Is a securities firm, in Rwanda

National Bank of Rwanda Regulation N° 50/2022 of 02/06/2022 on Cyber Security in Regulated Institutions, art. 21 · Read the law's page

• This binds every regulated institution, meaning any financial institution licensed and supervised by the National Bank of Rwanda, unless a specific regulation or directive provides otherwise (reached by declaring that you provide financial services). Regulation N° 50/2022 came into force on 17 June 2022, and article 26 gave an institution that did not comply one year from its publication to comply.
• Notify the National Bank of Rwanda as promptly as possible, and within two hours of the occurrence of the incident or of a determination that a cyber security incident has occurred, where the incident may disrupt you from continuing your normal operations for customer-facing transactions or has a reasonable likelihood of materially harming any material part of your normal operations (article 21).
• Submit the full incident report to the National Bank of Rwanda within 24 hours of the occurrence of the incident, in the format of Appendix 1 to the Regulation (article 21).
• Follow any specific incident reporting requirement the National Bank of Rwanda provides in a Directive (article 21).

National Bank of Rwanda Regulation N° 50/2022 of 02/06/2022 on Cyber Security in Regulated Institutions, arts. 2-20 and 22 · Read the law's page

• This binds every regulated institution, meaning any financial institution licensed and supervised by the National Bank of Rwanda, unless a specific regulation or directive provides otherwise (reached by declaring that you provide financial services). Regulation N° 50/2022 came into force on 17 June 2022, and article 26 gave an institution that did not comply one year from its publication to comply.
• Make the Board of Directors and Senior Management responsible for cyber security governance, with a governance framework that includes a cyber security strategy linked with business objectives, a governing security programme, metrics and monitoring processes and crisis management practices (article 4).
• Keep an IT security function with qualified staff and an IT Steering Committee that meets at least quarterly, unless a specific regulation or directive provides otherwise (articles 6 and 7).
• Implement and maintain a written cyber security policy approved by the board and based on your risk assessment, covering at least the areas article 9 lists, including cyber incident management and vendor and service provider management (article 9).
• Conduct at least annual penetration tests and bi-annual vulnerability assessments, using assessors who hold one of the qualifications article 10 lists, and share an executive summary of the findings with the National Bank of Rwanda within fifteen days after the test (article 10).
• Use risk-based multi-factor authentication, required for any individual accessing your internal networks from an external network unless the head of the IT security function has approved in writing an equivalent or more secure access control (article 16).
• Protect non-public data held or transmitted by you, in transit over external networks and at rest, with controls including encryption (article 19).
• Establish a written incident response and business continuity management plan (article 20).
• Assess the cyber security of your service providers, run a security awareness programme for the board, staff and third parties, and keep a data retention policy for non-public data (articles 14, 17 and 18).
• Submit to the National Bank of Rwanda, not later than 15 January each year, a written statement of self-assessment certifying that your cyber security strategy complies with the Regulation (article 22).