MalaysiaBNM Risk Management in Technology Policy Document, Cyber Risk Framework, Monitoring, Red Team Testing and Incident Response Plan
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a financial institution that this policy document covers: a licensed bank, investment bank or Islamic bank, a licensed insurer or takaful operator, a prescribed development financial institution, an approved issuer of electronic money, an operator of a designated payment system, a registered merchant acquirer, or an intermediary remittance institution (reached by declaring that you provide financial services). Some paragraphs are disapplied for the smaller classes in paragraph 2.2.
- Develop a Cyber Risk Framework that articulates your governance for managing cyber risks, your cyber resilience objectives and your risk tolerance, with due regard to the evolving cyber threat environment (S 11.2).
- Adopt the control measures in Appendix 5 of the policy document to enhance your resilience to cyber-attacks (S 11.5).
- Conduct a realistic Red Team simulation attack on your infrastructure at least once every three years to identify and manage potential vulnerabilities (S 11.6).
- Establish a Security Operations Center, supported by competent resources and the necessary tools, that monitors your technology security posture and covers all critical systems including the supporting infrastructure (S 11.9).
- Establish and implement a comprehensive Cyber Incident Response Plan, and conduct an annual cyber drill exercise to test it, reporting the result to your board in a timely manner (S 11.13 and S 11.16).
- If the Bank has designated you a National Critical Information Infrastructure entity, ensure compliance with the requirements applicable to such entities, including the code of practice in Appendix 12 and any additional directives and standards the National Cyber Security Agency issues (S 11.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Bank Negara Malaysia, which may take enforcement action for non-compliance with a standard (S) of the policy document.
Settledness
- As of
- Open questions
- Which penalty applies to a breach of a standard (S) of the policy document, given that paragraph 5.2 states only that non-compliance may result in enforcement action?
What this law does
Paragraph S 11.2 requires a financial institution to develop a Cyber Risk Framework that articulates its governance for managing cyber risks, its cyber resilience objectives and its risk tolerance. Paragraph S 11.5 requires a financial institution to adopt the control measures outlined in Appendix 5 to enhance its resilience to cyber-attacks. Paragraph S 11.6 requires a financial institution to conduct a realistic Red Team simulation attack on its infrastructure at least once every three years.
Paragraph S 11.9 requires a financial institution to establish a Security Operations Center supported by competent resources, with monitoring that covers all critical systems including the supporting infrastructure. Paragraph S 11.13 requires a financial institution to establish and implement a comprehensive Cyber Incident Response Plan.
Paragraph S 11.16 requires a financial institution to conduct an annual cyber drill exercise to test the effectiveness of that plan and to report the result to the board in a timely manner.
Paragraph S 11.4 requires a financial institution designated as a National Critical Information Infrastructure entity under the Cyber Security Act 2024 to ensure compliance with the requirements applicable to such entities, including additional directives and standards issued by the National Cyber Security Agency.
Appendix 12 to the policy document constitutes the Code of Practice for national critical information infrastructure entities designated by the Bank under the banking and finance sector.
The policy document applies to licensed banks, licensed investment banks, licensed Islamic banks, licensed insurers, licensed takaful operators, prescribed development financial institutions, approved issuers of electronic money, operators of a designated payment system, registered merchant acquirers and intermediary remittance institutions.
The requirements in the policy document are specified pursuant to sections 47(1), 47(2)(d) and 143(2) of the Financial Services Act 2013, and to the corresponding sections of the Islamic Financial Services Act 2013, the Development Financial Institutions Act 2002 and the Money Services Business Act 2011. Paragraph 5.2 provides that non-compliance with a standard may result in enforcement action. Paragraph 4.1 states that the policy document comes into effect on .
When LexLint raises it
When your app profile says your app provides financial services.