IsraelDirective 364, management of IT, information security and cyber defense risks of banking corporations
Proper Conduct of Banking Business Directive 364 (Management of IT, Information Security, and Cyber Protection Risks) sections 10, 28, 106 and 171
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a banking corporation as defined in the Banking (Licensing) Law, 5741-1981, a corporation the Directive reaches under sections 11(a)(3a), 11(a)(3b) and 11(b) of that Law, and a payment services provider with prudential importance license holder (reached by declaring that you are a bank or a payment or e-money provider), from (Directive 364, section 10.1).
- Appoint a senior employee as the Chief Cyber Defense and Information Security Officer, subordinate to a member of management, responsible for monitoring and ensuring that you comply with the information security management framework (section 28).
- Document an information security and cyber defense policy that refers to the issues in section 106, among them identity management and logical access management controls, controls across the information asset lifecycle, monitoring and managing information security incidents, and information security when you enter agreements with third parties (section 106).
- Establish identity management and logical access management controls that allow access to information assets only when a clear business need exists (section 116).
- Use authentication of increased strength, such as multi-factor authentication, for system administrator access and remote access through a public network to a critical or sensitive information asset (section 119).
- Report technological failure incidents and information security incidents to the Supervisor of Banks as Directive 366 requires (section 171.1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 14h(a)(1) of the Banking Ordinance lets the Supervisor of Banks impose a financial sanction of one million NIS on a banking corporation that contravenes a proper conduct of banking business directive.
- Rule
- Fixed only
- As of
- Currency
- ILS
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Supervisor of Banks, who may impose a financial sanction on a banking corporation that contravenes a proper conduct of banking business directive.
What this law does
Section 10.1 of Directive 364 applies it to a banking corporation, to the corporations stated in sections 11(a)(3a), 11(a)(3b) and 11(b) of the Banking (Licensing) Law, and to a payment services provider with prudential importance.
Section 28 of Directive 364 requires a banking corporation to appoint a senior employee as the Chief Cyber Defense and Information Security Officer, who is responsible for monitoring and ensuring that the banking corporation complies with the information security management framework.
Section 106 of Directive 364 requires a banking corporation to refer in its information security and cyber defense policy to identity management controls and logical access management controls and to monitoring and managing information security incidents, among other issues. Section 116.1 of Directive 364 requires a banking corporation to establish identity management and logical access management controls.
Section 171.1 of Directive 364 requires a banking corporation to report technological failure incidents and information security incidents to the Supervisor of Banks pursuant to Directive 366. The Banking Supervision Department published Directive 364 on . Circular C-06-2847 states that Directive 364 entered into force on and repealed, among others, Directive 357 on Information Technology Management and Directive 361 on Cyber Defense Management.
Section 5(c1) of the Banking Ordinance lets the Supervisor promulgate proper conduct of banking business directives pertaining to the operating and management methods of a banking corporation. Section 14h(a)(1) of the Banking Ordinance lets the Supervisor impose a financial sanction of one million NIS on a banking corporation that contravened a proper conduct of banking business directive. The English publication of Directive 364 states that only the Hebrew text is binding.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.