Is a bank, in Antigua and Barbuda

Technology Risk Standard, cyber governance, Prudential Standard on Technology Risk Management, paras. 5.2.4 and Board and Senior Management roles · Read the law's page

• This binds an institution licensed under the Banking Act 2015 of Antigua and Barbuda: the Prudential Standard on Technology Risk Management says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates unless IT is not a significant function or equally effective alternative measures have been taken, and it came into effect on 3 January 2023 (reached by declaring that you are a bank).
• Have your Board keep ultimate responsibility for effective oversight of all IT and cybersecurity risks, systems and processes, and approve the technology policies, standards and procedures that govern the management of technology risks and safeguard information system assets (Information Technology Governance and Board roles).
• Have Senior Management implement the Board-approved cyber security strategies, policies and framework, which the standard lists among Senior Management's responsibilities (Senior Management roles, item a).
• If you rely heavily on IT systems for daily operations, you should establish a cybersecurity policy based on your risk assessment that mitigates the identified cyber risk threats in line with your risk appetite (paragraph 5.2.4).
• Explain any deviation from the standard in a separate document and make it promptly available to the ECCB on request (Scope of Application, item c).

Technology Risk Standard, cyber incidents, Prudential Standard on Technology Risk Management, para. 12.8.1 and Appendix I · Read the law's page

• This binds an institution licensed under the Banking Act 2015 of Antigua and Barbuda: the Prudential Standard on Technology Risk Management says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates unless IT is not a significant function or equally effective alternative measures have been taken, and it came into effect on 3 January 2023 (reached by declaring that you are a bank).
• Within 24 hours of becoming aware of a cyber-incident, alert the ECCB and the Information Security User Group of licensed financial institutions that a cyber-incident occurred (paragraph 12.8.1).
• Complete the incident report in Appendix I of the standard and submit it to the ECCB within 48 hours of the incident; the standard states this as 'should' (paragraph 12.8.1 and Appendix I).
• Notify directly the customers whose accounts were potentially or actually compromised within seventy-two hours of the discovery of the incident (Senior Management roles, item g).
• Provide updates on the incident to the ECCB at the frequency the ECCB determines, until the ECCB deems the incident resolved, and after resolution conduct a post-incident review and submit it to the ECCB (paragraphs 12.8.4 and 12.8.5).
• Notify the general public about a cybersecurity incident only after notifying the ECCB (Senior Management roles, item f).
• Develop and implement a cybersecurity incident response plan that details the steps to be taken in the event of a security breach (Senior Management roles, item e).

Electronic Banking Standard, incident reporting, Banking Prudential Standard No. 3 of 2022, paras. 5.2.7, 5.11 and 6.4 · Read the law's page

• This binds an institution licensed under the Banking Act 2015 of Antigua and Barbuda: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on 1 February 2023 (reached by declaring that you are a bank).
• Send all incident reports and your response to the Central Bank within 3 days of the occurrence, and report any further update on the incident to the Central Bank (paragraph 6.4).
• Implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of your e-banking services (paragraph 5.2.7).
• Build into your incident response plan a clear process for alerting the appropriate regulatory authorities when security breaches or disruptive incidents occur, and a process to inform the ECCB, customers, counterparties and the media in a timely and appropriate manner of material e-banking disruptions and business resumption developments (paragraph 5.11.2(d) and (g)).

Electronic Banking Standard, security controls, Banking Prudential Standard No. 3 of 2022, paras. 5.2 and 6.4 · Read the law's page

• This binds an institution licensed under the Banking Act 2015 of Antigua and Barbuda: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on 1 February 2023 (reached by declaring that you are a bank).
• Make sure the security control infrastructure is in place to secure e-banking systems and data from internal and external threats, including appropriate authorisation, logical and physical access controls and adequate security infrastructure (paragraph 5.2.1).
• If e-banking services are outsourced, assess that the necessary controls are in place (paragraph 5.2.1).
• Implement a comprehensive security process with policies and procedures that address internal and external security threats in terms of incident prevention and the appropriate response, including physical controls, specialised security staff, logical controls with ongoing monitoring of network intrusion attempts, and ongoing review and testing of security measures (paragraph 5.2.2).
• Reinforce information security controls to preserve the confidentiality and integrity of customer data, and protect sensitive and high-risk e-banking systems with mechanisms such as encryption, firewalls, access control and data recovery plans (paragraph 5.2.4).
• Submit the security process you implement to the Central Bank (paragraph 6.4).