Duty LXD-7456
Is a bank, in Morocco
Bank Al-Maghrib Directive on Intrusion Tests of Credit Institutions' Information Systemssince 7 lines
Directive n° 3/W/16 du 10 juin 2016 fixant les règles minimales à observer par les établissements de crédit pour réaliser les tests d’intrusion des systèmes d’information · Read the law's page
- This binds a credit institution (établissement de crédit) supervised by Bank Al-Maghrib under Law 103-12 (reached by declaring that you are a bank or a lender).
- Assess the security of your information system and make the regular conduct of intrusion tests part of an overall, risk-based framework for evaluating the effectiveness of your security arrangements (Article 1).
- Adopt each year a programme of tests, specifying the perimeter, nature, extent and frequency of the tests for your whole information system, and submit it for validation to your audit or risk committee (Article 3).
- Test information systems that are open to the outside more than once a year, and test again on any change in the information system that may affect your exposure to information-security or cyber-attack risks (Articles 6 and 7).
- Carry out targeted tests when Bank Al-Maghrib requires them, at the frequency and in the manner it determines (Article 7).
- Report the results of the tests to your management body and your audit or risk committee, and draw up an action plan to correct the vulnerabilities and weaknesses found (Articles 17 and 19).
- Send Bank Al-Maghrib, by 31 March at the latest, an annual report on the tests covering your risk mapping, the tests carried out and their results, the corrective action plans and the programme for the coming year (Article 20).