AngolaBNA Aviso 08/2020, Notification of Cyber Incidents to the Banco Nacional de Angola
Aviso n.º 8/20 (BNA), Artigo 8.º
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the financial institutions under the supervision of the Banco Nacional de Angola (article 2); you are reached by declaring that you provide financial services.
- Report to the Banco Nacional de Angola any breach of your networks and information systems, or loss of integrity, that significantly affects how those networks and services function (article 8).
- Make that report after you detect the incident, then send situation updates every 4 hours until normal service is restored (article 8).
- Where necessary, and without prejudice to professional secrecy and free competition, develop initiatives to share information on relevant incidents, to limit their impact and strengthen the financial system's resilience to cyber-attacks (article 8).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Banco Nacional de Angola, which receives the incident reports.
Settledness
- As of
- Open questions
- Article 8 requires the first report after detection without stating an hour limit: has the Banco Nacional de Angola set one by instruction or in a later regulation?
- Has the cybersecurity regulatory framework for financial institutions that the Banco Nacional de Angola has been drafting replaced this Aviso?
What this law does
Article 2 of Aviso n.º 08/2020 applies the Aviso to the financial institutions under the supervision of the Banco Nacional de Angola. Article 8 requires the institutions to report to the Banco Nacional de Angola breaches of networks and information systems, or losses of integrity, with a significant impact on the functioning of those networks and services.
Article 8 requires that report to be made after detection of the incident, followed by situation updates at intervals of 4 hours until normal service is restored. Article 8 requires the institutions to develop initiatives to share information on relevant incidents, where necessary and without prejudice to professional secrecy and free competition.
Article 13 provides that non-compliance with the Aviso is a contravention punishable under Lei n.º 12/15, the Lei de Bases das Instituições Financeiras. The Aviso was published in the Diário da República Iª Série n.º 41 of . Article 16 of the Aviso has it enter into force 30 days after the date of its publication.
When LexLint raises it
When your app profile says your app provides financial services.