Is a crypto-asset provider, in Jordan

Central Bank of Jordan Instructions of Cyber Risks Resilience (No. 26/1/1/1984 of 6 February 2018), Art. 49 · Read the law's page

• This binds a bank, a financial institution (a company licensed to practice payment services or to manage and operate electronic payment systems), a credit bureau or a microfinance company under the oversight and supervision of the Central Bank of Jordan (reached by declaring that you provide financial services).
• Notify the Central Bank of Jordan, no later than 72 hours from the moment of discovering it, where the company detects its exposure to a cyber event or an attempt at a high risk cyber attack on its systems or networks, according to the mechanism the Central Bank adopts (Article 49(a)). The Instructions state this as what the company should do.
• Notify the competent security bodies immediately upon discovery of any embezzlement, forgery, theft or fraud resulting from the cyber event, in accordance with the relevant laws and instructions (Article 49(a)).
• Provide the Central Bank periodically with the details of cyber events, their effects, response procedures and the preventive procedures implemented, according to the mechanism the Central Bank will adopt (Article 49(b)).

Central Bank of Jordan Instructions of Cyber Risks Resilience (No. 26/1/1/1984 of 6 February 2018), Arts. 3 and 6 to 17 · Read the law's page

• This binds a bank, a financial institution (a company licensed to practice payment services or to manage and operate electronic payment systems), a credit bureau or a microfinance company under the oversight and supervision of the Central Bank of Jordan (reached by declaring that you provide financial services).
• Have a board and executive management that include competent persons with the skills and knowledge to understand and manage cyber risks, with the board adopting the cyber security policy and program and checking compliance with them (Article 6).
• Apply and continuously update a cyber security program that meets the confidentiality, reliability and availability requirements of information in the ICT environment, identifies internal and external cyber threats, and undertakes the corrective procedures needed to control and mitigate the adverse effects of cyber risks (Article 7).
• Keep a dedicated cyber security policy covering at least roles and responsibilities, data governance and classification, cyber risk management, controls to mitigate cyber risks, business continuity and disaster recovery, third-party outsourcing, and staff training and awareness (Articles 8 and 9).
• Manage cyber security through an information security manager who does not administratively follow the IT department, and have that manager submit reports at least semi-annually, or whenever necessary, to the board and the executive management (Article 10).
• Identify and classify critical functions, operations and information assets, conduct ongoing cyber risk factor and scenario analysis, and keep a cyber risk register updated continuously (Articles 13 to 17).

Cyber Security Law No. (16) of 2019, Article 8(b) · Read the law's page

• Adhere to the policies, standards, and controls the Center issues for the institution's own sector, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity or the security of cyberspace, taking every step necessary to prevent or avoid it.
• If the Council of Ministers has delegated some of the Center's tasks and powers to you as an oversight body, government department, or official or public institution, notify the Center immediately upon the occurrence or suspicion of a cybersecurity incident (Article 11(b)).when it serves a public body
• Where the incident is Critical or High severity, in particular where it touches critical infrastructure, a security or military body, a ministry or government institution, a government-owned or government-invested company, a supply chain feeding those entities, or where it disrupts essential services entirely at a higher-education institution, the Center's own Incident Response and Reporting Policy sets the time to report to the Center and the sectoral body at 1 hour at most for a Critical-tier incident, 2 hours for High, 4 hours for Medium, and 24 hours for Low; an ordinary private company or individual establishment with no such touchpoint is typically classified Medium or Low.
• Where the National Cyber Security Council designates an incident a threat to the Kingdom's own security and safety, the Center directs the response and every institution involved must comply with the Center's instructions and directives.
• This binds any ministry, government department, or official, public, private, or civil institution operating in Jordan; the National Cyber Security Center's own subsidiary instructions define the bound entity to include any company or individually registered establishment in the Kingdom, and the duty carries no sector, size, or personal-data gate of its own.
• A violation may draw a written warning, an order to correct the violation and reimburse the Center's resulting costs, blocking, cancellation, confiscation, or disabling of the offending network, system, or device, a requirement that the institution take legal measures against a responsible employee, suspension or cancellation of a cybersecurity-services license, or a fine of between 500 and 100,000 Jordanian dinars doubled for a repeated violation, imposed by the Center itself rather than through a private lawsuit.