EswatiniCBE Cybersecurity Guidelines for Financial Institutions No. 1 of 2021: Cyber Incident Notification
CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 7.5.1 and 7.5.2
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a financial institution regulated and licensed by the Central Bank of Eswatini under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 or the National Clearing and Settlement Systems Act, 2011, which the Guidelines expect to implement them within 12 months of their publication (paragraph 1.3.1; reached by declaring that you provide financial services).
- In the event of a successful cyber attack, notify the Central Bank within two hours of verifying the incident, using the incident notification form in Appendix A, and be ready to provide the updates the Bank requests; the Guidelines say the institution should (paragraph 7.5.1).
- Once you are satisfied that you have contained and recovered from the incident, submit a report to the Central Bank, expected at most on the fourth working day since the incident was detected, with the information available and a note that a full report follows if investigations are incomplete; the Guidelines say the institution shall (paragraph 7.5.2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Eswatini, which monitors compliance with the Guidelines and, under section 11, pursues corrective actions and penalties under its governing Acts where an institution fails to comply in a flagrant manner that results or threatens to result in an unsafe or unsound operating condition.
Settledness
- As of
- Open questions
- Does the two hour period in paragraph 7.5.1, worded as 'should', bind an institution to the same degree as the report in paragraph 7.5.2, worded as 'shall'?
What this law does
Paragraph 7.5.1 says that in the event of a successful cyber attack, a financial institution should notify the Central Bank within two hours of verifying the incident. Paragraph 7.5.2 says that once a financial institution is satisfied that it has contained and recovered from an incident, it shall submit a report to the Central Bank.
Section 11 says that where a financial institution fails to comply in a flagrant manner that results or threatens to result in an unsafe or unsound operating condition, the Central Bank will pursue corrective actions and penalties provided under the Acts it names.
When LexLint raises it
When your app profile says your app provides financial services.