BahrainCyber Security Incident Reporting for Crypto-Asset Licensees (Rulebook Volume 6, Module CRA, Section CRA-5.8)
Crypto-Asset Cyber Security Incident Reporting Rules Central Bank of Bahrain Rulebook Volume 6, Module CRA, paragraphs CRA-5.8.33 to CRA-5.8.35
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a crypto-asset licensee of the Central Bank of Bahrain (reached by declaring that you are a crypto-asset provider). The rule was added in April 2023.
- Contact the Central Bank of Bahrain by telephone immediately, within one hour, on detecting a cyber security incident, internal or external, that compromises client information or disrupts critical services that affect operations (Cyber Resilience Act (CRA)-5.8.33).
- Submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours (CRA-5.8.33).
- Submit Section B of the Cyber Security Incident Report within 10 calendar days of the incident, with the full root cause analysis, the impact on business operations and clients, and the measures taken to stop the attack and prevent a recurrence, and send a weekly progress update until the incident is fully resolved (CRA-5.8.34).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- What financial penalty does the Central Bank of Bahrain apply to a licensee in this licensee class that breaches this module?
What this law does
Rule Cyber Resilience Act (CRA)-5.8.33 requires licensees that detect a cyber security incident, whether internal or external, that compromises client information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule CRA-5.8.33 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.
Rule CRA-5.8.34 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule CRA-5.8.34 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule CRA-5.8.35 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.