KosovoCentral Bank Regulation on Information Systems and Cyber Risk Management, Incident Reporting
Rregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik, Neni 31
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This duty binds every financial institution licensed or supervised by the Central Bank of the Republic of Kosovo, other than a non-bank financial institution that carries out only foreign exchange activities and an insurance intermediary (reached by declaring that you provide financial services in Kosovo). Obligations scale with each institution's size, risk profile and complexity, but every bank must meet them all, and institutions must comply from .
- Notify and report each incident to the BQK no later than 4 hours after you discover it; the initial report or notification gives information on the significant threat and the affected systems (incident management article, paragraph 10; Annex 1).
- Telephone the BQK officials immediately, while the report is being prepared, and have your chief information security officer sign the written report (Annex 1, notes c and d).
- Submit an interim report within 72 hours (Annex 1, note a, counts the 72 hours from the occurrence of the incident) and the final report within 30 days, using the models in Annexes 1 and 2, and provide updates whenever there is a development until the closing report is submitted (incident management article, paragraph 10; Annex 1, note a).
- Report cyber incidents and technological failures to the relevant regulatory authorities as the incident management article provides (incident reporting article).
- Report immediately any incident that involves a malfunction, breach or adverse result of an artificial intelligence system you use (artificial intelligence article, paragraph 11).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of the Republic of Kosovo (BQK), which licenses or supervises the financial institutions the Regulation covers; a breach is subject to corrective measures, administrative penalties and monetary penalties under the Central Bank Law and the sector laws the Regulation lists.
Settledness
- As of
- Open questions
- Does the four-hour clock run from the discovery of every incident, or only of one that is a significant threat, given that the initial report is to describe the significant threat?
- The Regulation lets the BQK replace the Annex report models by a separate instruction; has it done so?
What this law does
The Regulation on Information Systems and Cyber Risk Management applies to all financial institutions licensed or supervised by the Central Bank of the Republic of Kosovo. A financial institution must notify and report an incident to the Central Bank no later than four hours after discovering it. The initial report or notification must give information on the significant threat and the affected systems. An interim report must be submitted within 72 hours and the final report within 30 days.
Cyber incidents and technological failures must be reported to the relevant regulatory authorities under the incident management article. A financial institution must report immediately incidents involving malfunctions, breaches or adverse results of artificial intelligence. Annex 1 requires the report to be preceded by an immediate telephone conversation with BQK officials. Any breach of the Regulation is subject to corrective measures, administrative penalties and monetary penalties. The Regulation entered into force on and requires financial institutions to comply from .
When LexLint raises it
When your app profile says your app provides financial services.