Brunei DarussalamBDCB Notice on Cyber Intrusion Detection and IT Resilience for Banks
Notice on Early Detection of Cyber Intrusion and Incident Reporting (Notice TRS/N-1/2020/1, Amendment No. 1) paras. 3.1 to 3.5, 5.2, 5.3 and 6.2
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a bank or Islamic bank licensed in Brunei Darussalam, as the Notice of the Brunei Darussalam Central Bank on early detection of cyber intrusion and incident reporting is issued under section 66 of the Banking Act (Chapter 95) and the corresponding section of the Islamic Banking Order, 2008.
- Keep systematic and consistent procedures for risk identification, assessment, responses and monitoring in relation to IT incidents including cyber intrusion, and perform risk assessments regularly and on an ad-hoc basis (paragraph 3.1).
- Monitor incoming and outgoing network traffic and internal network communications to detect and block suspicious or unauthorised events, and put in place mechanisms to detect and block behavioural anomalies on systems, servers and devices (paragraphs 3.2 to 3.4).
- On confirmation of a successful cyber intrusion, investigate its extent, the damage sustained and the vulnerabilities exploited, and take immediate action to contain it (paragraph 3.5).
- Notify the Central Bank by email at the latest five working days before any planned downtime, and do not schedule planned downtime during peak periods (paragraph 5.2).
- Make all reasonable efforts to keep each critical system available, so that its unplanned downtime does not exceed 240 minutes within a rolling period of 12 months, except where caused by systemic risks (paragraph 5.3).
- Keep policies and procedures on incident handling, business continuity and service restoration, and review them at least once a year (paragraph 6.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 113 of the Banking Act makes contravention of a provision of the Act with no express penalty an offence punishable by a fine; no term of imprisonment is stated there.
Penalty structure
Section 113 of the Banking Act sets a fine not exceeding $10,000,000, and a further fine not exceeding $100,000 for every day of a continuing offence, for a bank that contravenes a provision of the Act with no penalty expressly provided. Section 66(3) is a provision of the Act that requires a bank to comply with a notice.
- Rule
- Fixed only
- As of
- Currency
- BND
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The Brunei Darussalam Central Bank, which may at its discretion take supervisory action against a bank that fails to comply with the Notice.
Settledness
- As of
- Open questions
- Does a breach of a notice under section 66 of the Banking Act fall under the general penalty in section 113, or is it enforced only through supervisory action?
What this law does
The Notice states that it is issued pursuant to section 66 of the Banking Order, 2006 and section 66 of the Islamic Banking Order, 2008 and applies to all banks and Islamic banks in Brunei Darussalam. Paragraph 3.1 requires a bank to have systematic and consistent procedures in place for risk identification, assessment, responses and monitoring in relation to IT incidents including cyber intrusion.
Paragraph 3.2 requires a bank to monitor incoming and outgoing network traffic on its network to detect and block suspicious external network events. Paragraph 3.3 requires a bank to monitor internal network communications closely to detect and block unauthorised network communications amongst servers, systems and end-point devices. Paragraph 3.4 requires a bank to put in place mechanisms to detect and block behavioural anomalies on its systems, servers and devices.
Paragraph 3.5 requires a bank, upon confirmation of a successful cyber intrusion, to perform a thorough investigation to determine its extent and the damage sustained and to identify the vulnerabilities exploited by the attacker. Paragraph 5.2 requires a bank to notify the Central Bank by email at the latest five working days before any planned downtime and bars it from scheduling planned downtime during peak periods.
Paragraph 5.3 requires a bank to make all reasonable efforts to maintain high availability of its critical systems, with unplanned downtime of each critical system not exceeding 240 minutes within a rolling period of 12 months, except where caused by systemic risks. Paragraph 6.2 requires a bank to have in place policies and procedures on incident handling, business continuity and service restoration and to review them at least once a year.
Amendment 1 to the Notice took effect on . Section 66(3) of the Banking Act (Chapter 95) requires every bank to comply with any direction given or requirement imposed by a notice under section 66.
Section 113 of the Banking Act makes a bank that contravenes a provision of the Act for which no penalty is expressly provided guilty of an offence liable to a fine not exceeding $10,000,000 and, for a continuing offence, a further fine not exceeding $100,000 for every day during which it continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.