JordanCentral Bank of Jordan Instructions of Cyber Risks Resilience, Notification of Cyber Events to the Central Bank
Central Bank of Jordan Instructions of Cyber Risks Resilience (No. 26/1/1/1984 of ), Art. 49
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a bank, a financial institution (a company licensed to practice payment services or to manage and operate electronic payment systems), a credit bureau or a microfinance company under the oversight and supervision of the Central Bank of Jordan (reached by declaring that you provide financial services).
- Notify the Central Bank of Jordan, no later than 72 hours from the moment of discovering it, where the company detects its exposure to a cyber event or an attempt at a high risk cyber attack on its systems or networks, according to the mechanism the Central Bank adopts (Article 49(a)). The Instructions state this as what the company should do.
- Notify the competent security bodies immediately upon discovery of any embezzlement, forgery, theft or fraud resulting from the cyber event, in accordance with the relevant laws and instructions (Article 49(a)).
- Provide the Central Bank periodically with the details of cyber events, their effects, response procedures and the preventive procedures implemented, according to the mechanism the Central Bank will adopt (Article 49(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 88(b)(4) of the Banking Law lists a fine on the bank of no more than 500,000 Jordanian dinars among the penalties.
- Rule
- Fixed only
- As of
- Currency
- JOD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Central Bank of Jordan, which under Article 88 of the Banking Law may take the listed measures and penalties against a bank that violates the Law or the regulations, instructions and orders issued under it.
Settledness
- As of
- Open questions
- What mechanism has the Central Bank of Jordan adopted for the 72-hour notice and the periodic reports under Article 49?
What this law does
The Instructions apply to all licensed banks, financial institutions, credit bureaus and microfinance companies under the oversight and supervision of the Central Bank of Jordan. Article 49(a) says the company should notify the Central Bank of Jordan no later than 72 hours from the moment of discovering a cyber event or an attempt at a high risk cyber attack on its systems or networks.
Article 49(a) also says the company should immediately upon discovery notify the competent security bodies of any embezzlement, forgery, theft or fraud resulting from the cyber event. Article 49(b) provides for the company to give the Central Bank the details of cyber events, their effects, response procedures and the implemented preventive procedures, periodically.
Article 88(a)(1) of the Banking Law treats a bank's violation of the instructions and orders issued under that Law as a ground for the Central Bank to take the measures and sanctions listed in Article 88(b).
When LexLint raises it
When your app profile says your app provides financial services.