Is a crypto-asset provider, in Samoa

Commercial Banks Prudential Statements, January 2021, Prudential Statement 11 (Cybersecurity), paras. 1-3, 99-103 and 107 · Read the law's page

• This binds every entity licensed under the Financial Institutions Act 1996, that is a bank, a securities broker or a securities dealer (Applicability), and is reached by declaring that you provide financial services.
• Keep a framework for cybersecurity risk management that is an integral part of your enterprise risk management framework, document it, have the Board approve it and review it regularly (paragraphs 1 and 2).
• Maintain a designated cybersecurity risk management function with independent reporting lines, headed by a Chief Information Security Officer or an equivalent senior officer (paragraph 3).
• Develop and document an enterprise wide cybersecurity risk strategy approved by the Board (paragraph 5).
• Have in place a cybersecurity policy framework commensurate with your exposures to vulnerabilities and threats, covering policies and procedures for cybersecurity risk identification, measurement, monitoring and control (paragraph 8).
• Have a cybersecurity incident management process governed by documented policy and procedures, with the objective of restoring normal service as quickly as possible (paragraphs 99 and 100).
• Conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production (paragraph 103).

Commercial Banks Prudential Statements, January 2021, Prudential Statement 11 (Cybersecurity), paras. 105-106 · Read the law's page

• This binds every entity licensed under the Financial Institutions Act 1996, that is a bank, a securities broker or a securities dealer (Applicability), and is reached by declaring that you provide financial services.
• Notify the Central Bank of Samoa as soon as possible and not later than sixty minutes after becoming aware of an information security incident that materially affects, or has the potential to materially affect, the institution or the interests of depositors, financially or non-financially (paragraph 106).
• Report all cybersecurity incidents to the Central Bank of Samoa each quarter, in the format of Form QCR in Appendix 1 (paragraph 105).