MoroccoBank Al-Maghrib Directive on Intrusion Tests of Credit Institutions' Information Systems
Directive n° 3/W/16 du 10 juin 2016 fixant les règles minimales à observer par les établissements de crédit pour réaliser les tests… d’intrusion des systèmes d’information
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds a credit institution (établissement de crédit) supervised by Bank Al-Maghrib under Law 103-12 (reached by declaring that you are a bank or a lender).
- Assess the security of your information system and make the regular conduct of intrusion tests part of an overall, risk-based framework for evaluating the effectiveness of your security arrangements (Article 1).
- Adopt each year a programme of tests, specifying the perimeter, nature, extent and frequency of the tests for your whole information system, and submit it for validation to your audit or risk committee (Article 3).
- Test information systems that are open to the outside more than once a year, and test again on any change in the information system that may affect your exposure to information-security or cyber-attack risks (Articles 6 and 7).
- Carry out targeted tests when Bank Al-Maghrib requires them, at the frequency and in the manner it determines (Article 7).
- Report the results of the tests to your management body and your audit or risk committee, and draw up an action plan to correct the vulnerabilities and weaknesses found (Articles 17 and 19).
- Send Bank Al-Maghrib, by 31 March at the latest, an annual report on the tests covering your risk mapping, the tests carried out and their results, the corrective action plans and the programme for the coming year (Article 20).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Bank Al-Maghrib, which may require targeted tests and receives the annual report on the tests (Articles 7 and 20).
Settledness
- As of
- Open questions
- Has Bank Al-Maghrib replaced or amended Directive 3/W/16 since the end-2023 update of its compilation of texts?
What this law does
Directive 3/W/16 of Bank Al-Maghrib sets the minimum rules that credit institutions must observe in carrying out intrusion tests on their information systems. Article 1 requires a credit institution to assess the security of its information system and to include the regular conduct of tests in an overall framework for evaluating the effectiveness of its security arrangements, based on a risk-based approach.
Article 3 requires a credit institution to adopt each year a programme of tests to be carried out, taking account of all legal, regulatory and contractual requirements. Article 6 requires information systems that are open to the outside to be tested more than once a year. Article 7 lets Bank Al-Maghrib require a credit institution to carry out targeted tests at the frequency and in the manner it determines.
Article 19 requires a credit institution to draw up an action plan to correct the vulnerabilities and weaknesses found through the tests. Article 20 requires a credit institution to send Bank Al-Maghrib, by 31 March at the latest, an annual report on the tests. Article 21 provides that the Directive takes effect from the date of its signature.
Article 172 of Law 103-12 makes credit institutions that contravene the Law and the texts taken for its application liable to the disciplinary sanctions provided in the following articles. Article 178 of Law 103-12 lets the wali of Bank Al-Maghrib, where a caution or warning has had no effect, suspend managers, prohibit or restrict operations, appoint a provisional administrator or withdraw the licence.
When LexLint raises it
When your app profile says your app is a bank or is a lender.