposit-taking financial institution, such as a commercial bank, savings and loans company, mutual savings company or credit union, authorised under the Banking Act 2009 or the Non-Bank Financial Institutions Act 2016 (secs. 1.3 and 1.4) (reached by declaring that you are a bank).
• Appoint a Chief Information Security Officer who ensures that cybersecurity policies and procedures are adhered to and incidents are dealt with on time, who chairs the Cybersecurity Steering Committee, and who creates a cyber-incident response plan (secs. 3.3 and 3.4).
• Establish a risk management framework that defines roles and responsibilities in addressing cyber risk, and a robust operational risk management policy with appropriate systems, procedures and controls to identify, protect, detect, monitor and manage cyber risks (part IV).
• Develop an incident response policy to plan for, respond to, contain and rapidly recover from disruptions caused by cyber incidents; the policy should stipulate a Board-approved cyber-incident response plan, a dedicated response team and cybersecurity drills based on the plan (sec. 4.1.3).
• Keep a business continuity plan and disaster recovery plan, create a test calendar for it, and test it against disruptive, destructive and corruptive cyber events (sec. 4.1.1).
• Carry out a cyber resilience assessment of your current cybersecurity posture at regular intervals, conduct regular cyber drill exercises, and submit cybersecurity functions to regular independent assessment and testing by internal audit, risk management and external audit (secs. 4.2 and 4.3).

Cybersecurity Guidelines for Financial Institutions (Central Bank of The Gambia), parts 3 and 5 (incident reporting) · Read the law's page

• This reaches you where you are a deposit-taking financial institution, such as a commercial bank, savings and loans company, mutual savings company or credit union, authorised under the Banking Act 2009 or the Non-Bank Financial Institutions Act 2016 (secs. 1.3 and 1.4) (reached by declaring that you are a bank).
• Report all cyber incidents, whether successful or not, to the Central Bank of The Gambia immediately after the incident is identified, using the cyber incident report template in Appendix II, and provide additional information afterwards where necessary and applicable (sec. 5.2(4)).
• Have your Board receive quarterly reports and updates concerning cyber and information security incidents, and have senior management receive quarterly reports on the state of the cyber and information security programme (secs. 3.1 and 5.2).
• Develop adequate management processes and plans for IT incident detection, notification and escalation; your incident response policy should stipulate how crisis information is communicated and shared with stakeholders including the Central Bank of The Gambia, law enforcement agencies and the public (sec. 4.1.3).