SeychellesSeychelles Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024: Reporting of Cyber Security Risk
Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, reg. 7
In force.
A vulnerability and incident reporting rule binding private bodies.
- Enforcement body
- The Authority named in the Regulations, to which the notification is made.
- Obligation class
- Reporting, Security
As of .
What it requires
- This reaches your organization only if it is a licensee under the Virtual Asset Service Providers Act, 2024 (Act 12 of 2024): the Regulations apply to all licensees (reg. 3) (reached by declaring that you are a crypto-asset provider).
- Notify the Authority within 24 hours of any attempt, where you discover a cyber security risk as a result of a cyber security event, meaning any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information on them (reg. 7(1)).
- For a successful attempt, provide the Authority a report within 5 working days on whether the event affects or has affected the services or network and information systems that support your critical or important functions, the services you are authorized to provide, and whether it is or was malicious and unauthorized access to your network and information systems (reg. 7(2)).
- Include in that report the remedial actions to mitigate cyber security risk and prevent future cyber security events (reg. 7(3)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Regulation 7(1) requires a licensee that discovers a cyber security risk as a result of a cyber security event to notify the Authority of any attempt within 24 hours. Regulation 7(2) requires a licensee to provide a report within 5 working days for any successful attempt. Regulation 7(3) requires the report to include the remedial actions to mitigate cyber security risk and prevent a future cyber security event.
Regulation 2 defines a cyber security event as any act or attempt, successful or unsuccessful, to gain unauthorized access to disrupt, or misuse the electronic systems or information stored on such systems.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.