QatarQatar Central Bank Insurance Sector Cyber Security Regulation, incident management and reporting
Qatar Central Bank Insurance Sector Cyber Security Regulation (2019), Section 8.2
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an insurance company in Qatar regulated by the Qatar Central Bank (QCB); an insurer that declares it is an insurer is reached (Section II).
- Establish an Incident Management Framework and an Incident Management Policy and procedures to protect, detect, evaluate and respond to cyber incidents (Section 8.2.1).
- Report every critical incident to QCB immediately, or within 1 hour of identifying it (Section 8.2.13).
- Test the predetermined escalation and response plan for security incidents on an annual basis (Section 8.2.10).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 216 sets up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and also up to 100,000 riyals daily for every continuous violation.
- Rule
- Per violation only
- As of
- Currency
- QAR
- Per violation unit
- Violation
- Per violation amount
- 10,000,000
Who enforces it
Enforcement body
The Qatar Central Bank, which may impose a financial penalty on a financial institution for a violation of the Qatar Central Bank Law or of the regulations, decisions or instructions issued in implementation of it (Law No. 13 of 2012, Article 216).
What this law does
The Insurance Sector Cyber Security Regulation is addressed to the insurance sector in Qatar, which it says is required to comply with its requirements. An insurance company must establish an Incident Management Framework and an Incident Management Policy and procedures to protect, detect, evaluate and respond to cyber incidents. Critical incidents must be reported immediately to QCB or within 1 hour of identification of the incident.
An insurance company must test its predetermined escalation and response plan for security incidents on an annual basis. Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.
The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.
When LexLint raises it
When your app profile says your app is an insurer.