Is a bank, in Mauritius

Bank of Mauritius Guideline on Cyber and Technology Risk Management (BOM/BSD 780/May 2023), Parts I to VIII and X · Read the law's page

• This binds every financial institution licensed or authorised by the Bank of Mauritius (reached by declaring that you provide financial services). The Guideline came into effect on 29 May 2023, and paragraph 102 required full compliance by the end of June 2024.
• Have your board review and approve at least annually the technology strategy, the cyber and technology risk management strategy and framework and the related policies, and appoint a senior officer as Chief Information Security Officer (paragraph 5).
• Keep a board approved business continuity plan and a board approved response and recovery plan for cyber and technology incidents (paragraphs 54 and 55).
• Have independent specialists assess the critical systems, services, infrastructures and other assets for vulnerabilities on an annual basis, and penetration test internet-facing systems and critical infrastructure after deployment or any major change and annually thereafter (paragraphs 74 and 81).
• Have the governance and the cyber and technology risk management framework audited by an external independent assessor, covering critical systems, services, infrastructures and other assets and electronic delivery channels annually and all areas within a two-year cycle for a Domestic Systemically Important Bank or a three-year cycle for any other financial institution (paragraph 67).
• Run a cyber and technology security awareness and training programme for staff, senior management and the board at least annually (paragraph 94).

Bank of Mauritius Guideline on Cyber and Technology Risk Management (BOM/BSD 780/May 2023), paras. 55(viii) and 95-97 · Read the law's page

• This binds every financial institution licensed or authorised by the Bank of Mauritius (reached by declaring that you provide financial services). The Guideline came into effect on 29 May 2023, and paragraph 102 required full compliance by the end of June 2024.
• Report cyber and technology events and incidents to the Bank of Mauritius in the manner and format the Bank prescribes (paragraph 96).
• Share cyber and technology threat intelligence information with the Bank in the manner and format the Bank prescribes (paragraph 97).
• Submit to the Bank the findings of all audits, assessments and testing exercises, together with the remediation plan, within 90 days from the date of completion of each exercise (paragraph 95).
• Set out in your board approved response and recovery plan the details of internal and external stakeholders, including the Bank, the information to be shared and reported and the relevant timeframes, including in an emergency (paragraph 55(viii)).