EthiopiaRequirements for Information Technology (IT) Management Directive, IT Risk Management and Security Programme
National Bank of Ethiopia Directive No. 886/2022 IT risk management and security programme (Requirements for Information Technology (IT) Management), arts. 3, 6 to 9
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every insurance company and Ethiopian reinsurer (reached by declaring that you are an insurer). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on .
- Put in place and implement an IT risk management program aligned with your risk management program, and take into account the cyber security risk management requirements the Information Network Security Agency provides (Articles 6.1 and 6.3).
- Conduct an IT risk assessment every quarter, present the report to your board of directors, send it to the Insurance Supervision Directorate of the National Bank within 30 calendar days after the end of the quarter, and keep an IT risk register that you update quarterly (Articles 6.4 to 6.6).
- Develop and implement IT risk management strategies, plans, policies, procedures and standards covering at least physical access and network security, business continuity, disaster recovery, incident response, hardware, software and network maintenance, database and backup management and access, IT change and patch management, vendor and third-party service provider management, customer data privacy, password, data transfer, user access, antivirus and firewall security, and risk in system development, integration and acquisition, and revise them from your periodic risk assessment findings (Articles 7.1 to 7.3).
- Prepare an annual IT security awareness plan and provide the awareness program to relevant employees, including the board and senior management (Articles 8.1 and 8.2).
- Maintain an IT audit function within internal audit that audits at least quarterly, includes at least an annual cyber threat test or other IT audit activities the Information Network Security Agency provides, and reports its findings to the board audit committee with a copy to the Insurance Supervision Directorate of the National Bank (Articles 9.1, 9.4 and 9.5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 57(7) of Insurance Business Proclamation No. 746/2012, as published in 2012, punishes any person who contravenes or obstructs directives issued under it with imprisonment up to three years and a fine up to Birr 10,000.
Who enforces it
Enforcement body
The National Bank of Ethiopia, which issues the Directive under the Insurance Business Proclamation.
What this law does
Article 3 applies the Directive to all insurance companies and an Ethiopian reinsurer. Article 6.1 requires an insurance company to put in place and implement an IT risk management program aligned with its risk management program. Article 6.3 requires it to take into account the cyber security risk management requirements provided by the Information Network Security Agency.
Article 6.4 requires an insurance company to conduct a quarterly IT risk assessment and present the report to its board of directors. Article 6.5 requires the report to reach the Insurance Supervision Directorate of the National Bank within 30 calendar days after the end of each quarter. Article 6.6 requires an insurance company to maintain an IT risk register and update it quarterly.
Article 7.2 requires its IT risk management policies to cover an incident response plan, hardware, software and network maintenance, database and backup management and access, and IT change and patch management. Article 7.2 also requires them to cover password, data transfer security, user right access, antivirus and firewall security. Article 8.1 requires an insurance company to prepare an annual IT security awareness plan.
Article 9.1 requires an insurance company to establish an IT audit function within its internal audit function. Article 9.5 requires IT audit at least quarterly, with the findings reported to the board audit committee. Article 13 brings the Directive into force on . Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date.
Article 12.2 says an insurance company that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Article 64(2) of the Insurance Business Proclamation No. 746/2012, as amended by Proclamation No. 1163/2019.
Article 58(2) of Insurance Business Proclamation No. 746/2012, as published in 2012, lets the National Bank issue directives necessary for its implementation. Article 57(7) of that Proclamation punishes any person who contravenes or obstructs directives issued under it with imprisonment up to three years and a fine up to Birr 10,000.
When LexLint raises it
When your app profile says your app is an insurer.