ChinaPeople's Bank of China Cybersecurity Incident Reporting Measures, financial institution duties
Measures for the Administration of Cybersecurity Incident Reporting in the Business Areas of the People's Bank of China Arts. 2, 6, 12 and 14-17
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a financial practitioner institution, meaning a financial institution or another institution the People's Bank of China has approved or recognized, for a cybersecurity incident in a business area the People's Bank of China supervises, including payment, credit reporting and interbank market business (Articles 2, 3 and 31); you are reached by declaring that you provide financial services.
- Set incident grading standards in your cybersecurity rules that rank incidents as especially major, major, relatively major or ordinary, review the standards each year, and grade each incident that occurs against them (Articles 6 and 12).
- After an incident of the relatively major grade or above, send the People's Bank of China, or its branch at your place of domicile, a brief incident report within 1 hour and an incident report within 24 hours (Articles 14 and 15).
- For a major incident or above, send a progress report at least every 2 hours until handling ends, and report at once when the grade is raised or a new problem is found (Article 16).
- Within 10 working days after handling ends, send a written post-incident investigation summary report; if you cannot, send a preliminary report on time that states a promised date within 40 working days (Article 17).
- Keep an incident ledger recording the incident time, the report time and the contact person who took the report, and keep it for at least three years (Article 25).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The People's Bank of China or its branch, which penalizes a failure to report (Article 27).
Settledness
- As of
What this law does
A financial practitioner institution must report a cybersecurity incident in a business area the People's Bank of China supervises to the People's Bank of China or its branch at the institution's place of domicile. After an incident of the relatively major grade or above, the institution must send a brief incident report within 1 hour and an incident report within 24 hours. For a major incident or above, the institution must send a progress report at least every 2 hours until handling ends.
Within 10 working days after handling ends, the institution must send a post-incident investigation summary report. The Measures provide that a failure to report is penalized under the Cybersecurity Law.
When LexLint raises it
When your app profile says your app provides financial services.