JamaicaStandard of Sound Practice on Management of Cyber Risks, Cyber Risk Management Framework of Deposit-Taking Institutions
Bank of Jamaica Standard of Sound Practice on Management of Cyber Risks (September 2024), ss. 3 to 6
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a deposit-taking institution licensed under the Banking Services Act, 2014 (reached by declaring that you are a bank). The Standard states some of its requirements as what an institution should do and others as what it must do.
- Conduct continuous monitoring of emerging cybersecurity threats such as denial of service attacks, internal sabotage and malware infestations, so that intrusion attempts and unauthorized or malicious activities by internal and external parties are detected promptly (section 4.6.5).
- Provide the Bank of Jamaica with an annual attestation that includes areas of weakness, compensating controls in areas of non or partial compliance and the initiatives being undertaken to address them, alternating between a self-attestation and an independent attestation (section 4.10.2).
- Provide external reports on vulnerability tests at least twice yearly and on penetration testing at least annually. The Standard states this as what you should do (section 4.10.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Jamaica, which conducts risk-based examinations of licensees under section 34D of the Bank of Jamaica Act to assure compliance with the standards in the Standard of Sound Practice on Management of Cyber Risks.
Settledness
- As of
- Open questions
- Has the Standard been made as Supervisory Rules under section 132 of the Banking Services Act, which are subject to affirmative resolution, or does it operate only as a standard of sound practice?
What this law does
The Bank of Jamaica's Standard of Sound Practice on Management of Cyber Risks is intended to establish minimum standards and guidelines on the management of cyber risk for the licensees under the Banking Services Act, 2014. The Standard says it is issued pursuant to section 132(1)a of the Banking Services Act. The Bank of Jamaica's list of supervisory guidance notes names the Standard of Sound Practice on Management of Cyber Risks, dated September 2024.
The Standard says deposit-taking institutions must conduct continuous monitoring of emerging cybersecurity threats such as denial of service attacks, internal sabotage and malware infestations. The Standard says deposit-taking institutions must provide the Bank of Jamaica with an annual attestation that includes areas of weakness, compensating controls in areas of non or partial compliance and the initiatives being undertaken.
The Standard says external reports on vulnerability tests should be provided at least twice yearly and penetration testing at least annually. Section 132(1) of the Banking Services Act lists a licensee's risk management framework to address material risks among the matters on which Supervisory Rules may be made. The Standard says the Bank of Jamaica conducts risk-based examinations of licensees under section 34D of the Bank of Jamaica Act to assure compliance with the standards it sets out.
Section 132(6) of the Banking Services Act says a breach of the Supervisory Rules or of a code of conduct may constitute grounds for the issue of directions by the Supervisor. Section 132(7) of the Banking Services Act makes it an offence for a licensee not to comply with a direction given by the Supervisor.
When LexLint raises it
When your app profile says your app is a bank.