AzerbaijanRules on Information Security Management in Banks, High-Category Incident Report to the Central Bank
Rules on Information Security Management in Banks approved by Decision No. 20/1 of the Board of the Central Bank of the Republic of Azerbaijan (), cl. 14
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds banks operating in the Republic of Azerbaijan and the local branches of foreign banks (reached by declaring that you are a bank).
- Submit information on a high-category information security incident to the Central Bank within 5 working days, in the form set out in Annex 1 to the Rules, confirmed by the Chairman of your Management Board with an enhanced electronic signature and sent through the special-purpose information exchange system (clause 14.2); an incident is high-category where, as a result, the bank cannot carry out any business process (clause 14.1.6.4.3).
- Register each information security incident and see that it is communicated, using the notification channels you have defined and recorded (clauses 14.1.6.2 and 14.1.6.7).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of the Republic of Azerbaijan, which receives the high-category incident report through its special-purpose information exchange system (clause 14.2).
Settledness
- As of
- Open questions
- Does the Central Bank require a first notice of a lower-category incident outside the clause 14.2 report, in a separate instrument?
What this law does
Clause 14.2 of the Rules requires a bank to submit information on a high-category information security incident to the Central Bank within 5 working days, in the form of Annex 1, confirmed by the Chairman of the Management Board with an enhanced electronic signature and sent through the special-purpose information exchange system. Clause 14.1.6.4.3 ranks an incident as high where, as a result, the bank cannot carry out any business process.
Clause 14.1.6.2 requires a bank to register each incident and to communicate it. Clause 2.1.20 defines an information security incident as one or more unwanted or unexpected information security events that disrupt business processes and are significantly likely to create an information security threat.
When LexLint raises it
When your app profile says your app is a bank.