SamoaCommercial Banks Prudential Statements, Prudential Statement 11 on cybersecurity risk management
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every entity licensed under the Financial Institutions Act 1996, that is a bank, a securities broker or a securities dealer (Applicability), and is reached by declaring that you provide financial services.
- Keep a framework for cybersecurity risk management that is an integral part of your enterprise risk management framework, document it, have the Board approve it and review it regularly (paragraphs 1 and 2).
- Maintain a designated cybersecurity risk management function with independent reporting lines, headed by a Chief Information Security Officer or an equivalent senior officer (paragraph 3).
- Develop and document an enterprise wide cybersecurity risk strategy approved by the Board (paragraph 5).
- Have in place a cybersecurity policy framework commensurate with your exposures to vulnerabilities and threats, covering policies and procedures for cybersecurity risk identification, measurement, monitoring and control (paragraph 8).
- Have a cybersecurity incident management process governed by documented policy and procedures, with the objective of restoring normal service as quickly as possible (paragraphs 99 and 100).
- Conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production (paragraph 103).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Samoa, which may issue a directive to a licensed financial institution that is following unsound or unsafe practices to cease and desist from them and to take the action the directive specifies to correct them (section 13 of the Financial Institutions Act 1996).
Settledness
- As of
- Open questions
- Does Prudential Statement 11 bind a securities broker or securities dealer in full, given that Prudential Statement 1 defines a Financial Institution as a bank entity licensed under the Financial Institutions Act 1996?
- Does the Central Bank of Samoa treat non-compliance with Prudential Statement 11 as an unsound or unsafe practice under section 13 of the Financial Institutions Act 1996?
What this law does
Prudential Statement 11 applies to all entities licensed under the Financial Institutions Act 1996. Paragraph 1 of Prudential Statement 11 requires a licensed financial institution to have a framework for cybersecurity risk management, which should be an integral part of its enterprise risk management framework. Paragraph 2 of Prudential Statement 11 requires the framework to be documented and approved by the Board and reviewed regularly.
Paragraph 3 of Prudential Statement 11 requires a licensed financial institution to have a designated cybersecurity risk management function. Paragraph 3(e) of Prudential Statement 11 requires the function to be headed by a person designated as the Chief Information Security Officer or an equivalent senior officer. Paragraph 5 of Prudential Statement 11 requires a licensed financial institution to develop and document an enterprise wide cybersecurity risk strategy approved by the Board.
Paragraph 8 of Prudential Statement 11 requires a licensed financial institution to have in place a cybersecurity policy framework commensurate with its exposures to vulnerabilities and threats. Paragraph 103(a) of Prudential Statement 11 requires a licensed financial institution to conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production.
Paragraph 99 of Prudential Statement 11 requires a licensed financial institution to have a cybersecurity incident management process governed by documented policy and procedures. Paragraph 107 of Prudential Statement 11 provides that non-compliance with it is subject to corrective actions as provided by the Central Bank and the administrative penalties outlined in the Financial Institutions Act 1996.
Prudential Statement 1 of the Commercial Banks Prudential Statements states that it is made under section 3(2) of the Financial Institutions Act 1996. Section 3(2) of the Financial Institutions Act 1996 allows the Central Bank to issue in writing prudential statements and guidelines in connection with the implementation of provisions of the Act.
Section 3(3) of the Financial Institutions Act 1996 provides that non-compliance with the prudential statements and guidelines may lead the Central Bank to conclude that an institution is following unsound or unsafe practices. Section 13 of the Financial Institutions Act 1996 allows the Central Bank to issue a directive to a licensed financial institution it finds to be following unsound or unsafe practices.
When LexLint raises it
When your app profile says your app provides financial services.