Is an insurer, in Bahrain

Insurance Cyber Security Incident Reporting Rules, Central Bank of Bahrain Rulebook Volume 3, Module RM, paragraphs RM-9.1.58 to RM-9.1.60 · Read the law's page

• This binds an insurance licensee of the Central Bank of Bahrain (reached by declaring that you are an insurer). The rule was added in January 2022 and amended in April 2022.
• Contact the Central Bank of Bahrain by telephone immediately, within one hour, on detecting a cyber security incident, internal or external, that compromises customer information or disrupts critical services that affect operations (RM-9.1.58).
• Submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours (RM-9.1.58).
• Submit Section B of the Cyber Security Incident Report within 10 calendar days of the incident, with the full root cause analysis, the impact on business operations and customers, and the measures taken to stop the attack and prevent a recurrence, and send a weekly progress update until the incident is fully resolved (RM-9.1.59).

Insurance Cyber Security Risk Management Rules, Central Bank of Bahrain Rulebook Volume 3, Module RM, paragraphs RM-9.1.1 to RM-9.1.57 · Read the law's page

• This binds an insurance licensee of the Central Bank of Bahrain (reached by declaring that you are an insurer). The section was added in October 2019 and amended in January 2022.
• Have your Board ensure a robust cyber security risk management framework, developed in accordance with the NIST Cyber security framework, that covers a cyber security strategy, policy and risk management approach, tools and methodology (RM-9.1.1 to RM-9.1.3).
• Implement cyber security incident management processes for timely detection, response and recovery, and assign the roles and resources to detect, investigate and respond to cyber incidents (RM-9.1.32 and RM-9.1.36).
• Identify the critical systems and services that must be recovered on a priority basis (RM-9.1.46).
• Arrange to seek cyber risk insurance cover from a suitable insurer after a risk-based assessment (RM-9.1.54).
• Make sure all employees receive adequate cyber security training on a regular basis (RM-9.1.56).
• Report cyber security incidents to the Central Bank of Bahrain on the clocks stated in the separate incident reporting row (RM-9.1.58 and RM-9.1.59).