Is a bank, in Brunei Darussalam

Notice on Early Detection of Cyber Intrusion and Incident Reporting (Notice TRS/N-1/2020/1, Amendment No. 1), paras. 3.1 to 3.5, 5.2, 5.3 and 6.2 · Read the law's page

• Applies to a bank or Islamic bank licensed in Brunei Darussalam, as the Notice of the Brunei Darussalam Central Bank on early detection of cyber intrusion and incident reporting is issued under section 66 of the Banking Act (Chapter 95) and the corresponding section of the Islamic Banking Order, 2008.
• Keep systematic and consistent procedures for risk identification, assessment, responses and monitoring in relation to IT incidents including cyber intrusion, and perform risk assessments regularly and on an ad-hoc basis (paragraph 3.1).
• Monitor incoming and outgoing network traffic and internal network communications to detect and block suspicious or unauthorised events, and put in place mechanisms to detect and block behavioural anomalies on systems, servers and devices (paragraphs 3.2 to 3.4).
• On confirmation of a successful cyber intrusion, investigate its extent, the damage sustained and the vulnerabilities exploited, and take immediate action to contain it (paragraph 3.5).
• Notify the Central Bank by email at the latest five working days before any planned downtime, and do not schedule planned downtime during peak periods (paragraph 5.2).
• Make all reasonable efforts to keep each critical system available, so that its unplanned downtime does not exceed 240 minutes within a rolling period of 12 months, except where caused by systemic risks (paragraph 5.3).
• Keep policies and procedures on incident handling, business continuity and service restoration, and review them at least once a year (paragraph 6.2).

Notice on Early Detection of Cyber Intrusion and Incident Reporting (Notice TRS/N-1/2020/1, Amendment No. 1), paras. 4.1 to 4.7 · Read the law's page

• Applies to a bank or Islamic bank licensed in Brunei Darussalam, as the Notice of the Brunei Darussalam Central Bank on early detection of cyber intrusion and incident reporting is issued under section 66 of the Banking Act (Chapter 95) and the corresponding section of the Islamic Banking Order, 2008.
• Notify Technology Risk of the Brunei Darussalam Central Bank no later than one hour after the discovery of a Suspected Incident, by email, telephone call or another authorised communication channel (paragraph 4.1).
• Assess the Suspected Incident and notify the Central Bank no later than two hours after first discovery whether it is a successful cyber intrusion and whether it is a major IT incident (paragraph 4.2).
• Make no public announcement regarding a Suspected Incident before notifying the Central Bank of your assessment (paragraph 4.3).
• Once a cyber intrusion or major IT incident is confirmed, update the Central Bank on the progress of the incident response at least twice every calendar day until it is resolved (paragraph 4.4).
• Submit an IT Incident Report to the Central Bank by email within 5 working days from the notification under paragraph 4.2, or the longer period the Central Bank allows (paragraph 4.5).
• Record every confirmed near-miss IT incident and submit the details to the Central Bank within 5 working days after the end of each month (paragraph 4.7).