IraqCentral Bank of Iraq Standards Booklet 2025 for Private Banks, Standard B7 Infrastructure and Data
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a private bank, commercial or Islamic, licensed in Iraq (reached by declaring that you are a bank); the Booklet applies exclusively to private banks.
- Establish strong, secure and stable infrastructure that is resilient and can withstand cyberattacks, aligned with the Central Bank of Iraq's specifications in the Assessment Guidelines (Standard B7.1).
- Protect all data from unauthorized access and tampering, and apply mandatory encryption at rest and in transit to Tier 0 and Tier 1 data, including customer master data, customer authentication data, customer contact data and static account identifiers (Standard B7.1 and Assessment Guidelines, Standard B.7).
- Maintain a detailed Incident Response Plan for cybersecurity breaches and update it annually (Assessment Guidelines, Standard B.7, item 11).
- Obtain an annual assurance report on infrastructure and encryption compliance from a third-party specialist firm on the Central Bank of Iraq's approved list, and submit it to the board and the Central Bank within a maximum of 60 days since the close of the financial year (Standard B7.2 and Assessment Guidelines, Standard B.7).
- Abide by the requirements and specifications of ISO 27001, ISO 20000, ISO 22301, 25011 and PCI DSS, implemented in a phased approach with an analysis of cost and expected timelines (Assessment Guidelines, Standard B.7, items 9 and 10).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Iraq, which states that non-compliance draws administrative action up to sanctions and remedial measures under article 56 of the 2004 Banking Law, or revocation of banking licenses under article 13 of that law.
Settledness
- As of
- Open questions
- Which cybersecurity specifications has the Central Bank of Iraq issued beyond the Assessment Guidelines, including the Cyber Resilience Controls the Guidelines name?
What this law does
The Booklet enters into force as of the date of its publication and applies exclusively to all private banks, both commercial and Islamic. Standard B7.1 requires all banks to establish strong, secure and stable infrastructure that is resilient and can withstand cyberattacks, aligned with Central Bank of Iraq specifications. Standard B7.1 also requires banks to protect all data from unauthorized access and tampering.
Standard B7.2 requires a third-party specialist firm from a Central Bank of Iraq approved list to assure the bank's adherence to the infrastructure and data encryption specifications. The Booklet states that its standards are mandatory and will be enforced by the Central Bank of Iraq.
The Booklet states that non-compliance results in administrative action, up to sanctions and remedial measures under article 56 of the 2004 Banking Law or revocation of banking licenses under article 13 of that law. The Assessment Guidelines require banks to apply mandatory encryption at rest and in transit to Tier 0 and Tier 1 data, which includes customer master data and customer authentication data.
The Assessment Guidelines require a bank to maintain a detailed Incident Response Plan for cybersecurity breaches and to update it annually. The Assessment Guidelines require the annual third-party assurance report to be submitted to the board and the Central Bank of Iraq within a maximum of 60 days since the close of the financial year.
When LexLint raises it
When your app profile says your app is a bank.