Provides financial services, in Iraq

Central Bank of Iraq Standards Booklet 2025 Intended for Private Banks (Commercial and Islamic), Standard B7 · Read the law's page

• This binds a private bank, commercial or Islamic, licensed in Iraq (reached by declaring that you are a bank); the Booklet applies exclusively to private banks.
• Establish strong, secure and stable infrastructure that is resilient and can withstand cyberattacks, aligned with the Central Bank of Iraq's specifications in the Assessment Guidelines (Standard B7.1).
• Protect all data from unauthorized access and tampering, and apply mandatory encryption at rest and in transit to Tier 0 and Tier 1 data, including customer master data, customer authentication data, customer contact data and static account identifiers (Standard B7.1 and Assessment Guidelines, Standard B.7).
• Maintain a detailed Incident Response Plan for cybersecurity breaches and update it annually (Assessment Guidelines, Standard B.7, item 11).
• Obtain an annual assurance report on infrastructure and encryption compliance from a third-party specialist firm on the Central Bank of Iraq's approved list, and submit it to the board and the Central Bank within a maximum of 60 days since the close of the financial year (Standard B7.2 and Assessment Guidelines, Standard B.7).
• Abide by the requirements and specifications of ISO 27001, ISO 20000, ISO 22301, 25011 and PCI DSS, implemented in a phased approach with an analysis of cost and expected timelines (Assessment Guidelines, Standard B.7, items 9 and 10).