NigeriaCBN Risk-Based Cybersecurity Framework for Banks and Payment Service Banks, 2024, 24-Hour Cyber-Incident Report
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMBs%20and%20PSBs_2024.pdfIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a commercial bank, merchant bank, non-interest bank or payment service bank supervised by the Central Bank of Nigeria's Banking Supervision Department, which the Framework calls a Supervised Financial Institution (reached by declaring that you are a bank). Full compliance was due on .
- Report every cyber incident to the Director, Banking Supervision, Central Bank of Nigeria not later than 24 hours after you detect it, using the report format in Appendix VII or any other format the Central Bank advises (section 5).
- Treat as a cyber incident any event which may result in a financial loss above 0.01% of shareholders' funds unimpaired by losses, a data breach or data destruction, an unplanned outage in the Core Banking Application, website defacement, any glitch that results in financial losses, or another event the Central Bank determines from time to time (Appendix I).
- Provide additional information to the Central Bank afterwards where necessary, and provide an update where your earlier report was incomplete (section 5 and Appendix VII).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Nigeria, which monitors and enforces compliance through the annual Cybersecurity Supervisory Review and Evaluation exercise, Risk Based Examination, Annual Industry Standard Compliance audit and periodic spot check.
Settledness
- As of
- Open questions
- Does the 24-hour clock run from detection of the incident, as section 5 states, or from the incident happening, as the Appendix VII template heading states?
What this law does
Section 5 of the Framework requires a Supervised Financial Institution to report all cyber incidents, as defined in Appendix I, to the Director of Banking Supervision of the Central Bank of Nigeria not later than 24 hours after the incident is detected.
Appendix I to the Framework defines a cyber-incident as any event which may result in a financial loss above 0.01% of shareholders' funds unimpaired by losses, data breach and data destruction, unplanned outage in the Core Banking Application, website defacement, any glitch that results in financial losses, or others as determined from time to time.
The incident reporting template in Appendix VII to the Framework states that security incidents must be reported to the Director, Banking Supervision within 24 hours of the incident happening. The incident reporting template in Appendix VII to the Framework states that additional updates must be provided if the earlier reporting was incomplete.
The Central Bank of Nigeria issued the Framework by a letter of as the minimum requirements to be put in place by all banks and payment service banks in their cybersecurity programmes. The Framework's covering letter sets as the effective date for full compliance. The Framework applies to commercial banks, merchant banks, non-interest banks and payment service banks.
The Framework replaces the Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers issued in October 2018. Section 6 of the Framework provides that non-compliance with it shall attract appropriate sanctions as defined in section 68 of BOFIA, 2020. Section 7 of the Framework provides that the Central Bank of Nigeria shall monitor and enforce compliance.
Section 33(1)(b) of the Central Bank of Nigeria (Establishment) Act, 2007 empowers the Bank to issue guidelines to any person and any institution under its supervision. Section 33(5)(a) of that Act makes an institution that fails to comply with such a guideline liable on conviction to a fine not exceeding N10,000,000.
When LexLint raises it
When your app profile says your app is a bank.