Guideline 2021
CBE Guidelines on Cybersecurity for Financial Institutions No. 1 of 2021
Effective: 1 Mar 2021
Plain-English summary
Issued in January 2021. Applies to institutions licensed by the Central Bank under the Financial Institutions Act, 2005, the Exchange Control Order, 1974 and the National Clearing and Settlement Systems Act, 2011. Makes the board responsible for the cyber resilience framework, requires outsourced services to receive the same cyber resilience as in-house ones (s. 5.3.1) and sets incident reporting to the Central Bank (s. 7.5.1).
Who it applies to
Banking · Payments & Fintech
Topics
Cybersecurity & IT Risk Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Cyber incident reporting to the Central Bank | Deadline Within 2 hours of verifying the incident; report by the 4th working day | — | official | |
Section 7.5.1 of the guidelines requires a regulated institution to notify the Central Bank within two hours of verifying a successful cyber attack, followed by a report no later than the fourth working day after detection (s. 7.5.2) once the incident is contained. Section 5.3.1 also requires outsourced services to meet the same resilience standard. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.