Is a lender, in Malaysia

Credit Reporting Agencies Act 2010 (Act 710), ss. 11, 22, 24, 26, 30, 31, 39, 61 and 62 · Read the law's page

• Do not carry on a credit reporting business in Malaysia unless you are a company registered as a credit reporting agency with a certificate of registration from the Registrar of Credit Reporting Agencies; carrying on the business unregistered is an offence carrying a fine up to RM1,000,000, imprisonment up to 3 years, or both.
• If you are a credit reporting agency, collect a customer's credit information only for a specific and lawful purpose directly related to your activity, only what is necessary for that purpose and no more than is adequate, and disclose it only with the customer's consent, to prevent or detect crime or for investigations, or where a law or court order requires or authorizes it.when it serves a financial business
• If you are a credit reporting agency, protect the credit information you hold from loss, misuse, unauthorized or accidental access or disclosure, alteration or destruction, impose access authentication controls, and keep an access log of every access for not less than two years.when it serves a financial business
• If you are a credit reporting agency, answer a customer's access request and correction request within 21 days of receiving each, and do not transfer a customer's credit information to a place outside Malaysia unless the Minister has specified that place by gazette notification or a listed exception applies.when it serves a financial business

Bank Negara Malaysia, Risk Management in Technology (RMiT) policy document (BNM/RH/PD 028-98), paras. S 11.18 and S 11.19 · Read the law's page

• This binds a financial institution that this policy document covers: a licensed bank, investment bank or Islamic bank, a licensed insurer or takaful operator, a prescribed development financial institution, an approved issuer of electronic money, an operator of a designated payment system, a registered merchant acquirer, or an intermediary remittance institution (reached by declaring that you provide financial services). Some paragraphs are disapplied for the smaller classes in paragraph 2.2.
• Notify the Bank of cyber incidents in adherence to the Bank's policy documents on Operational Risk Reporting (Part C), Business Continuity Management (Part C) and Merchant Acquiring Services (paragraphs 19.25 to 19.26), and any other relevant policy document the Bank specifies; the clock sits in those documents, and the RMiT policy document states none (S 11.18).
• Subject to the applicable data protection laws, share cyber threat intelligence information with the industry on a timely basis through the sharing platforms developed by the Bank, the industry or law enforcement agencies, and allocate resources to take part in industry-wide initiatives that improve collective threat intelligence capabilities (S 11.19).

Bank Negara Malaysia, Risk Management in Technology (RMiT) policy document (BNM/RH/PD 028-98), paras. S 11.2 to S 11.16 · Read the law's page

• This binds a financial institution that this policy document covers: a licensed bank, investment bank or Islamic bank, a licensed insurer or takaful operator, a prescribed development financial institution, an approved issuer of electronic money, an operator of a designated payment system, a registered merchant acquirer, or an intermediary remittance institution (reached by declaring that you provide financial services). Some paragraphs are disapplied for the smaller classes in paragraph 2.2.
• Develop a Cyber Risk Framework that articulates your governance for managing cyber risks, your cyber resilience objectives and your risk tolerance, with due regard to the evolving cyber threat environment (S 11.2).
• Adopt the control measures in Appendix 5 of the policy document to enhance your resilience to cyber-attacks (S 11.5).
• Conduct a realistic Red Team simulation attack on your infrastructure at least once every three years to identify and manage potential vulnerabilities (S 11.6).
• Establish a Security Operations Center, supported by competent resources and the necessary tools, that monitors your technology security posture and covers all critical systems including the supporting infrastructure (S 11.9).
• Establish and implement a comprehensive Cyber Incident Response Plan, and conduct an annual cyber drill exercise to test it, reporting the result to your board in a timely manner (S 11.13 and S 11.16).
• If the Bank has designated you a National Critical Information Infrastructure entity, ensure compliance with the requirements applicable to such entities, including the code of practice in Appendix 12 and any additional directives and standards the National Cyber Security Agency issues (S 11.4).