Brunei DarussalamCybersecurity Act: Critical Information Infrastructure Owner Duties
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- Applies to an owner of a computer or computer system designated as critical information infrastructure by the Commissioner of Cybersecurity, by written notice under section 9, because it is necessary for the continuous delivery of an essential service (energy, infocommunications, healthcare, banking and finance, defence and security, emergency services, aviation, functioning of Government, media or water) and is located wholly or partly in Brunei Darussalam.
- Comply with the codes of practice and standards of performance that apply to the critical information infrastructure, unless the Commissioner has waived them (section 13(6) and (7)).
- Cause an audit of the compliance of the critical information infrastructure with the Act and the applicable codes of practice and standards of performance to be carried out at least once every 2 years, or more often where the Commissioner directs, by an auditor approved or appointed by the Commissioner (section 17(1)(a)).
- Conduct a cybersecurity risk assessment of the critical information infrastructure at least once a year, in the form and manner the Commissioner determines (section 17(1)(b)).
- Furnish a copy of each audit report and each risk assessment report to the Commissioner not later than 30 days after completion (section 17(2)).
- Notify the Commissioner of a material change to the design, configuration, security or operation of the critical information infrastructure not later than 30 days after the change is made, where information on it was furnished under a notice of the Commissioner (section 12(5)).
- Inform the Commissioner of a change in the beneficial or legal ownership of the critical information infrastructure not later than 7 days after the change (section 15(1)).
- Furnish the information on the design, configuration, security and operation of the critical information infrastructure that the Commissioner requires by notice, within the reasonable period the notice specifies (section 12(1)).
- Comply with a written direction of the Commissioner to the owner or to a class of owners, and participate in a cybersecurity exercise when the Commissioner directs it in writing (sections 14 and 18(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 14(6) makes failure to comply with a direction of the Commissioner an offence punishable by a fine, imprisonment of up to 2 years or both, with a further daily fine for a continuing offence.
Penalty structure
Section 14(6) sets a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both, and a further fine not exceeding $5,000 for every day of a continuing offence, for failing to comply with a direction of the Commissioner. Sections 12(7) and 17(8) carry a lower tier of a fine not exceeding $25,000, imprisonment for a term not exceeding 12 months or both.
- Rule
- Fixed only
- As of
- Currency
- BND
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Commissioner of Cybersecurity, who is responsible for the administration of the Act.
Settledness
- As of
- Open questions
- Which codes of practice and standards of performance has the Commissioner issued under section 13, and from what date does each bind a designated owner?
What this law does
Section 9 lets the Commissioner of Cybersecurity designate a computer or computer system as critical information infrastructure, by written notice to its owner, where it is necessary for the continuous delivery of an essential service and is located wholly or partly in Brunei Darussalam. A designation has effect for a period of 5 years unless the Commissioner withdraws it before the period expires.
The Schedule lists ten essential services, among them services relating to energy, infocommunications, healthcare, and banking and finance. Section 13(6) requires every owner of critical information infrastructure to comply with the codes of practice and standards of performance that apply to it, subject to subsections (4) and (7).
Section 17(1) requires the owner to cause a compliance audit to be carried out at least once every 2 years by an auditor approved or appointed by the Commissioner, and to conduct a cybersecurity risk assessment at least once a year. Section 17(2) requires the owner to furnish a copy of the report of each audit or assessment to the Commissioner not later than 30 days after its completion.
Section 12(5) requires the owner to notify the Commissioner of a material change to the design, configuration, security or operation of the critical information infrastructure not later than 30 days after the change is made, where information on it was furnished under a notice. Section 15 requires the relevant person to inform the Commissioner of a change in the beneficial or legal ownership of critical information infrastructure not later than 7 days after the change.
Section 18(2) requires the owner to participate in a cybersecurity exercise if directed in writing to do so by the Commissioner. Section 14(6) makes it an offence, punishable by a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both, to fail without reasonable excuse to comply with a written direction of the Commissioner to an owner of critical information infrastructure.
The Act binds the Government, but nothing in it renders the Government liable to prosecution for an offence. The Act commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.