TongaPrudential Banking Standard No. 15, Cybersecurity risk management for banks
Prudential Banking Standard No. 15 - 2021, Cybersecurity, paras. 1-3, 99-103 and 107
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a bank licensed under the Banking Act 2020 (paragraph 108), and is reached by declaring that you are a bank.
- Keep a framework for cybersecurity risk management that is an integral part of your enterprise risk management framework, document it, have the Board approve it and review it regularly (paragraphs 1 and 2).
- Maintain a designated cybersecurity risk management function with independent reporting lines, headed by a Chief Information Security Officer or an equivalent senior officer (paragraph 3).
- Develop and document an enterprise wide cybersecurity risk strategy approved by the Board (paragraph 5).
- Have in place a cybersecurity policy framework commensurate with your exposures to vulnerabilities and threats, covering policies and procedures for cybersecurity risk identification, measurement, monitoring and control (paragraph 8).
- Have a cybersecurity incident management process governed by documented policy and procedures, with the objective of restoring normal service as quickly as possible (paragraphs 99 and 100).
- Conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production (paragraph 103).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Reserve Bank of Tonga, which may issue written warnings, enter into a written agreement with a bank's board on a programme of remedial action, and issue written orders to cease and desist from an infraction, where a bank contravenes a prudential banking standard (section 39 of the Banking Act 2020).
Settledness
- As of
- Open questions
- Does the Standard's reference to section 20(3) of the Banking Act 2020 refer to the power to issue prudential banking standards that the Act's text states in section 19(3)?
- What currency does the daily penalty of up to $1,000 in section 39(2) of the Banking Act 2020 denote, given that the Act does not define the dollar sign?
What this law does
Paragraph 108 of Prudential Banking Standard No. 15 applies it to banks licensed under the Banking Act 2020 and makes it effective from . Paragraph 1 of Prudential Banking Standard No. 15 requires a bank to have a framework for cybersecurity risk management, which should be an integral part of its enterprise risk management framework. Paragraph 2 of Prudential Banking Standard No. 15 requires the framework to be documented and approved by the Board and reviewed regularly.
Paragraph 3 of Prudential Banking Standard No. 15 requires a bank to have a designated cybersecurity risk management function. Paragraph 3(e) of Prudential Banking Standard No. 15 requires the function to be headed by a person designated as the Chief Information Security Officer or an equivalent senior officer. Paragraph 5 of Prudential Banking Standard No. 15 requires a bank to develop and document an enterprise wide cybersecurity risk strategy approved by the Board.
Paragraph 8 of Prudential Banking Standard No. 15 requires a bank to have in place a cybersecurity policy framework commensurate with its exposures to vulnerabilities and threats. Paragraph 103(a) of Prudential Banking Standard No. 15 requires a bank to conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production.
Paragraph 99 of Prudential Banking Standard No. 15 requires a bank to have a cybersecurity incident management process governed by documented policy and procedures. Paragraph 107 of Prudential Banking Standard No. 15 provides that non-compliance with it is subject to corrective actions as provided under section 39 of the Banking Act 2020. Prudential Banking Standard No. 15 states that it is issued under section 20(3) of the Banking Act 2020.
Section 19(3) of the Banking Act 2020 allows the Reserve Bank to issue in writing prudential banking standards. Section 39(1)(a) of the Banking Act 2020 allows the Reserve Bank to impose the measures in that section where a bank contravenes a prudential banking standard.
Section 39(3) of the Banking Act 2020 allows the Reserve Bank to issue written warnings, enter into a written agreement with the board of directors of the bank providing for a program of remedial action, and issue written orders to cease and desist.
When LexLint raises it
When your app profile says your app is a bank.