RwandaRegulation on Cyber Security in Regulated Institutions, Cyber Security Programme
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds every regulated institution, meaning any financial institution licensed and supervised by the National Bank of Rwanda, unless a specific regulation or directive provides otherwise (reached by declaring that you provide financial services). Regulation N° 50/2022 came into force on , and article 26 gave an institution that did not comply one year from its publication to comply.
- Make the Board of Directors and Senior Management responsible for cyber security governance, with a governance framework that includes a cyber security strategy linked with business objectives, a governing security programme, metrics and monitoring processes and crisis management practices (article 4).
- Keep an IT security function with qualified staff and an IT Steering Committee that meets at least quarterly, unless a specific regulation or directive provides otherwise (articles 6 and 7).
- Implement and maintain a written cyber security policy approved by the board and based on your risk assessment, covering at least the areas article 9 lists, including cyber incident management and vendor and service provider management (article 9).
- Conduct at least annual penetration tests and bi-annual vulnerability assessments, using assessors who hold one of the qualifications article 10 lists, and share an executive summary of the findings with the National Bank of Rwanda within fifteen days after the test (article 10).
- Use risk-based multi-factor authentication, required for any individual accessing your internal networks from an external network unless the head of the IT security function has approved in writing an equivalent or more secure access control (article 16).
- Protect non-public data held or transmitted by you, in transit over external networks and at rest, with controls including encryption (article 19).
- Establish a written incident response and business continuity management plan (article 20).
- Assess the cyber security of your service providers, run a security awareness programme for the board, staff and third parties, and keep a data retention policy for non-public data (articles 14, 17 and 18).
- Submit to the National Bank of Rwanda, not later than 15 January each year, a written statement of self-assessment certifying that your cyber security strategy complies with the Regulation (article 22).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Bank of Rwanda, as the Supervisory Authority, which may apply any sanctions available under the relevant provisions of the relevant specific regulations when a regulated institution fails to satisfy a requirement of the Regulation.
Settledness
- As of
- Open questions
- Which sanctions do the specific regulations of the National Bank of Rwanda make available for a failure to meet a requirement of this Regulation, given that article 25 refers to them without naming them?
- Has the National Bank of Rwanda issued a directive under articles 21 and 24 that adds to or tailors these requirements for a class of regulated institution?
What this law does
The National Bank of Rwanda, called the Supervisory Authority in the text, issues the Regulation. Article 2 applies the Regulation to all regulated institutions unless specific regulations or directives provide otherwise. Article 3 defines a regulated institution as any financial institution licensed and supervised by the Supervisory Authority. Article 4 makes cyber security governance the responsibility of the Board of Directors and Senior Management.
Article 9 requires a regulated institution to implement and maintain a written cyber security policy that is approved by the board and based on its risk assessment. Article 10 requires a regulated institution to conduct at least annual penetration tests and bi-annual vulnerability assessments. Article 10 also requires the regulated institution to share with the Supervisory Authority an executive summary of the findings of the test within fifteen days after the test.
Article 16 requires multi-factor authentication for any individual accessing the regulated institution’s internal networks from an external network, unless the head of the IT security function or relevant staff has approved in writing the use of reasonably equivalent or more secure access controls. Article 19 requires a regulated institution to implement controls, including encryption, to protect data held or transmitted by it both in transit over external networks and at rest.
Article 20 requires a regulated institution to establish a written incident response management plan designed to promptly respond to, contain and recover from disruptions caused by any cyber incident materially affecting the confidentiality, integrity or availability of its information systems.
Article 22 requires a regulated institution to submit to the Supervisory Authority every year, not later than 15 January, a written statement of self-assessment certifying that its cyber security strategy complies with the Regulation. Article 25 lets the Supervisory Authority apply any sanctions available under the relevant provisions of the relevant specific regulations where a regulated institution fails to satisfy any of the requirements of the Regulation.
Article 26 gave regulated institutions that did not comply with the Regulation one year from its publication in the Official Gazette to comply. The Regulation came into force on its publication in the Official Gazette (article 29). The Regulation was published in the Official Gazette special issue of .
When LexLint raises it
When your app profile says your app provides financial services.