SamoaCommercial Banks Prudential Statements, Prudential Statement 11 on cybersecurity incident reporting
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every entity licensed under the Financial Institutions Act 1996, that is a bank, a securities broker or a securities dealer (Applicability), and is reached by declaring that you provide financial services.
- Notify the Central Bank of Samoa as soon as possible and not later than sixty minutes after becoming aware of an information security incident that materially affects, or has the potential to materially affect, the institution or the interests of depositors, financially or non-financially (paragraph 106).
- Report all cybersecurity incidents to the Central Bank of Samoa each quarter, in the format of Form QCR in Appendix 1 (paragraph 105).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Samoa, which may issue a directive to a licensed financial institution that is following unsound or unsafe practices to cease and desist from them and to take the action the directive specifies to correct them (section 13 of the Financial Institutions Act 1996).
Settledness
- As of
- Open questions
- Does the Central Bank of Samoa treat a failure to notify it within sixty minutes as an unsound or unsafe practice under section 13 of the Financial Institutions Act 1996?
What this law does
Paragraph 105 of Prudential Statement 11 requires a licensed financial institution to provide quarterly reporting on all cybersecurity incidents in the format prescribed in Appendix 1.
Paragraph 106 of Prudential Statement 11 requires a licensed financial institution to notify the Central Bank as soon as possible but not later than sixty minutes after becoming aware of an information security incident that materially affects or has the potential to materially affect the institution or the interests of depositors.
Paragraph 107 of Prudential Statement 11 provides that non-compliance with it is subject to corrective actions as provided by the Central Bank and the administrative penalties outlined in the Financial Institutions Act 1996. Section 3(3) of the Financial Institutions Act 1996 provides that non-compliance with the prudential statements and guidelines may lead the Central Bank to conclude that an institution is following unsound or unsafe practices.
When LexLint raises it
When your app profile says your app provides financial services.