Is a lender, in Ethiopia

Computer Crime Proclamation No. 958/2016, art. 2(13), art. 2(19), art. 17, art. 27, art. 46 · Read the law's page

• Immediately notify the Information Network Security Agency (now the Information Network Security Administration) and report the crime to the police, and take appropriate measures.
• This binds a service provider, defined as a person who provides technical data-processing or communication service or alternative infrastructure to users by means of a computer system, or a government organ; the trigger is knowledge that a crime under this Proclamation is being committed, or knowledge that a third party is disseminating illegal content through the computer system you administer, which on this definition's own terms reaches an app or platform operator whose product is itself that computer system, not only a network, hosting, or telecommunications intermediary.
• The Agency may issue a directive setting the form and procedure for this report; no such directive is confirmed as a separately published text in the primary sources located here.
• No provision of this Proclamation states a separate penalty for failing this reporting duty. The Article 17 offense for failing to cooperate with an investigation lists five other, unrelated articles on data retention, real-time collection, data preservation orders, data-production orders, and search assistance, and does not include this one.

National Bank of Ethiopia Directive No. 884/2022, IT incident reporting (Requirements for Information Technology (IT) Management of Capital Goods Financing Company), arts. 3, 10 · Read the law's page

• This binds every capital goods financing company operating in Ethiopia, a licensed lessor and lender (reached by declaring that you are a lender). Its provisions other than Articles 5 and 6.7 have applied since 1 April 2023, one year after the Directive entered into force on 1 April 2022.
• Notify the Microfinance Institutions Supervision Directorate of the National Bank within 2 working days of any IT incident that could have significant impact on your ability to provide services to your customers or adversely affect your reputation or financial condition, in the format of Annex-1 to the Directive (Article 10.1).
• Submit to the Microfinance Institutions Supervision Directorate every quarter a report on your ongoing handling of IT incidents, in the format of Annex-2 to the Directive (Article 10.2).

National Bank of Ethiopia Directive No. 884/2022, IT risk management and security programme (Requirements for Information Technology (IT) Management of Capital Goods Financing Company), arts. 3, 6 to 9 · Read the law's page

• This binds every capital goods financing company operating in Ethiopia, a licensed lessor and lender (reached by declaring that you are a lender). Its provisions other than Articles 5 and 6.7 have applied since 1 April 2023, one year after the Directive entered into force on 1 April 2022. Articles 5 and 6.7 applied from the end of three years from that date (Article 11.1).
• Put in place and implement an IT risk management program aligned with your risk management program, and take into account the cyber security risk management requirements the Information Network Security Agency provides (Articles 6.1 and 6.3).
• Conduct an IT risk assessment every quarter, present the report to your board of directors, send it to the Microfinance Institutions Supervision Directorate of the National Bank within 30 calendar days after the end of the quarter, and keep an IT risk register that you update quarterly (Articles 6.4 to 6.6).
• Develop and implement IT risk management strategies, plans, policies, procedures and standards covering at least physical access and network security, business continuity, disaster recovery, incident response, hardware, software and network maintenance, database and backup management and access, IT change and patch management, vendor and third-party service provider management, customer data privacy, password, data transfer, user access, antivirus and firewall security, and risk in system development, integration and acquisition, and revise them from your periodic risk assessment findings (Articles 7.1 to 7.3).
• Prepare an annual IT security awareness plan and provide the awareness program to relevant employees, including the board and senior management (Articles 8.1 and 8.2).
• Maintain an IT audit function within internal audit that audits at least quarterly, includes at least an annual cyber threat test or other IT audit activities the Information Network Security Agency provides, and reports its findings to the board audit committee with a copy to the Microfinance Institutions Supervision Directorate of the National Bank (Articles 9.1, 9.4 and 9.5).

National Bank of Ethiopia Directive No. 887/2022, IT incident reporting (Requirements for Information Technology (IT) Management of Microfinance Institution), arts. 3, 10 · Read the law's page

• This binds every microfinance institution operating in Ethiopia, a licensed deposit-taker and lender (reached by declaring that you are a bank or a lender). Its provisions other than Articles 5 and 6.7 have applied since 1 April 2023, one year after the Directive entered into force on 1 April 2022.
• Notify the Microfinance Institutions Supervision Directorate of the National Bank within 2 working days of any IT incident that could have significant impact on your ability to provide services to your customers or adversely affect your reputation or financial condition, in the format of Annex-1 to the Directive (Article 10.1).
• Submit to the Microfinance Institutions Supervision Directorate every quarter a report on your ongoing handling of IT incidents, in the format of Annex-2 to the Directive (Article 10.2).

National Bank of Ethiopia Directive No. 887/2022, IT risk management and security programme (Requirements for Information Technology (IT) Management of Microfinance Institution), arts. 3, 6 to 9 · Read the law's page

• This binds every microfinance institution operating in Ethiopia, a licensed deposit-taker and lender (reached by declaring that you are a bank or a lender). Its provisions other than Articles 5 and 6.7 have applied since 1 April 2023, one year after the Directive entered into force on 1 April 2022. Articles 5 and 6.7 applied from the end of three years from that date (Article 11.1).
• Put in place and implement an IT risk management program aligned with your risk management program, and take into account the cyber security risk management requirements the Information Network Security Agency provides (Articles 6.1 and 6.3).
• Conduct an IT risk assessment every quarter, present the report to your board of directors, send it to the Microfinance Institutions Supervision Directorate of the National Bank within 30 calendar days after the end of the quarter, and keep an IT risk register that you update quarterly (Articles 6.4 to 6.6).
• Develop and implement IT risk management strategies, plans, policies, procedures and standards covering at least physical access and network security, business continuity, disaster recovery, incident response, hardware, software and network maintenance, database and backup management and access, IT change and patch management, vendor and third-party service provider management, customer data privacy, password, data transfer, user access, antivirus and firewall security, and risk in system development, integration and acquisition, and revise them from your periodic risk assessment findings (Articles 7.1 to 7.3).
• Prepare an annual IT security awareness plan and provide the awareness program to relevant employees, including the board and senior management (Articles 8.1 and 8.2).
• Maintain an IT audit function within internal audit that audits at least quarterly, includes at least an annual cyber threat test or other IT audit activities the Information Network Security Agency provides, and reports its findings to the board audit committee with a copy to the Microfinance Institutions Supervision Directorate of the National Bank (Articles 9.1, 9.4 and 9.5).

Critical Infrastructure Cybersecurity Proclamation No. 1426/2026, art. 3, art. 4, art. 5, art. 7, art. 8, art. 22(1)(a), art. 22(1)(d)-(f), art. 22(2)-(3), art. 22(5), art. 25(1)(a), art. 25(1)(c)-(d), art. 25(2)-(4), art. 28 · Read the law's page

• Formulate and implement your own cybersecurity program and cybersecurity framework consistent with the mandatory national cybersecurity frameworks the Administration issues, classify and protect your critical assets to the Administration's standard, create the cybersecurity organizational structure the national framework calls for, and establish and manage a center responsible for monitoring, reporting, and responding to cyberattacks.
• Conduct regular cybersecurity risk assessments and impact analyses, participate in the Administration's annual National Cybersecurity Risk Survey and supply the information it requests, and obtain and renew a cyber audit certificate and a cybersecurity inspection-and-evaluation certificate from the Administration, taking appropriate corrective action within the time the Administration sets on any gap the audit or inspection finds.
• Employ cybersecurity professionals who hold a certification the Administration issues or recognizes, ensure the security of the supply chain of the technology products you use, obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system acquired by purchase, donation, development, or any other means, and ensure that any employee or officer with access to your critical assets holds a security clearance from the relevant government body.
• You may perform these obligations yourself or delegate them to a person licensed to provide cybersecurity services under this Proclamation, unless the Administration has identified your infrastructure, on national-security grounds, as one whose cybersecurity duties may not be delegated.
• Not implementing a mandatory cybersecurity framework in a timely manner is an administrative offense fined from 500,000 to 1,000,000 Birr; not cooperating with a periodic cybersecurity audit is fined from 1,500,000 to 2,000,000 Birr; not taking timely corrective action on a cyber-audit finding, and using an information and communication technology system that has not undergone the required cybersecurity inspection and evaluation, are each fined from 800,000 to 1,000,000 Birr. A negligent violation is fined at no more than half those amounts, a first violation causing no damage may be resolved with a written warning instead, and a repeat violation is fined at triple the stated maximum for that offense.
• An officer, employee, member of the management body, or owner of the critical infrastructure who intentionally fails to implement a mandatory cybersecurity framework, fails to take timely corrective action on an audit finding, or uses an information and communication technology system that has not undergone the required inspection and evaluation, is separately subject to imprisonment of up to one year, rising to rigorous imprisonment of seven to ten years, or three to five years if committed negligently, where the failure interrupts, disrupts, or damages the critical infrastructure's service, compromises its integrity or confidentiality, or harms national security, national interest, public health, life, or the environment.
• This binds a critical infrastructure owner, or its delegated cybersecurity service provider, that the Information Network Security Administration has designated by Directive under Article 5 as critical infrastructure within one of twelve named sectors (information technology and communication, finance, security and safety, transport, education, health, water and energy, government services, disaster management, agriculture, trade, and industry). It reaches a designated critical infrastructure located outside Ethiopia's territory as well as inside it, and the primary text confirms no duty yet on an organization the Administration has not designated.

Critical Infrastructure Cybersecurity Proclamation No. 1426/2026, art. 7(14), art. 9(2), art. 22(1)(b)-(c), art. 22(2)-(3), art. 22(5), art. 25(1)(b), art. 25(2)-(4), art. 28 · Read the law's page

• Notify the National Computer Emergency Response Center of a cyber incident within 48 hours of becoming aware of it, using the system the Administration establishes, and implement the mandatory recommendations or directions the Center provides within the time it sets.
• Provide the National Computer Emergency Response Center the information it requests and cooperate appropriately with its activities when it is responding to a cyberattack.
• Failing to notify an incident within 48 hours, or to take appropriate corrective action, is an administrative offense fined from 1,500,000 to 2,000,000 Birr; failing to provide the requested information or cooperation during a cyberattack response is fined from 300,000 to 500,000 Birr; a negligent violation of either is fined at no more than half the stated amount, a first violation causing no damage may be resolved with a written warning instead, and a repeat violation is fined at triple the stated maximum.
• An officer, employee, member of the management body, or owner of the critical infrastructure who intentionally fails to notify the Center within 48 hours, or to take appropriate corrective action, is separately subject to imprisonment of up to one year; where that failure interrupts, disrupts, or damages the critical infrastructure's service, compromises its integrity or confidentiality, or harms national security, national interest, public health, life, or the environment, the term rises to rigorous imprisonment of seven to ten years, or three to five years where the aggravated result is caused negligently.
• This binds a critical infrastructure owner, or its delegated cybersecurity service provider, that the Information Network Security Administration has designated by Directive under Article 5 as critical infrastructure within one of twelve named sectors (information technology and communication, finance, security and safety, transport, education, health, water and energy, government services, disaster management, agriculture, trade, and industry). It reaches a designated critical infrastructure located outside Ethiopia's territory as well as inside it, and the primary text confirms no duty yet on an organization the Administration has not designated.