NamibiaBank of Namibia Determination on Information Security (BID-30) of 2026, Information Security Framework
BID-30 (2026), information security framework, paras. 7 to 11
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This Determination takes effect six months after its publication in the Gazette on (paragraph 14); until then the Determination of 2017 applies. It binds a banking institution or microfinance banking institution authorised by the Bank of Namibia to conduct banking business or microfinance banking business in Namibia (reached by declaring that you are a bank).
- Have your board establish and maintain effective governance over your information and cybersecurity frameworks, and have a comprehensive information security framework in place that covers governance, identification, protection, detection, response and recovery (paragraphs 7.1 and 7.3.1).
- Document all suspected and actual material information and cyber incidents and give the Bank a preliminary report within 24 hours, followed by a detailed post-incident analysis (paragraph 7.2(h)).
- Perform penetration testing on critical systems at least annually, and run vulnerability assessments regularly and remediate what they find (paragraphs 10.5 and 10.6).
- Maintain and test data backup and restoration procedures regularly or at least quarterly, and test your incident response and recovery plan with simulation tests at least twice a year (paragraphs 11.3 and 11.4).
- Extend the framework to third parties you enter material outsourcing arrangements with, and require them to uphold information security controls commensurate with your risk profile (paragraph 7.3.1(d)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Namibia, which may impose an administrative fine under section 94(1) of the Banking Institutions Act, 2023.
Settledness
- As of
- Open questions
- Does the 2026 Determination take effect on , six months after its gazette of as paragraph 14 reads, or on , the date the Bank of Namibia determinations listing gives?
What this law does
Paragraph 5 of the Determination on Information Security (BID-30) of 2026 applies it to all banking institutions and microfinance banking institutions authorised by the Bank to conduct banking business and microfinance banking business in Namibia. Paragraph 7.3.1 of the 2026 Determination requires a banking institution or microfinance banking institution to have in place a comprehensive information security framework.
Paragraph 10.5 of the 2026 Determination requires penetration testing on critical systems at least annually or more frequently in alignment with the institution's risk profile. Paragraph 11.3 of the 2026 Determination requires the institution to maintain and test data backup and restoration procedures regularly or at least quarterly. Paragraph 14 of the 2026 Determination brings it into effect six months after the date of publication in the Gazette.
Paragraph 15 of the 2026 Determination repeals the Determination on Information Security (BID-30) published in the Government Gazette on . Paragraph 13.1 of the 2026 Determination says any contravention or failure to comply is subject to administrative penalties as contemplated in section 94(1) of the Act.
Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.
When LexLint raises it
When your app profile says your app is a bank.