NamibiaBank of Namibia Determination on Information Security (BID-30) of 2017, Reporting of Material Incidents
BID-30 (2017), incident reporting, para. 17.1
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a banking institution authorised by the Bank of Namibia to conduct banking business in Namibia, and the banking group to which it belongs (reached by declaring that you are a bank). The paragraphs on governance and the programme are worded "should", and the incident reporting paragraph is worded "is required".
- Report all material information security related incidents to the Bank of Namibia immediately as and when each happens (paragraph 17.1).
- Communicate with internal and external parties to ensure a coordinated response to an incident, and determine the type of information to be reported and when (paragraph 17.1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Namibia, which may pursue remedial measures under the Banking Institutions Act and impose an administrative fine for contravening a determination.
Settledness
- As of
- Open questions
- What makes an information security incident material under the 2017 Determination, given that it leaves the term undefined?
What this law does
Paragraph 3 of the Determination on Information Security (BID-30) of 2017 applies it to all banking institutions authorised by the Bank to conduct banking business in Namibia and to the banking groups to which they belong. Paragraph 17.1 of the 2017 Determination says a banking institution is required to report all material information security related incidents to the Bank immediately as and when it happens.
Paragraph 17.1 of the 2017 Determination says the banking institution should communicate with internal and external parties to ensure a coordinated response to incidents. Part V of the 2017 Determination says that if a banking institution fails to comply, the Bank may pursue any remedial measures provided under the Act or any other measures the Bank may deem appropriate.
Section 109(3) of the Banking Institutions Act, 2023 keeps a determination made under the repealed Banking Institutions Act, 1998 in force until it is repealed or amended under the 2023 Act.
Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.
When LexLint raises it
When your app profile says your app is a bank.