GambiaCentral Bank of The Gambia Cybersecurity Guidelines for Financial Institutions: Governance, Risk Management and Cyber Resilience Requirements
Cybersecurity Guidelines for Financial Institutions (Central Bank of The Gambia), parts 3 and 4
In force.
A sector security regimes rule binding private bodies.
- Enforcement body
- Central Bank of The Gambia
- Obligation class
- Security, Governance
As of .
What it requires
- This reaches you where you are a deposit-taking financial institution, such as a commercial bank, savings and loans company, mutual savings company or credit union, authorised under the Banking Act 2009 or the Non-Bank Financial Institutions Act 2016 (secs. 1.3 and 1.4) (reached by declaring that you are a bank).
- Appoint a Chief Information Security Officer who ensures that cybersecurity policies and procedures are adhered to and incidents are dealt with on time, who chairs the Cybersecurity Steering Committee, and who creates a cyber-incident response plan (secs. 3.3 and 3.4).
- Establish a risk management framework that defines roles and responsibilities in addressing cyber risk, and a robust operational risk management policy with appropriate systems, procedures and controls to identify, protect, detect, monitor and manage cyber risks (part IV).
- Develop an incident response policy to plan for, respond to, contain and rapidly recover from disruptions caused by cyber incidents; the policy should stipulate a Board-approved cyber-incident response plan, a dedicated response team and cybersecurity drills based on the plan (sec. 4.1.3).
- Keep a business continuity plan and disaster recovery plan, create a test calendar for it, and test it against disruptive, destructive and corruptive cyber events (sec. 4.1.1).
- Carry out a cyber resilience assessment of your current cybersecurity posture at regular intervals, conduct regular cyber drill exercises, and submit cybersecurity functions to regular independent assessment and testing by internal audit, risk management and external audit (secs. 4.2 and 4.3).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Guideline is issued pursuant to section 79 of the Central Bank of The Gambia Act 2018. The Guideline applies to all financial institutions authorised under the Banking Act 2009, the Non-Bank Financial Institutions Act 2016 and section 66(b) of the Central Bank of The Gambia Act. The Guideline defines a financial institution as a deposit-taking institution such as a commercial bank, savings and loans company, mutual savings company and credit union.
Part VI provides that a financial institution that contravenes the Guideline attracts appropriate sanctions determined by the Central Bank of The Gambia in accordance with the Central Bank of The Gambia Act. Section 4.1.3 requires a financial institution to develop an incident response policy to plan for, respond to, contain and rapidly recover from disruptions caused by cyber incidents.
When LexLint raises it
When your app profile says your app is a bank.