Runs an essential service, in Brunei Darussalam

Cybersecurity Act (Chapter 272, Laws of Brunei, Revised Edition 2024), s. 16 · Read the law's page

• Applies to an owner of a computer or computer system designated as critical information infrastructure by the Commissioner of Cybersecurity under section 9, because it is necessary for the continuous delivery of an essential service and is located wholly or partly in Brunei Darussalam.
• Notify the Commissioner, in the form and manner the Commissioner determines and within the period prescribed after becoming aware of it, of a prescribed cybersecurity incident in respect of the critical information infrastructure, and of a prescribed cybersecurity incident in respect of any interconnected computer or computer system under your control (section 16(1)(a) and (b)).
• Notify the Commissioner in the same way of any other type of cybersecurity incident in respect of the critical information infrastructure that the Commissioner has specified by written direction to you (section 16(1)(c)).
• Establish the mechanisms and processes for detecting cybersecurity threats and incidents in respect of the critical information infrastructure that any applicable code of practice sets out (section 16(2)).

Cybersecurity Act (Chapter 272, Laws of Brunei, Revised Edition 2024), ss. 9, 12, 13, 14, 15, 17 and 18 · Read the law's page

• Applies to an owner of a computer or computer system designated as critical information infrastructure by the Commissioner of Cybersecurity, by written notice under section 9, because it is necessary for the continuous delivery of an essential service (energy, infocommunications, healthcare, banking and finance, defence and security, emergency services, aviation, functioning of Government, media or water) and is located wholly or partly in Brunei Darussalam.
• Comply with the codes of practice and standards of performance that apply to the critical information infrastructure, unless the Commissioner has waived them (section 13(6) and (7)).
• Cause an audit of the compliance of the critical information infrastructure with the Act and the applicable codes of practice and standards of performance to be carried out at least once every 2 years, or more often where the Commissioner directs, by an auditor approved or appointed by the Commissioner (section 17(1)(a)).
• Conduct a cybersecurity risk assessment of the critical information infrastructure at least once a year, in the form and manner the Commissioner determines (section 17(1)(b)).
• Furnish a copy of each audit report and each risk assessment report to the Commissioner not later than 30 days after completion (section 17(2)).
• Notify the Commissioner of a material change to the design, configuration, security or operation of the critical information infrastructure not later than 30 days after the change is made, where information on it was furnished under a notice of the Commissioner (section 12(5)).
• Inform the Commissioner of a change in the beneficial or legal ownership of the critical information infrastructure not later than 7 days after the change (section 15(1)).
• Furnish the information on the design, configuration, security and operation of the critical information infrastructure that the Commissioner requires by notice, within the reasonable period the notice specifies (section 12(1)).
• Comply with a written direction of the Commissioner to the owner or to a class of owners, and participate in a cybersecurity exercise when the Commissioner directs it in writing (sections 14 and 18(2)).