BahrainCyber Security Incident Reporting for Conventional Bank Licensees (Rulebook Volume 1, Module OM, Section OM-5.5)
Conventional Banks Cyber Security Incident Reporting Rules Central Bank of Bahrain Rulebook Volume 1, Module OM, paragraphs OM-5.5.57 to OM-5.5.59
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a conventional bank licensee of the Central Bank of Bahrain (reached by declaring that you are a bank). The rule was added in July 2021 and amended in April 2022.
- Contact the Central Bank of Bahrain by telephone immediately, within one hour, on detecting a cyber security incident, internal or external, that compromises customer information or disrupts critical services that affect operations (OM-5.5.57).
- Submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours (OM-5.5.57).
- Submit Section B of the Cyber Security Incident Report within 10 calendar days of the incident, with the full root cause analysis, the impact on business operations and customers, and the measures taken to stop the attack and prevent a recurrence, and send a weekly progress update until the incident is fully resolved (OM-5.5.58).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- What financial penalty does the Central Bank of Bahrain apply to a licensee in this licensee class that breaches this module?
What this law does
Rule OM-5.5.57 requires conventional bank licensees that detect a cyber security incident, whether internal or external, that compromises customer information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule OM-5.5.57 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.
Rule OM-5.5.58 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule OM-5.5.58 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule OM-5.5.59 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet.
When LexLint raises it
When your app profile says your app is a bank.