AngolaBNA Aviso 08/2020, Cybersecurity Policy and Cloud Contracting Duties of Supervised Financial Institutions
Aviso n.º 8/20 (BNA), Artigos 4.º a 7.º e 9.º a 12.º
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds the financial institutions under the supervision of the Banco Nacional de Angola (article 2); you are reached by declaring that you provide financial services.
- Define, implement and maintain a cybersecurity policy built on internationally accepted standards that ensures the confidentiality, integrity and availability of your networks, data and information systems (article 4).
- Build into that policy authentication, authorization, encryption, intrusion prevention and detection, prevention of information leakage, and periodic tests and audits to detect vulnerabilities (article 4).
- Publish the policy to the public, your staff and your service providers in clear language (article 5).
- Draw up an action plan to respond to incidents, with a procedures manual approved by your management body and reviewed every year or when relevant changes occur (article 6).
- Set up a dedicated structure or team responsible for the cybersecurity policy and for running the action and incident-response plan (article 7).
- Before contracting cloud-computing services, tell the Banco Nacional de Angola at least 60 days ahead, for appraisal and approval, giving the details article 10 lists (article 10).
- Before contracting cloud-computing services, check and document that the provider can ensure confidentiality, integrity, availability and recovery of your data (article 11).
- Classify the information you consider essential to the security of society, your clients and the State by confidentiality level, and decide from that classification what may migrate to the cloud (article 12).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Banco Nacional de Angola, which supervises the financial institutions the Aviso binds and answers questions of interpretation under Article 14.
Settledness
- As of
- Open questions
- Article 13 punishes non-compliance under Lei n.º 12/15, the Lei de Bases das Instituições Financeiras: which provisions of the financial-institutions regime now in force set the contravention and its fine for a breach of this Aviso?
- Has the cybersecurity regulatory framework for financial institutions that the Banco Nacional de Angola has been drafting replaced this Aviso?
What this law does
Article 2 of Aviso n.º 08/2020 applies the Aviso to the financial institutions under the supervision of the Banco Nacional de Angola. Article 4 requires those institutions to define, implement and maintain a cybersecurity policy, based on internationally accepted standards, principles and guidelines, that aims to ensure the confidentiality, integrity and availability of the networks, data and information systems they use.
Article 4 requires the policy's procedures and controls to include authentication, authorization, encryption and intrusion prevention and detection, data-leak prevention, and periodic tests and audits to detect vulnerabilities. Article 6 requires the institutions to draw up an action plan able to respond to incidents, with a procedures manual approved by the management body and reviewed annually or whenever relevant changes occur.
Article 7 requires the institutions to set up a dedicated structure or team responsible for the cybersecurity policy and for carrying out the action and incident-response plan. Article 5 requires the cybersecurity policy to be disclosed to the public, to staff and to service-provider companies, in clear, objective and accessible language.
Article 11 requires an institution, before contracting cloud-computing services, to verify and document the prospective provider's ability to ensure the confidentiality, integrity, availability and recovery of the data it processes or stores. Article 12 requires the institutions to classify the information they consider essential to the security of society, their clients and the State by secrecy level, from very confidential to public.
Article 10 requires an institution to tell the Banco Nacional de Angola of its intention to contract cloud-computing services at least 60 days before contracting, for appraisal and approval. Article 13 provides that non-compliance with the Aviso is a contravention punishable under Lei n.º 12/15, the Lei de Bases das Instituições Financeiras. The Aviso was published in the Diário da República Iª Série n.º 41 of . Article 16 of the Aviso has it enter into force 30 days after the date of its publication.
When LexLint raises it
When your app profile says your app provides financial services.