Sierra LeoneBank of Sierra Leone Cyber Security and IT Risk Management Guidelines for Commercial Banks: Governance, Controls, Defense and Response
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2022. Publisher's page: https://bsl.gov.sl/Cyber%20Security.pdfIn force since .
A sector security regimes rule binding private bodies.
- Enforcement body
- Bank of Sierra Leone
- Obligation class
- Security, Governance
As of .
What it requires
- This reaches you where you are a commercial bank licensed by the Bank of Sierra Leone under section 8 of the Banking Act 2019 (sec. 1.4) (reached by declaring that you are a bank).
- Recruit or appoint a Chief Information Security Officer who reports to the Board and copies the CEO, establish a Cyber and Information Systems Security function headed by that officer, and establish a Cyber and Information Security Steering Committee chaired by the officer (sec. 1.6).
- Have your Board approve a cyber and information security strategy and a framework of policies, standards and procedures, with the cyber security policy and strategy kept separate from the broader IT policy and strategy (secs. 1.6, 3.1 and 3.2).
- Institute controls that include malware protection, the capacity to employ encryption technologies for confidential information in the information systems and in transmission, configuration of firewalls, routers and network segmentation, and logical access controls limited to authorized individuals (sec. 4.0).
- Continuously monitor the network and information systems to detect anomalies and potential cyber security incidents, covering security information and event management, security cameras and intrusion detection including vulnerability assessment and penetration testing (sec. 5.0).
- Implement an incident response management programme with an incident response management plan and business and disaster continuity management, and keep a cyber-crisis management plan (secs. 1.6 and 6.0).
- Institute a cyber-threat intelligence program with a Board-approved policy, and establish a cyber-security information sharing and collaboration platform for sharing within the bank and among banks, regulators and external parties (secs. 7.0 and 8.0).
- Comply within 180 days of the effective date of the Guidelines, and file your cyber security and IT risk management policies, strategies and frameworks with the Bank of Sierra Leone (secs. 1.7 and 9.0).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Guidelines require all commercial banks licensed by the Bank of Sierra Leone to comply with them. The Guidelines are developed in accordance with section 53(1) of the Banking Act 2019, which empowers the Bank of Sierra Leone to issue directives and guidelines. Noncompliance with the Guidelines attracts the appropriate penalties and sanctions from the Bank of Sierra Leone. Section 1.7 gives commercial banks 180 days from the effective date of the Guidelines to comply.
Section 5.0 requires commercial banks to continuously monitor the network and information systems to detect anomalies and potential cyber security incidents. The Guidelines come into effect on the day they are published in the Gazette. The Sierra Leone Gazette (Extraordinary) that publishes the Guidelines is dated Friday, .
When LexLint raises it
When your app profile says your app is a bank.