EthiopiaRequirements for Information Technology (IT) Management of Microfinance Institution Directive, IT Risk Management and Security Programme
National Bank of Ethiopia Directive No. 887/2022 IT risk management and security programme (Requirements for Information Technology (IT) Management of Microfinance Institution), arts. 3, 6 to 9
In force since .
A sector security regimes rule binding private bodies.
- Enforcement body
- The National Bank of Ethiopia, which issued the Directive.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
What it requires
- This binds every microfinance institution operating in Ethiopia, a licensed deposit-taker and lender (reached by declaring that you are a bank or a lender). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on . Articles 5 and 6.7 applied from the end of three years from that date (Article 11.1).
- Put in place and implement an IT risk management program aligned with your risk management program, and take into account the cyber security risk management requirements the Information Network Security Agency provides (Articles 6.1 and 6.3).
- Conduct an IT risk assessment every quarter, present the report to your board of directors, send it to the Microfinance Institutions Supervision Directorate of the National Bank within 30 calendar days after the end of the quarter, and keep an IT risk register that you update quarterly (Articles 6.4 to 6.6).
- Develop and implement IT risk management strategies, plans, policies, procedures and standards covering at least physical access and network security, business continuity, disaster recovery, incident response, hardware, software and network maintenance, database and backup management and access, IT change and patch management, vendor and third-party service provider management, customer data privacy, password, data transfer, user access, antivirus and firewall security, and risk in system development, integration and acquisition, and revise them from your periodic risk assessment findings (Articles 7.1 to 7.3).
- Prepare an annual IT security awareness plan and provide the awareness program to relevant employees, including the board and senior management (Articles 8.1 and 8.2).
- Maintain an IT audit function within internal audit that audits at least quarterly, includes at least an annual cyber threat test or other IT audit activities the Information Network Security Agency provides, and reports its findings to the board audit committee with a copy to the Microfinance Institutions Supervision Directorate of the National Bank (Articles 9.1, 9.4 and 9.5).
These lines are LexLint's reading of the law's text.
What this law does
Article 3 applies the Directive to all microfinance institutions operating in Ethiopia. Article 2.11 defines a microfinance institution as a company licensed by the National Bank to engage in microfinance business. Article 5.1 requires a microfinance institution to fully automate at a minimum its core business processes. Article 6.1 requires a microfinance institution to put in place and implement an IT risk management program aligned with its risk management program.
Article 6.3 requires it to take into account the cyber security risk management requirements provided by the Information Network Security Agency. Article 6.4 requires a microfinance institution to conduct a quarterly IT risk assessment and present the report to its board of directors. Article 6.5 requires the report to reach the Microfinance Institutions Supervision Directorate of the National Bank within 30 calendar days after the end of each quarter.
Article 6.6 requires a microfinance institution to maintain an IT risk register and update it quarterly. Article 6.7 requires a microfinance institution to set up a disaster recovery site at a safe place with adequate detachment from the main site of its IT systems. Article 7.2 requires its IT risk management policies to cover an incident response plan, hardware, software and network maintenance, database and backup management and access, and IT change and patch management.
Article 7.2 also requires them to cover password, data transfer security, user right access, antivirus and firewall security. Article 8.1 requires a microfinance institution to prepare an annual IT security awareness plan. Article 9.1 requires a microfinance institution to establish an IT audit function within its internal audit function. Article 9.5 requires IT audit at least quarterly, with the findings reported to the board audit committee.
Article 13 brings the Directive into force on . Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date. Article 11.1 gives three years from that date to implement Article 5 and sub-article 6.7. Article 12.1 penalizes a microfinance institution that misses the Article 11.1 period Birr 10,000 per requirement per month until it complies.
Article 12.2 says a microfinance institution that violates other provisions shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Articles 14(2)(e) and 34(2) of the Microfinance Business Proclamation No. 626/2009, as amended by Proclamation No. 1164/2019.
When LexLint raises it
When your app profile says your app is a bank or is a lender.
Back to the example · Lint your app
Page updated .