NamibiaBank of Namibia Determination on Information Security (BID-30) of 2017, Information Security Programme
BID-30 (2017), information security programme, paras. 8 to 18
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a banking institution authorised by the Bank of Namibia to conduct banking business in Namibia, and the banking group to which it belongs (reached by declaring that you are a bank). The paragraphs on governance and the programme are worded "should", and the incident reporting paragraph is worded "is required".
- Have your board of directors ensure that an information security policy and program is established and implemented to comply with the Determination (paragraph 8).
- Establish, implement and maintain an information security policy approved by the board, and a documented information security program that states how you identify your information security risks, set your objectives and risk tolerance, and manage those risks (paragraphs 10.1 and 11.1).
- Extend your information security practices to third parties through service level agreements (paragraph 12.2).
- Implement a methodology for vulnerability assessments and penetration testing, and run the tests regularly and whenever systems are updated or deployed (paragraph 18.4).
- Engage independent auditors or specialists to evaluate your security and monitoring systems every three years or when significant changes are made to the systems (paragraph 17.5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Namibia, which may pursue remedial measures under the Banking Institutions Act and impose an administrative fine for contravening a determination.
Settledness
- As of
- Open questions
- Is the 2017 Determination repealed on , six months after the gazette of that repeals it, or on another day?
What this law does
Paragraph 3 of the Determination on Information Security (BID-30) of 2017 applies it to all banking institutions authorised by the Bank to conduct banking business in Namibia and to the banking groups to which they belong. Paragraph 8 of the 2017 Determination makes the board of directors of each banking institution responsible for ensuring that an information security policy and program is established and implemented to comply with the Determination.
Paragraph 10.1 of the 2017 Determination says a banking institution should establish, implement and maintain an information security policy approved by the board. Paragraph 18.4 of the 2017 Determination says a banking institution should implement a methodology for vulnerability assessments and penetration testing and should ensure that the tests are conducted regularly and whenever systems are updated or deployed.
Part V of the 2017 Determination says that if a banking institution fails to comply, the Bank may pursue any remedial measures provided under the Act or any other measures the Bank may deem appropriate. Section 109(3) of the Banking Institutions Act, 2023 keeps a determination made under the repealed Banking Institutions Act, 1998 in force until it is repealed or amended under the 2023 Act.
Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.
When LexLint raises it
When your app profile says your app is a bank.