KosovoCentral Bank Regulation on Information Systems and Cyber Risk Management, Security Programme
Rregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This duty binds every financial institution licensed or supervised by the Central Bank of the Republic of Kosovo, other than a non-bank financial institution that carries out only foreign exchange activities and an insurance intermediary (reached by declaring that you provide financial services in Kosovo). Obligations scale with each institution's size, risk profile and complexity, but every bank must meet them all, and institutions must comply from .
- Keep a governance and internal control framework for ICT and cyber risk, have your board of directors approve every information systems policy (ICT, information security and cyber), and assess and review the policies each year (governance and organisation article).
- Designate a person or unit responsible for information security that is independent of other units and reports to the chief executive, and appoint a chief information and technology officer and a chief information security officer with the expertise needed; tell the BQK 30 days before each appointment, and the BQK may object (governance and organisation article, paragraphs 7 and 8). An institution that under the proportionality article decides not to appoint these roles must still secure sufficient expertise, experience and independence.
- Establish a risk management framework that assigns an owner to each identified technology risk and runs a repeated cycle of risk assessment, treatment and monitoring, and review it regularly (risk management framework article).
- Run a process for regular vulnerability scanning and address the risks found without delay; carry out penetration tests of external digital services at least once a year if you are a bank and at least every two years if you are another financial institution, and after any major system change (vulnerability scanning and penetration testing articles).
- Review, update and test your business continuity and disaster recovery plans at least once a year or after significant changes to ICT systems or business processes (business continuity and disaster recovery article).
- Have the internal audit function audit IT, cybersecurity controls, governance, compliance and outsourcing, on an annual audit plan your board approves, and report high-risk findings to the board without undue delay (audit article).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of the Republic of Kosovo (BQK), which licenses or supervises the financial institutions the Regulation covers; a breach is subject to corrective measures, administrative penalties and monetary penalties under the Central Bank Law and the sector laws the Regulation lists.
Settledness
- As of
- Open questions
- Which institutions fall within the bank category of Article 3(1) and so owe annual penetration tests, and which owe the two-year cycle as other financial institutions?
What this law does
The Regulation on Information Systems and Cyber Risk Management applies to all financial institutions licensed or supervised by the Central Bank of the Republic of Kosovo. The Regulation does not apply to non-bank financial institutions that carry out only foreign exchange activities, or to insurance intermediaries.
A financial institution's board of directors must approve all policies on information systems, including ICT, information security and cyber policies, and assess and review them every year. A financial institution must appoint a chief information and technology officer and a chief information security officer, and inform the Central Bank 30 days in advance. A financial institution must establish a framework for managing ICT and cyber risks.
A financial institution must set up a process for regular vulnerability scanning. A bank must carry out penetration tests of its external digital services at least once a year, and every other financial institution at least every two years. Business continuity and disaster recovery plans must be reviewed, updated and tested at least once a year. The internal audit function must audit IT, cybersecurity controls, governance, compliance and outsourcing processes.
Any breach of the Regulation is subject to corrective measures, administrative penalties and monetary penalties. The Regulation entered into force on and requires financial institutions to comply from . The Board of the Central Bank of the Republic of Kosovo adopted the Regulation at its meeting of .
When LexLint raises it
When your app profile says your app provides financial services.