FijiReserve Bank of Fiji Prudential Supervision Policy Statement 2, Cybersecurity Risk Management Framework
Prudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), paras. 4 to 16
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a commercial bank, credit institution, insurance company, insurance broker, securities exchange, management company of a managed investment scheme, stock broker, the Fiji National Provident Fund, the Fiji Development Bank or a restricted foreign exchange dealer supervised by the Reserve Bank of Fiji (reached by declaring that you provide financial services); it does not reach any other business.
- Establish and maintain a documented cybersecurity risk management framework that is part of your enterprise risk management framework, is approved by your board and is regularly reviewed (paras. 4.1 and 4.2.1).
- Have in place a cybersecurity policy commensurate with your exposures to vulnerabilities and threats, covering cybersecurity risk identification, measurement, monitoring and control (para. 4.4.1).
- Establish a designated cybersecurity risk management function headed by a Chief Information Security Officer or an equivalent senior officer (para. 4.2.3).
- Establish, document and implement policies and procedures to control access to your information assets (para. 7.1.1), and obtain information about technical vulnerabilities of your information systems in a timely fashion, evaluate your exposure to them and implement appropriate measures (para. 10.6.1).
- Conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals at a minimum for high risk systems and processes, and before such systems are introduced (para. 15.3(a)).
- Develop and implement a third-party relationship policy that mandates cybersecurity controls to address the risk posed by third-party access to your information assets (para. 13.2).
- Have a cybersecurity incident management process governed by a documented policy and procedures (para. 14.1).
- Give the Reserve Bank a copy of your cybersecurity policy and all relevant policies and procedures within 12 months of the Policy's implementation, and a copy of any major revision within 30 days after your board approves it (para. 18.1). Full compliance was required within one year of the Policy's effective date of (para. 19.1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
The Reserve Bank may impose on a licensed financial institution that fails to comply with a directive of the Reserve Bank an initial fine not exceeding FJD 5,000 and a further fine not exceeding FJD 1,000 for each day the contravention continues (Banking Act 1995, section 15(1)(d) and (2)(a)), and may direct the institution to take a specified action by written notice (section 15(2)(b)).
- Rule
- Per violation only
- As of
- Currency
- FJD
- Fixed cap
- 5,000
- Per violation unit
- Day
- Per violation amount
- 1,000
Over one month, FJD 5,000, which is the instrument's own cap: the penalty stops accruing on day 5.
Who enforces it
Enforcement body
The Reserve Bank of Fiji, which assesses each supervised entity's compliance in the course of its supervision.
What this law does
The Reserve Bank of Fiji's Prudential Supervision Policy Statement on the management of cybersecurity risk by supervised entities, PSPS 2, applies to licensed commercial banks, credit institutions, insurance companies, insurance brokers, the securities exchange, management companies of managed investment schemes, stock brokers, the Fiji National Provident Fund, the Fiji Development Bank and restricted foreign exchange dealers.
The Policy is issued under section 14(3) of the Banking Act 1995 and the other Acts paragraph 1.1 lists. A supervised entity must have a documented, board-approved cybersecurity risk management framework that is part of its enterprise risk management framework and is regularly reviewed. A supervised entity must also have a cybersecurity policy commensurate with its exposures to vulnerabilities and threats.
Section 14(3) of the Banking Act 1995 subjects a licensed financial institution to the directives of the Reserve Bank. Section 15 of the Banking Act 1995 lets the Reserve Bank sanction a licensed financial institution that fails to comply with a directive of the Reserve Bank, including by a fine of up to FJD 5,000 and a further fine of up to FJD 1,000 for each day the contravention continues. The Policy became effective on , with full compliance required within one year of that date.
When LexLint raises it
When your app profile says your app provides financial services.