Saint Kitts and NevisSaint Kitts and Nevis Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Incident Reporting
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an institution licensed under the Banking Act of Saint Kitts and Nevis: the Prudential Standard on Technology Risk Management says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates unless IT is not a significant function or equally effective alternative measures have been taken, and it came into effect on (reached by declaring that you are a bank).
- Within 24 hours of becoming aware of a cyber-incident, alert the ECCB and the Information Security User Group of licensed financial institutions that a cyber-incident occurred (paragraph 12.8.1).
- Complete the incident report in Appendix I of the standard and submit it to the ECCB within 48 hours of the incident; the standard states this as 'should' (paragraph 12.8.1 and Appendix I).
- Notify directly the customers whose accounts were potentially or actually compromised within seventy-two hours of the discovery of the incident (Senior Management roles, item g).
- Provide updates on the incident to the ECCB at the frequency the ECCB determines, until the ECCB deems the incident resolved, and after resolution conduct a post-incident review and submit it to the ECCB (paragraphs 12.8.4 and 12.8.5).
- Notify the general public about a cybersecurity incident only after notifying the ECCB (Senior Management roles, item f).
- Develop and implement a cybersecurity incident response plan that details the steps to be taken in the event of a security breach (Senior Management roles, item e).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of one hundred thousand dollars and a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Central Bank, which may subject a licensed financial institution that violates a prudential standard issued by the Central Bank to the remedial actions specified in section 75 of the Banking Act.
Settledness
- As of
- Open questions
- Are the 24-hour alert to the ECCB and the 48-hour Appendix I report one notification or two?
What this law does
The Eastern Caribbean Central Bank issued the Prudential Standard on Technology Risk Management in exercise of the powers conferred on it by section 184 of the Banking Act, 2015. Paragraph 12.8.1 of the standard provides that within 24 hours of becoming aware of a cyber-incident, an institution shall alert the ECCB and its Information Security User Group that a cyber-incident occurred.
Paragraph 12.8.1 of the standard also says the compromised institution should complete the incident report in Appendix I and submit it to the ECCB within 48 hours of the incident. The standard lists among the responsibilities of Senior Management notifying directly the customers whose accounts were potentially or actually compromised within seventy-two hours of the discovery of the incident.
The standard lists among the responsibilities of Senior Management notifying the general public about a cybersecurity incident only after notifying the ECCB. Paragraph 12.8.4 of the standard provides that an institution shall provide an update on the incident to the ECCB at a frequency determined by the ECCB. Paragraph 12.8.5 of the standard provides that following the resolution of the cyber-incident an institution shall conduct a post-incident review and submit it to the ECCB.
Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2). Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management.
Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.