KuwaitCyber and Operational Resilience Framework (CORF), Incident Reporting to the Central Bank of Kuwait
Incident Reporting to the Central Bank of Kuwait under the Cyber and Operational Resilience Framework (CORF) Version 1.0, Chapter 5, sections 8.2.2.1 to 8.2.2.5
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every institution under the supervision of the Central Bank of Kuwait (the Framework names these Regulated Entities), reached by declaring that you provide financial services.
- Report a high severity incident to the Central Bank of Kuwait within 1 hour of discovery and a medium severity incident within 4 hours of discovery (Chapter 5, section 8.2.2.1).
- Update the Central Bank of Kuwait on a high severity incident every 4 hours from the prior notification and on a medium severity incident daily, or when it asks (section 8.2.2.2).
- Submit a closure report to the Central Bank of Kuwait once a medium or high severity incident is resolved, and report low severity incidents consolidated each month (section 8.2.2.3).
- State the estimated financial loss in your initial progress report and confirm the final loss amount in the closure report (section 8.2.2.4).
- Report using the Central Bank of Kuwait's predefined incident templates and communication channels (section 8.2.2.5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 85(b) of Law No. 32 of 1968 caps the financial penalty on a bank at fifty thousand Dinars; the same article also provides a warning, restrictions on the bank's business and removal of responsible officers
- Rule
- Fixed only
- As of
- Currency
- KWD
- Fixed cap
- 50,000
Who enforces it
Enforcement body
The Central Bank of Kuwait, which oversees the implementation of the Framework across all Regulated Entities.
Settledness
- As of
- Open questions
- Which provision sanctions a finance, investment, exchange or credit information company that breaches the Framework, given that Article 85 of Law No. 32 of 1968 is stated for banks?
What this law does
The Framework applies to all Regulated Entities under the supervision of the Central Bank of Kuwait. Regulated Entities must initially report a medium severity incident to the Central Bank of Kuwait within 4 hours of discovery and a high severity incident within 1 hour of discovery. Regulated Entities must update the Central Bank of Kuwait on a medium severity incident daily or when requested by the Central Bank of Kuwait.
Regulated Entities must update the Central Bank of Kuwait on a high severity incident every 4 hours from prior notification or when requested by the Central Bank of Kuwait. Regulated Entities must submit a closure report once a medium or high severity incident is resolved, and report low severity incidents consolidated on a monthly basis. Regulated Entities must determine the estimated financial loss in the initial situational report and confirm the final loss amount in the closure report. Regulated Entities must report incidents in accordance with the predefined templates and communication channels.
When LexLint raises it
When your app profile says your app provides financial services.