RwandaRegulation on Cyber Security in Regulated Institutions, Notification and Reporting of Cyber Incidents
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every regulated institution, meaning any financial institution licensed and supervised by the National Bank of Rwanda, unless a specific regulation or directive provides otherwise (reached by declaring that you provide financial services). Regulation N° 50/2022 came into force on , and article 26 gave an institution that did not comply one year from its publication to comply.
- Notify the National Bank of Rwanda as promptly as possible, and within two hours of the occurrence of the incident or of a determination that a cyber security incident has occurred, where the incident may disrupt you from continuing your normal operations for customer-facing transactions or has a reasonable likelihood of materially harming any material part of your normal operations (article 21).
- Submit the full incident report to the National Bank of Rwanda within 24 hours of the occurrence of the incident, in the format of Appendix 1 to the Regulation (article 21).
- Follow any specific incident reporting requirement the National Bank of Rwanda provides in a Directive (article 21).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Bank of Rwanda, as the Supervisory Authority, which may apply any sanctions available under the relevant provisions of the relevant specific regulations when a regulated institution fails to satisfy a requirement of the Regulation.
Settledness
- As of
- Open questions
- Has the National Bank of Rwanda issued a Directive under article 21 that sets further incident reporting requirements, and does it change the two-hour and 24-hour clocks?
- Which sanctions do the specific regulations of the National Bank of Rwanda make available for a failure to report an incident, given that article 25 refers to them without naming them?
What this law does
Article 2 applies the Regulation to all regulated institutions unless specific regulations or directives provide otherwise. Article 3 defines a regulated institution as any financial institution licensed and supervised by the Supervisory Authority.
Article 3 defines a cyber incident as a cyber event that jeopardizes the cyber security of an information system or the information the system processes, stores or transmits, or that violates the security policies, security procedures or acceptable use policies, whether resulting from malicious activity or not.
Article 21 requires a regulated institution to notify the Supervisory Authority as promptly as possible, within a period not exceeding two hours from the occurrence of the incident or from a determination that a cyber security incident has occurred.
The two-hour notification covers a cyber security incident that may disrupt a regulated institution from continuing its normal operations for customer-facing transactions, and cyber security events that have a reasonable likelihood of materially harming any material part of the normal operations of the institution.
Article 21 also requires the regulated institution to submit the full incident report to the Supervisory Authority within 24 hours from the occurrence of the incident as per the annex to the Regulation. Article 21 allows specific reporting requirements on cyber security incidents to be provided in a Directive.
Appendix 1 sets the format of the cyber security incident report, which records the date and time of the incident, its type or nature, the physical location, the action taken, the time of resolution, the estimated or actual impact, the law enforcement authorities involved and the action taken to mitigate future incidents.
Article 25 lets the Supervisory Authority apply any sanctions available under the relevant provisions of the relevant specific regulations where a regulated institution fails to satisfy any of the requirements of the Regulation. The Regulation came into force on its publication in the Official Gazette (article 29). The Regulation was published in the Official Gazette special issue of .
When LexLint raises it
When your app profile says your app provides financial services.