Brunei DarussalamCybersecurity Act: Critical Information Infrastructure Incident Reporting
Cybersecurity Act (Chapter 272, Laws of Brunei, Revised Edition 2024), s. 16
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to an owner of a computer or computer system designated as critical information infrastructure by the Commissioner of Cybersecurity under section 9, because it is necessary for the continuous delivery of an essential service and is located wholly or partly in Brunei Darussalam.
- Notify the Commissioner, in the form and manner the Commissioner determines and within the period prescribed after becoming aware of it, of a prescribed cybersecurity incident in respect of the critical information infrastructure, and of a prescribed cybersecurity incident in respect of any interconnected computer or computer system under your control (section 16(1)(a) and (b)).
- Notify the Commissioner in the same way of any other type of cybersecurity incident in respect of the critical information infrastructure that the Commissioner has specified by written direction to you (section 16(1)(c)).
- Establish the mechanisms and processes for detecting cybersecurity threats and incidents in respect of the critical information infrastructure that any applicable code of practice sets out (section 16(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 16(3) makes failure without reasonable excuse to notify the Commissioner of a reportable incident an offence punishable by a fine, imprisonment of up to 2 years or both.
Penalty structure
Section 16(3) sets a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both, for failing without reasonable excuse to notify the Commissioner as section 16(1) requires.
- Rule
- Fixed only
- As of
- Currency
- BND
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Commissioner of Cybersecurity, who is responsible for the administration of the Act.
Settledness
- As of
- Open questions
- What period has the Minister prescribed for the section 16(1) notification, and which incidents are prescribed?
What this law does
Section 16(1) requires the owner of critical information infrastructure to notify the Commissioner, within the prescribed period after becoming aware of it, of a prescribed cybersecurity incident in respect of the critical information infrastructure, of a prescribed incident in respect of an interconnected computer or computer system under the owner's control, or of any other type of incident the Commissioner specifies by written direction to the owner.
Section 16(2) requires the owner to establish the mechanisms and processes for detecting cybersecurity threats and incidents in respect of the critical information infrastructure that any applicable code of practice sets out. Section 16(3) makes failure without reasonable excuse to comply with section 16(1) an offence punishable by a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both.
Section 38(2)(e) lets the Minister make regulations on the type of cybersecurity incidents in respect of critical information infrastructure that the owner is required to report. The Act commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.