Provides financial services, in Sierra Leone

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats) · Read the law's page

• Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.
• This binds a person or institution that operates a computer system or network, whether public or private, not a licensed or sector-specific status; operating a computer system or network at all is enough to place an app in scope.
• The Act does not name a reporting channel, form, or contact point for the National Computer Security Incidence Response Team, unlike India's CERT-In directions or similarly detailed regimes; confirm the current reporting channel directly with the Team, housed within the Ministry of Communication, Technology and Innovation.

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), ss. 7-8 (Critical National Information Infrastructure) · Read the law's page

• If your system, data, or traffic data is designated, meet the minimum standards, guidelines, rules, or procedures the Presidential Order prescribes, which section 7(2) requires to cover at least securing systems by default and logging system and user activity for audit, and permit the National Computer Security Incidence Response Team to audit and inspect the designated infrastructure at any time.
• This only binds a computer system, computer data, or traffic data the President has designated, by an Order published in the Gazette on the Minister's recommendation and in consultation with the National Cybersecurity Advisory Council, as Critical National Information Infrastructure; declaring a flagged activity alone does not put an app in scope, and no public register of designated infrastructure was located.

Cyber Security and IT Risk Management Guidelines for Commercial Banks (Government Notice 429 of 2021), secs. 1.6 to 8.0 · Read the law's page

• This reaches you where you are a commercial bank licensed by the Bank of Sierra Leone under section 8 of the Banking Act 2019 (sec. 1.4) (reached by declaring that you are a bank).
• Recruit or appoint a Chief Information Security Officer who reports to the Board and copies the CEO, establish a Cyber and Information Systems Security function headed by that officer, and establish a Cyber and Information Security Steering Committee chaired by the officer (sec. 1.6).
• Have your Board approve a cyber and information security strategy and a framework of policies, standards and procedures, with the cyber security policy and strategy kept separate from the broader IT policy and strategy (secs. 1.6, 3.1 and 3.2).
• Institute controls that include malware protection, the capacity to employ encryption technologies for confidential information in the information systems and in transmission, configuration of firewalls, routers and network segmentation, and logical access controls limited to authorized individuals (sec. 4.0).
• Continuously monitor the network and information systems to detect anomalies and potential cyber security incidents, covering security information and event management, security cameras and intrusion detection including vulnerability assessment and penetration testing (sec. 5.0).
• Implement an incident response management programme with an incident response management plan and business and disaster continuity management, and keep a cyber-crisis management plan (secs. 1.6 and 6.0).
• Institute a cyber-threat intelligence program with a Board-approved policy, and establish a cyber-security information sharing and collaboration platform for sharing within the bank and among banks, regulators and external parties (secs. 7.0 and 8.0).
• Comply within 180 days of the effective date of the Guidelines (sec. 1.7), and submit your cyber security and IT risk management policies, strategies and frameworks to the Bank of Sierra Leone by 31 December 2021 (sec. 9.0).

Cyber Security and IT Risk Management Guidelines for Commercial Banks (Government Notice 429 of 2021), secs. 2.1, 7.0 and 9.0 (incident reporting) · Read the law's page

• This reaches you where you are a commercial bank licensed by the Bank of Sierra Leone under section 8 of the Banking Act 2019 (sec. 1.4) (reached by declaring that you are a bank).
• Inform the Bank of Sierra Leone within 24 hours of any cyber security incident, in the format set out in Appendix II to the Guidelines (sec. 9.0(4)).
• Provide the Bank of Sierra Leone, on a quarterly basis, a report in the format of Appendix III concerning occurrences of cyber security incidents and your handling of them (sec. 9.0(5)).
• Promptly report all impending and challenging cyber-threats to your information assets to the Director, Banking Supervision Department, Bank of Sierra Leone (sec. 7.0).
• Have your Board report in a timely manner to the Bank of Sierra Leone any serious incident relating to information systems or any unexpected event, and respond to it quickly in accordance with the contingency plan (sec. 2.1(17)).