Provides financial services, in Eswatini

CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 1.3, 3 to 9 and 11 · Read the law's page

• This binds a financial institution regulated and licensed by the Central Bank of Eswatini under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 or the National Clearing and Settlement Systems Act, 2011, which the Guidelines expect to implement them within 12 months of their publication (paragraph 1.3.1; reached by declaring that you provide financial services).
• Have a cyber resilience framework that states how the institution determines its cyber resilience objectives and cyber risk tolerance and how it identifies, mitigates and manages its cyber risks; the Guidelines say the institution should, with board endorsement and periodic review (paragraph 3.2.1).
• Identify business functions and supporting processes, classify them by criticality and maintain a current inventory of information assets and system configurations; the Guidelines say the institution should (paragraphs 4.2.1 and 4.2.2).
• Implement protective controls in line with leading-practice cyber resilience standards, proportionate to the threat landscape and systemic role in the financial system; the Guidelines say the institution should (paragraph 5.2.1).
• Establish capabilities to continuously monitor and detect anomalous activities and events; the Guidelines say the institution should (paragraph 6.2.1).
• Design and test systems and processes to enable the safe resumption of critical operations within two hours of a disruption; the Guidelines say the institution should (paragraph 7.2.2).
• Establish a comprehensive testing programme to validate the effectiveness of the cyber resilience framework on a regular and frequent basis; the Guidelines say the institution should (paragraph 8.2.1).

CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 7.5.1 and 7.5.2 · Read the law's page

• This binds a financial institution regulated and licensed by the Central Bank of Eswatini under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 or the National Clearing and Settlement Systems Act, 2011, which the Guidelines expect to implement them within 12 months of their publication (paragraph 1.3.1; reached by declaring that you provide financial services).
• In the event of a successful cyber attack, notify the Central Bank within two hours of verifying the incident, using the incident notification form in Appendix A, and be ready to provide the updates the Bank requests; the Guidelines say the institution should (paragraph 7.5.1).
• Once you are satisfied that you have contained and recovered from the incident, submit a report to the Central Bank, expected at most on the fourth working day since the incident was detected, with the information available and a note that a full report follows if investigations are incomplete; the Guidelines say the institution shall (paragraph 7.5.2).

Minimum Standards for Electronic Payment Schemes, September 2010, paras. 1.4, 5.1, 9.1.7, 9.2 and 11.3 to 11.4 · Read the law's page

• This binds a financial institution or non-financial institution, including a payment system operator or payment service provider, that has introduced or intends to introduce an electronic payment scheme or product, and is required to adhere to the Minimum Standards (paragraph 1.4; reached by declaring that you are a bank or a payment provider).
• Put in place appropriate security control processes for the scheme that address authentication, non-repudiation, data and transaction integrity, segregation of duties, authorization controls, and maintenance of audit trails and confidentiality of key financial institution information (paragraph 9.2).
• Have the board and senior management review and approve the key aspects of the security control process, including authorization privileges, logical and physical access controls and adequate infrastructure security (paragraph 9.1.7).
• Have effective capacity, business continuity and contingency planning processes to help ensure the availability of the electronic payment scheme and its services (paragraph 11.3).
• Develop appropriate incident response plans to manage, contain and minimize problems arising from unexpected events, including internal and external attacks, that may hamper the provision of electronic payment systems and services (paragraph 11.4).

Minimum Standards for Electronic Payment Schemes, September 2010, paras. 4.3 and 4.4 · Read the law's page

• This binds a financial institution or non-financial institution, including a payment system operator or payment service provider, that has introduced or intends to introduce an electronic payment scheme or product, and is required to adhere to the Minimum Standards (paragraph 1.4; reached by declaring that you are a bank or a payment provider).
• Report promptly any suspected or confirmed case of fraud relating to an electronic payment scheme, any major security breach, any material service interruption or other significant issue (paragraph 4.3, in the section on the Central Bank's oversight function).
• Ensure regular and timely submission of all reports the Central Bank requests about providing electronic payment scheme services or products (paragraph 4.4).