Provides financial services, in Sri Lanka

Banking Act Directions No. 16 of 2021 (Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks), Directions 1 to 8 and Schedule I · Read the law's page

• This binds every licensed commercial bank and licensed specialised bank, including its operations conducted through agents and third-party service providers (reached by declaring that you are a bank).
• Establish an Information Security Committee as the apex management level body responsible for information security and technology resilience (Schedule I, 4.1.1).
• Appoint a Chief Information Security Officer as the executive officer responsible for the bank’s information security (Schedule I, 4.2.1).
• If you are a licensed commercial bank, a licensed specialised bank that is a domestic systemically important bank, or another licensed specialised bank offering electronic delivery channels other than automated teller machines, implement a Security Operations Center that is operational on a 24 x 7 basis (Schedule I, 5.6.1 and 5.6.4).
• Keep an up to date incident response plan approved by your Board of Directors, detailing procedures for incident escalation, remediation, recovery, and communication with internal and external stakeholders (Schedule I, 5.7.1).
• Test incident response and recovery capabilities at least annually (Schedule I, 5.7.2).
• Subject critical information systems to penetration tests by independent external experts at least annually, and other qualifying information systems and customer data repositories at least once in every two years (Schedule I, 5.8.3(ii)).
• Keep disaster recovery arrangements for critical information systems that meet a recovery time objective of less than 4 hours if you are a domestic systemically important bank, or less than 6 hours if you are not, and a recovery point objective of zero or near zero (Schedule I, 6.3.1).

Central Bank of Sri Lanka Circular No. 02 of 2025 (Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks), paragraphs 2 to 5 and Annexes 01 to 03 · Read the law's page

• This binds every licensed commercial bank and licensed specialised bank (reached by declaring that you are a bank).
• Report an IT or cybersecurity incident to the Director, Bank Supervision Department, at techrisk.bsd@cbsl.lk, copying dbsd@cbsl.lk, in the Annex 01 format within 2 hours of detecting it (paragraph 4, Table 01).
• Send the detailed report in the Annex 02 format, with a root cause analysis and the corrective actions taken, within 14 days of detecting the incident; the Annex 02 guidelines say 14 working days (paragraph 4, Table 01, and Annex 02).
• Send the quarterly report in the Annex 03 format within 15 days after the end of each quarter (paragraph 4, Table 01).
• Report at least these categories: intrusion or hacking, malware, ransomware, malicious code, viruses, phishing, denial of service attacks, social engineering, unauthorized system usage, insider threats, advanced persistent threats and supply chain attacks; online or digital scams affecting customers; unplanned critical system outages or failures; and regulatory non-compliances relating to IT and cybersecurity requirements (paragraph 3).