Sierra LeoneBank of Sierra Leone Cyber Security and IT Risk Management Guidelines for Commercial Banks: Cyber Security Incident and Threat Reporting
Cyber Security and IT Risk Management Guidelines for Commercial Banks (Government Notice 429 of 2021) secs. 2.1, 7.0 and 9.0 (incident reporting)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2022. Publisher's page: https://bsl.gov.sl/Cyber%20Security.pdfIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This reaches you where you are a commercial bank licensed by the Bank of Sierra Leone under section 8 of the Banking Act 2019 (sec. 1.4) (reached by declaring that you are a bank).
- Inform the Bank of Sierra Leone within 24 hours of any cyber security incident, in the format set out in Appendix II to the Guidelines (sec. 9.0(4)).
- Provide the Bank of Sierra Leone, on a quarterly basis, a report in the format of Appendix III concerning occurrences of cyber security incidents and your handling of them (sec. 9.0(5)).
- Promptly report all impending and challenging cyber-threats to your information assets to the Director, Banking Supervision Department, Bank of Sierra Leone (sec. 7.0).
- Have your Board report in a timely manner to the Bank of Sierra Leone any serious incident relating to information systems or any unexpected event, and respond to it quickly in accordance with the contingency plan (sec. 2.1(17)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Bank of Sierra Leone
Settledness
- As of
- Open questions
- Does the 180-day compliance period in section 1.7 of the Guidelines postpone the 24-hour incident notification in section 9.0(4) for a commercial bank within that period?
What this law does
Section 9.0 requires commercial banks to inform the Bank of Sierra Leone within 24 hours of any cyber security incident in the format set out as Appendix II. Section 9.0 requires commercial banks to provide the Bank of Sierra Leone each quarter a report in the format of Appendix III concerning occurrences and the handling of cyber security incidents.
Section 7.0 requires commercial banks to promptly report all impending and challenging cyber-threats to their information assets to the Director of the Banking Supervision Department. Section 2.1 makes the Board responsible for reporting in a timely manner to the Bank of Sierra Leone any serious incident relating to information systems or any unexpected event.
When LexLint raises it
When your app profile says your app is a bank.