JordanCentral Bank of Jordan Instructions of Cyber Risks Resilience, Cyber Security Governance, Program and Risk Management
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a bank, a financial institution (a company licensed to practice payment services or to manage and operate electronic payment systems), a credit bureau or a microfinance company under the oversight and supervision of the Central Bank of Jordan (reached by declaring that you provide financial services).
- Have a board and executive management that include competent persons with the skills and knowledge to understand and manage cyber risks, with the board adopting the cyber security policy and program and checking compliance with them (Article 6).
- Apply and continuously update a cyber security program that meets the confidentiality, reliability and availability requirements of information in the ICT environment, identifies internal and external cyber threats, and undertakes the corrective procedures needed to control and mitigate the adverse effects of cyber risks (Article 7).
- Keep a dedicated cyber security policy covering at least roles and responsibilities, data governance and classification, cyber risk management, controls to mitigate cyber risks, business continuity and disaster recovery, third-party outsourcing, and staff training and awareness (Articles 8 and 9).
- Manage cyber security through an information security manager who does not administratively follow the IT department, and have that manager submit reports at least semi-annually, or whenever necessary, to the board and the executive management (Article 10).
- Identify and classify critical functions, operations and information assets, conduct ongoing cyber risk factor and scenario analysis, and keep a cyber risk register updated continuously (Articles 13 to 17).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 88(b)(4) of the Banking Law lists a fine on the bank of no more than 500,000 Jordanian dinars among the penalties.
- Rule
- Fixed only
- As of
- Currency
- JOD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Central Bank of Jordan, which under Article 88 of the Banking Law may take the listed measures and penalties against a bank that violates the Law or the regulations, instructions and orders issued under it.
Settledness
- As of
- Open questions
- Do the Instructions of Cyber Risks Resilience remain the Central Bank of Jordan's operative cyber rule beside its Cybersecurity Framework for the Jordan Financial Sector of July 2021?
What this law does
The Instructions apply to all licensed banks, financial institutions, credit bureaus and microfinance companies under the oversight and supervision of the Central Bank of Jordan. The Central Bank of Jordan issued the Instructions under Article 99(B) of the Banking Law, among other provisions, and they take effect twelve months after issuance unless specified otherwise.
Article 7 requires the company to apply and continuously update a cyber security program that meets the confidentiality, reliability and availability requirements of information in its ICT environment. Article 10 requires the company to manage cyber security information through an information security manager who does not administratively follow the IT department.
Article 10 also requires the information security manager to submit reports at least semi-annually, or whenever necessary, to the board and the executive management on cyber security in the company. Article 88(a)(1) of the Banking Law treats a bank's violation of the instructions and orders issued under that Law as a ground for the Central Bank to take the measures and sanctions listed in Article 88(b).
Article 88(b)(4) of the Banking Law lists a fine on the bank of no more than 500,000 Jordanian dinars among the penalties.
When LexLint raises it
When your app profile says your app provides financial services.