EthiopiaRequirements for Information Technology (IT) Management of Capital Goods Financing Company Directive, IT Risk Management and Security Programme
National Bank of Ethiopia Directive No. 884/2022 IT risk management and security programme (Requirements for Information Technology (IT) Management of Capital Goods Financing Company), arts. 3, 6 to 9
In force since .
A sector security regimes rule binding private bodies.
- Enforcement body
- The National Bank of Ethiopia, which issued the Directive.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
What it requires
- This binds every capital goods financing company operating in Ethiopia, a licensed lessor and lender (reached by declaring that you are a lender). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on . Articles 5 and 6.7 applied from the end of three years from that date (Article 11.1).
- Put in place and implement an IT risk management program aligned with your risk management program, and take into account the cyber security risk management requirements the Information Network Security Agency provides (Articles 6.1 and 6.3).
- Conduct an IT risk assessment every quarter, present the report to your board of directors, send it to the Microfinance Institutions Supervision Directorate of the National Bank within 30 calendar days after the end of the quarter, and keep an IT risk register that you update quarterly (Articles 6.4 to 6.6).
- Develop and implement IT risk management strategies, plans, policies, procedures and standards covering at least physical access and network security, business continuity, disaster recovery, incident response, hardware, software and network maintenance, database and backup management and access, IT change and patch management, vendor and third-party service provider management, customer data privacy, password, data transfer, user access, antivirus and firewall security, and risk in system development, integration and acquisition, and revise them from your periodic risk assessment findings (Articles 7.1 to 7.3).
- Prepare an annual IT security awareness plan and provide the awareness program to relevant employees, including the board and senior management (Articles 8.1 and 8.2).
- Maintain an IT audit function within internal audit that audits at least quarterly, includes at least an annual cyber threat test or other IT audit activities the Information Network Security Agency provides, and reports its findings to the board audit committee with a copy to the Microfinance Institutions Supervision Directorate of the National Bank (Articles 9.1, 9.4 and 9.5).
These lines are LexLint's reading of the law's text.
What this law does
Article 3 applies the Directive to all capital goods financing companies operating in Ethiopia. Article 2.2 defines a capital goods financing company as a company licensed by the National Bank to engage in capital goods financing business. Article 5.1 requires a capital goods financing company to fully automate at a minimum its core business processes.
Article 6.1 requires a capital goods financing company to put in place and implement an IT risk management program aligned with its risk management program. Article 6.3 requires it to take into account the cyber security risk management requirements provided by the Information Network Security Agency. Article 6.4 requires a capital goods financing company to conduct a quarterly IT risk assessment and present the report to its board of directors.
Article 6.5 requires the report to reach the Microfinance Institutions Supervision Directorate of the National Bank within 30 calendar days after the end of each quarter. Article 6.6 requires a capital goods financing company to maintain an IT risk register and update it quarterly. Article 6.7 requires a capital goods financing company to set up a disaster recovery site at a safe place with adequate detachment from the main site of its IT systems.
Article 7.2 requires its IT risk management policies to cover an incident response plan, hardware, software and network maintenance, database and backup management and access, and IT change and patch management. Article 7.2 also requires them to cover password, data transfer security, user right access, antivirus and firewall security. Article 8.1 requires a capital goods financing company to prepare an annual IT security awareness plan.
Article 9.1 requires a capital goods financing company to establish an IT audit function within its internal audit function. Article 9.5 requires IT audit at least quarterly, with the findings reported to the board audit committee. Article 13 brings the Directive into force on . Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date.
Article 11.1 gives three years from that date to implement Article 5 and sub-article 6.7. Article 12.1 penalizes a capital goods financing company that misses the Article 11.1 period Birr 10,000 per requirement per month until it complies. Article 12.2 says a capital goods financing company that violates other provisions shall be penalized as per the relevant National Bank directive.
The Directive recites that the National Bank of Ethiopia issued it under Article 18(4) of the Capital Goods Leasing Business Proclamation No. 103/1998, as amended by Proclamation No. 807/2013.
When LexLint raises it
When your app profile says your app is a lender.
Back to the example · Lint your app
Page updated .