Is a crypto-asset provider, in Eswatini

CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 1.3, 3 to 9 and 11 · Read the law's page

• This binds a financial institution regulated and licensed by the Central Bank of Eswatini under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 or the National Clearing and Settlement Systems Act, 2011, which the Guidelines expect to implement them within 12 months of their publication (paragraph 1.3.1; reached by declaring that you provide financial services).
• Have a cyber resilience framework that states how the institution determines its cyber resilience objectives and cyber risk tolerance and how it identifies, mitigates and manages its cyber risks; the Guidelines say the institution should, with board endorsement and periodic review (paragraph 3.2.1).
• Identify business functions and supporting processes, classify them by criticality and maintain a current inventory of information assets and system configurations; the Guidelines say the institution should (paragraphs 4.2.1 and 4.2.2).
• Implement protective controls in line with leading-practice cyber resilience standards, proportionate to the threat landscape and systemic role in the financial system; the Guidelines say the institution should (paragraph 5.2.1).
• Establish capabilities to continuously monitor and detect anomalous activities and events; the Guidelines say the institution should (paragraph 6.2.1).
• Design and test systems and processes to enable the safe resumption of critical operations within two hours of a disruption; the Guidelines say the institution should (paragraph 7.2.2).
• Establish a comprehensive testing programme to validate the effectiveness of the cyber resilience framework on a regular and frequent basis; the Guidelines say the institution should (paragraph 8.2.1).

CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 7.5.1 and 7.5.2 · Read the law's page

• This binds a financial institution regulated and licensed by the Central Bank of Eswatini under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 or the National Clearing and Settlement Systems Act, 2011, which the Guidelines expect to implement them within 12 months of their publication (paragraph 1.3.1; reached by declaring that you provide financial services).
• In the event of a successful cyber attack, notify the Central Bank within two hours of verifying the incident, using the incident notification form in Appendix A, and be ready to provide the updates the Bank requests; the Guidelines say the institution should (paragraph 7.5.1).
• Once you are satisfied that you have contained and recovered from the incident, submit a report to the Central Bank, expected at most on the fourth working day since the incident was detected, with the information available and a note that a full report follows if investigations are incomplete; the Guidelines say the institution shall (paragraph 7.5.2).