IsraelDirective 366, reporting of technological failures, data security incidents and cyber attacks
Proper Conduct of Banking Business Directive 366 (Reporting of Technological Failures, Data Security Incidents, and Cyber Attacks) sections 3, 6, 10, 12 and 16
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a banking corporation as defined in the Banking (Licensing) Law, 5741-1981, a corporation defined in section 11(b)(1) of that Law, and a payment service provider with prudential importance license holder (reached by declaring that you are a bank or a payment or e-money provider); a corporation controlled by a banking corporation that is not itself one reports only an incident with a significant impact on the banking group or the banking system (Directive 366, sections 3 and 6.5).
- Report to the Banking Supervision Department a significant technological failure incident, a suspected cyber incident whose handling was not completed within four hours of its initial identification or within two hours from knowledge of the damage it caused, a cyber incident that affects a large number of customers or has new offensive characteristics, and any significant data leak incident (section 6).
- Report by telephone, at any time of day, within two hours of identifying the incident as one that requires reporting, and supplement the telephone report with a written initial report within 8 hours from the time of the telephone report (sections 10.1 and 10.2).
- Appoint a Reporting Officer for Technological Failure and a Reporting Officer for Information Technology Incidents, and give their details to the Technology, Innovation, and Cyber Division of the Banking Supervision Department (sections 8 and 9).
- Submit up-to-date written information on the incident at least once daily or whenever its characteristics or consequences change significantly, and report the completion of the incident (sections 12 and 13).
- Investigate the incident under a procedure carried out by or with the involvement of a function independent of the incident, and submit the approved investigation to the Banking Supervision Department within 45 days from the completion of the incident or within 60 days from its identification as one that requires reporting, whichever is earlier (sections 14 to 16).
- Document the decision, the function that made it and its reasons when you examined the need to report an incident and decided not to report it (section 17).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 14h(a)(1) of the Banking Ordinance lets the Supervisor of Banks impose a financial sanction of one million NIS on a banking corporation that contravenes a proper conduct of banking business directive.
- Rule
- Fixed only
- As of
- Currency
- ILS
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Supervisor of Banks, who may impose a financial sanction on a banking corporation that contravenes a proper conduct of banking business directive.
What this law does
Section 3 of Directive 366 applies it to a banking corporation, a corporation as defined in section 11(b)(1) of the Banking (Licensing) Law, and a payment service provider with prudential importance license holder as defined in section 36i. Section 6.1 of Directive 366 requires reporting to the Banking Supervision Department a significant technological failure incident.
Section 6.2 of Directive 366 requires reporting a suspected cyber incident dealt with at the level of the Chief Cyber Defense Officer when its handling was not completed within four hours of its initial identification or within two hours from knowledge of the damage it caused. Section 6.3 of Directive 366 requires reporting a cyber incident that affects a large number of customers or has new offensive characteristics.
Section 6.4 of Directive 366 requires reporting any significant data leak incident that sections 6.1 to 6.3 do not cover. Section 10.1 of Directive 366 requires a banking corporation to report by telephone within two hours of identifying an incident that requires reporting, and to supplement the telephone report with a written initial report within 8 hours from the time of the telephone report.
Section 12.1 of Directive 366 requires a banking corporation to submit up-to-date written information on the incident at least once daily or at any time that there are significant changes in its characteristics or consequences.
Section 16 of Directive 366 requires the investigation to be submitted to the Banking Supervision Department within 45 days from the completion of the incident or within 60 days from the date on which the incident was identified as one that requires reporting, whichever is earlier. Section 171.1 of Directive 364 requires the report to the Supervisor of Banks of technological failure incidents and information security incidents pursuant to Directive 366.
Section 5(c1) of the Banking Ordinance lets the Supervisor promulgate proper conduct of banking business directives pertaining to the operating and management methods of a banking corporation. Section 14h(a)(1) of the Banking Ordinance lets the Supervisor impose a financial sanction of one million NIS on a banking corporation that contravened a proper conduct of banking business directive.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.