Provides financial services, in Jamaica

Bank of Jamaica Standard of Sound Practice on Management of Cyber Risks (September 2024), ss. 3 to 6 · Read the law's page

• This binds a deposit-taking institution licensed under the Banking Services Act, 2014 (reached by declaring that you are a bank). The Standard states some of its requirements as what an institution should do and others as what it must do.
• Conduct continuous monitoring of emerging cybersecurity threats such as denial of service attacks, internal sabotage and malware infestations, so that intrusion attempts and unauthorized or malicious activities by internal and external parties are detected promptly (section 4.6.5).
• Provide the Bank of Jamaica with an annual attestation that includes areas of weakness, compensating controls in areas of non or partial compliance and the initiatives being undertaken to address them, alternating between a self-attestation and an independent attestation (section 4.10.2).
• Provide external reports on vulnerability tests at least twice yearly and on penetration testing at least annually. The Standard states this as what you should do (section 4.10.4).

Bank of Jamaica Standard of Sound Practice on Management of Cyber Risks (September 2024), ss. 4.6.6 and 4.10.1 · Read the law's page

• This binds a deposit-taking institution licensed under the Banking Services Act, 2014 (reached by declaring that you are a bank). The Standard states some of its requirements as what an institution should do and others as what it must do.
• Report cyber incidents and data breaches promptly to the Bank of Jamaica, within 72 hours, along with the relevant authorities (sections 4.6.6 and 4.10.1).
• Provide a digital forensics report from an external cybersecurity assessor if the Bank of Jamaica asks for one (section 4.10.1).