Brunei DarussalamBDCB Notice on Cyber Intrusion and IT Incident Reporting by Banks
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- Applies to a bank or Islamic bank licensed in Brunei Darussalam, as the Notice of the Brunei Darussalam Central Bank on early detection of cyber intrusion and incident reporting is issued under section 66 of the Banking Act (Chapter 95) and the corresponding section of the Islamic Banking Order, 2008.
- Notify Technology Risk of the Brunei Darussalam Central Bank no later than one hour after the discovery of a Suspected Incident, by email, telephone call or another authorised communication channel (paragraph 4.1).
- Assess the Suspected Incident and notify the Central Bank no later than two hours after first discovery whether it is a successful cyber intrusion and whether it is a major IT incident (paragraph 4.2).
- Make no public announcement regarding a Suspected Incident before notifying the Central Bank of your assessment (paragraph 4.3).
- Once a cyber intrusion or major IT incident is confirmed, update the Central Bank on the progress of the incident response at least twice every calendar day until it is resolved (paragraph 4.4).
- Submit an IT Incident Report to the Central Bank by email within 5 working days from the notification under paragraph 4.2, or the longer period the Central Bank allows (paragraph 4.5).
- Record every confirmed near-miss IT incident and submit the details to the Central Bank within 5 working days after the end of each month (paragraph 4.7).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 113 of the Banking Act makes contravention of a provision of the Act with no express penalty an offence punishable by a fine; no term of imprisonment is stated there.
Penalty structure
Section 113 of the Banking Act sets a fine not exceeding $10,000,000, and a further fine not exceeding $100,000 for every day of a continuing offence, for a bank that contravenes a provision of the Act with no penalty expressly provided. Section 66(3) is a provision of the Act that requires a bank to comply with a notice.
- Rule
- Fixed only
- As of
- Currency
- BND
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The Brunei Darussalam Central Bank, which may at its discretion take supervisory action against a bank that fails to comply with the Notice.
Settledness
- As of
- Open questions
- Does a breach of a notice under section 66 of the Banking Act fall under the general penalty in section 113, or is it enforced only through supervisory action?
What this law does
The Notice states that it is issued pursuant to section 66 of the Banking Order, 2006 and section 66 of the Islamic Banking Order, 2008 and applies to all banks and Islamic banks in Brunei Darussalam. Paragraph 4.1 requires a bank to notify Technology Risk of the Brunei Darussalam Central Bank no later than one hour after the discovery of a Suspected Incident, by email, telephone call or another authorised communication channel.
Paragraph 4.2 requires the bank to assess the Suspected Incident and notify the Central Bank no later than two hours after first discovery whether it is a successful cyber intrusion and whether it is a major IT incident. Paragraph 4.3 bars a bank from making any public announcement regarding a Suspected Incident before it has notified the Central Bank of its assessment under paragraph 4.2.
Paragraph 4.4 requires a bank to give the Central Bank progress updates at least twice every calendar day until a confirmed cyber intrusion or major IT incident has been resolved. Paragraph 4.5 requires a bank to submit an IT Incident Report to the Central Bank by email within 5 working days from its notification under paragraph 4.2, or such longer period as the Central Bank allows.
Paragraph 4.7 requires a bank to record all confirmed near-miss IT incidents and to submit the details to the Central Bank within 5 working days after the end of each month. Amendment 1 to the Notice took effect on . Section 66(3) of the Banking Act (Chapter 95) requires every bank to comply with any direction given or requirement imposed by a notice under section 66.
Section 113 of the Banking Act makes a bank that contravenes a provision of the Act for which no penalty is expressly provided guilty of an offence liable to a fine not exceeding $10,000,000 and, for a continuing offence, a further fine not exceeding $100,000 for every day during which it continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.