EthiopiaRequirements for Information Technology (IT) Management Directive, IT Incident Reporting
National Bank of Ethiopia Directive No. 886/2022 IT incident reporting (Requirements for Information Technology (IT) Management), arts. 3, 10
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every insurance company and Ethiopian reinsurer (reached by declaring that you are an insurer). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on .
- Notify the Insurance Supervision Directorate of the National Bank within 2 working days of any IT incident that could have significant impact on your ability to provide services to your customers or adversely affect your reputation or financial condition, in the format of Annex-1 to the Directive (Article 10.1).
- Submit to the Insurance Supervision Directorate every quarter a report on your ongoing handling of IT incidents, in the format of Annex-2 to the Directive (Article 10.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 57(7) of Insurance Business Proclamation No. 746/2012, as published in 2012, punishes any person who contravenes or obstructs directives issued under it with imprisonment up to three years and a fine up to Birr 10,000.
Who enforces it
Enforcement body
The National Bank of Ethiopia, which issues the Directive under the Insurance Business Proclamation.
What this law does
Article 3 applies the Directive to all insurance companies and an Ethiopian reinsurer. Article 10.1 requires an insurance company to notify the Insurance Supervision Directorate of the National Bank, within two working days, of any IT incident that could have significant impact on its ability to provide services to its customers or adversely affect its reputation or financial condition.
Article 10.2 requires an insurance company to submit to the Insurance Supervision Directorate every quarter a report on its ongoing handling of IT incidents. Article 13 brings the Directive into force on . Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date.
Article 12.2 says an insurance company that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Article 64(2) of the Insurance Business Proclamation No. 746/2012, as amended by Proclamation No. 1163/2019.
Article 58(2) of Insurance Business Proclamation No. 746/2012, as published in 2012, lets the National Bank issue directives necessary for its implementation. Article 57(7) of that Proclamation punishes any person who contravenes or obstructs directives issued under it with imprisonment up to three years and a fine up to Birr 10,000.
When LexLint raises it
When your app profile says your app is an insurer.