Is a crypto-asset provider, in the Solomon Islands

Prudential Guideline No. 13, paras. 9 to 19 (Central Bank of Solomon Islands) · Read the law's page

• This binds a financial institution licensed or deemed licensed by the Central Bank of Solomon Islands (reached by declaring that you provide financial services); it does not reach any other business.
• Mitigate in your information technology security risk management the existing internal and external threats, such as unauthorised access to critical financial data, service interruptions, impersonating clients and theft or alteration of information (para. 9).
• Have a proper plan in place to respond to an adverse event that exploits a vulnerability in your information technology systems (para. 16).
• Submit to the Central Bank of Solomon Islands a copy of your IT security risks, including your risk profiles, exposure analysis and incident analysis (para. 19).

Prudential Guideline No. 20, paras. 111 and 112 (Central Bank of Solomon Islands) · Read the law's page

• This binds a financial institution licensed or deemed licensed by the Central Bank of Solomon Islands (reached by declaring that you provide financial services); it does not reach any other business.
• Notify the Central Bank of Solomon Islands as soon as possible, and not later than sixty minutes, after becoming aware of an information security incident that materially affects or has the potential to materially affect, financially or non-financially, your institution or the interests of depositors (para. 112).
• Report all cybersecurity incidents to the Central Bank quarterly, in the format the standard prescribes as Appendix I (para. 111(a)).

Prudential Guideline No. 20, paras. 7 to 110 (Central Bank of Solomon Islands) · Read the law's page

• This binds a financial institution licensed or deemed licensed by the Central Bank of Solomon Islands (reached by declaring that you provide financial services); it does not reach any other business.
• Have a cybersecurity risk management framework, which should be an integral part of your enterprise risk management framework; the framework must be documented, approved by your board and reviewed regularly (paras. 7 and 8).
• Have a designated cybersecurity risk management function headed by a Chief Information Security Officer or an equivalent senior officer (para. 9).
• Obtain information about technical vulnerabilities of your information systems in a timely fashion (para. 79), and test and evaluate security updates before installing them on critical systems (para. 83).
• Have a cybersecurity incident management process governed by documented policy and procedures (para. 105).