JamaicaStandard of Sound Practice on Management of Cyber Risks, Reporting of Cyber Incidents and Data Breaches to the Bank of Jamaica
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a deposit-taking institution licensed under the Banking Services Act, 2014 (reached by declaring that you are a bank). The Standard states some of its requirements as what an institution should do and others as what it must do.
- Report cyber incidents and data breaches promptly to the Bank of Jamaica, within 72 hours, along with the relevant authorities (sections 4.6.6 and 4.10.1).
- Provide a digital forensics report from an external cybersecurity assessor if the Bank of Jamaica asks for one (section 4.10.1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Jamaica, which conducts risk-based examinations of licensees under section 34D of the Bank of Jamaica Act to assure compliance with the standards in the Standard of Sound Practice on Management of Cyber Risks.
Settledness
- As of
- Open questions
- Has the Standard been made as Supervisory Rules under section 132 of the Banking Services Act, which are subject to affirmative resolution, or does it operate only as a standard of sound practice?
What this law does
The Bank of Jamaica's Standard of Sound Practice on Management of Cyber Risks is intended to establish minimum standards and guidelines on the management of cyber risk for the licensees under the Banking Services Act, 2014. The Standard says it is issued pursuant to section 132(1)a of the Banking Services Act. The Bank of Jamaica's list of supervisory guidance notes names the Standard of Sound Practice on Management of Cyber Risks, dated September 2024.
The Standard says incidents must be reported promptly to the Bank of Jamaica and appropriate authorities within 72 hours. The Standard says deposit-taking institutions must report cyber incidents and data breaches promptly to the Bank of Jamaica within 72 hours along with relevant authorities. The Standard lists the Financial Services Commission, the Jamaica Cyber Incident Response Team and the Office of the Information Commissioner among the local authorities that may receive a report.
The Standard says the Bank of Jamaica conducts risk-based examinations of licensees under section 34D of the Bank of Jamaica Act to assure compliance with the standards it sets out. Section 132(6) of the Banking Services Act says a breach of the Supervisory Rules or of a code of conduct may constitute grounds for the issue of directions by the Supervisor. Section 132(7) of the Banking Services Act makes it an offence for a licensee not to comply with a direction given by the Supervisor.
When LexLint raises it
When your app profile says your app is a bank.