EswatiniCBE Cybersecurity Guidelines for Financial Institutions No. 1 of 2021: Cyber Resilience Framework
CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021, paras. 1.3, 3 to 9 and 11
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a financial institution regulated and licensed by the Central Bank of Eswatini under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 or the National Clearing and Settlement Systems Act, 2011, which the Guidelines expect to implement them within 12 months of their publication (paragraph 1.3.1; reached by declaring that you provide financial services).
- Have a cyber resilience framework that states how the institution determines its cyber resilience objectives and cyber risk tolerance and how it identifies, mitigates and manages its cyber risks; the Guidelines say the institution should, with board endorsement and periodic review (paragraph 3.2.1).
- Identify business functions and supporting processes, classify them by criticality and maintain a current inventory of information assets and system configurations; the Guidelines say the institution should (paragraphs 4.2.1 and 4.2.2).
- Implement protective controls in line with leading-practice cyber resilience standards, proportionate to the threat landscape and systemic role in the financial system; the Guidelines say the institution should (paragraph 5.2.1).
- Establish capabilities to continuously monitor and detect anomalous activities and events; the Guidelines say the institution should (paragraph 6.2.1).
- Design and test systems and processes to enable the safe resumption of critical operations within two hours of a disruption; the Guidelines say the institution should (paragraph 7.2.2).
- Establish a comprehensive testing programme to validate the effectiveness of the cyber resilience framework on a regular and frequent basis; the Guidelines say the institution should (paragraph 8.2.1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Eswatini, which monitors compliance with the Guidelines and, under section 11, pursues corrective actions and penalties under its governing Acts where an institution fails to comply in a flagrant manner that results or threatens to result in an unsafe or unsound operating condition.
Settledness
- As of
- Open questions
- Is a failure to follow a paragraph of the Guidelines that is worded as 'should' sanctionable on its own, or only through the flagrant non-compliance route in section 11?
What this law does
The Guidelines came into force on . Paragraph 1.1.2 says the Guidelines were issued by the Central Bank in exercise of powers conferred by sections 4(f), 4(g) and 42(b) of the Central Bank of Swaziland Order, 1974. Paragraph 1.3.1 says all financial institutions regulated and licensed by the Central Bank under the Acts it names are expected to implement the Guidelines within 12 months of their publication.
Section 11 says that where a financial institution fails to comply in a flagrant manner that results or threatens to result in an unsafe or unsound operating condition, the Central Bank will pursue corrective actions and penalties provided under the Acts it names.
When LexLint raises it
When your app profile says your app provides financial services.