MauritiusBank of Mauritius Guideline on Cyber and Technology Risk Management
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every financial institution licensed or authorised by the Bank of Mauritius (reached by declaring that you provide financial services). The Guideline came into effect on , and paragraph 102 required full compliance by the end of June 2024.
- Have your board review and approve at least annually the technology strategy, the cyber and technology risk management strategy and framework and the related policies, and appoint a senior officer as Chief Information Security Officer (paragraph 5).
- Keep a board approved business continuity plan and a board approved response and recovery plan for cyber and technology incidents (paragraphs 54 and 55).
- Have independent specialists assess the critical systems, services, infrastructures and other assets for vulnerabilities on an annual basis, and penetration test internet-facing systems and critical infrastructure after deployment or any major change and annually thereafter (paragraphs 74 and 81).
- Have the governance and the cyber and technology risk management framework audited by an external independent assessor, covering critical systems, services, infrastructures and other assets and electronic delivery channels annually and all areas within a two-year cycle for a Domestic Systemically Important Bank or a three-year cycle for any other financial institution (paragraph 67).
- Run a cyber and technology security awareness and training programme for staff, senior management and the board at least annually (paragraph 94).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 100(4) of the Banking Act 2004 makes failing to comply with guidelines or instructions made under section 100 an offence punishable by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 2 years.
Penalty structure
Section 100(4) of the Banking Act 2004 caps the fine at 100,000 rupees and the imprisonment at 2 years for failing to comply with guidelines or instructions made under that section; the fine and the imprisonment are stated together ('and').
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Bank of Mauritius, which issues the Guideline under section 100 of the Banking Act 2004 together with section 50 of the Bank of Mauritius Act 2004 and section 17 of the National Payment Systems Act 2018.
Settledness
- As of
- Open questions
- What penalty applies to a payment service provider that fails to comply with the Guideline, given that the Guideline cites section 17 of the National Payment Systems Act 2018 as well as the Banking Act 2004 as its authority?
What this law does
The Guideline applies to all financial institutions licensed or authorised by the Bank of Mauritius. The Guideline is issued under the authority of section 50 of the Bank of Mauritius Act 2004, section 100 of the Banking Act 2004 and section 17 of the National Payment Systems Act 2018. The Guideline came into effect on .
Paragraph 5 makes the board responsible for reviewing and approving at least annually the technology strategy, the cyber and technology risk management strategy and framework and the related policies. Paragraph 74 requires the critical systems, services, infrastructures and other assets of a financial institution to be subject to vulnerability assessment by independent specialists on an annual basis.
Paragraph 81 requires penetration testing by independent specialists of internet-facing systems and critical infrastructure immediately after deployment or major changes and annually thereafter. Paragraph 102 required financial institutions to take the measures necessary to comply fully with all provisions of the Guideline by the end of June 2024.
Section 100(4) of the Banking Act 2004 makes it an offence to fail to comply with guidelines or instructions made under that section, punishable on conviction by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 2 years.
When LexLint raises it
When your app profile says your app provides financial services.