Guideline 2017 status not recorded
Guidance Note on Cybersecurity for the Banking Sector (Central Bank of Kenya, August 2017)
Issued by Central Bank of Kenya
Plain-English summary
Issued under section 33(4) of the Banking Act to all institutions licensed under the Banking Act. Sets board governance duties, a CISO reporting line, third-party and outsourcing risk controls (section 3.3), notification to the CBK within 24 hours of a significant incident and quarterly incident reports.
Who it applies to
Banking
Topics
Cybersecurity & IT Risk Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Cyber incident reporting by banks to the CBK | Deadline Within 24 hours of the incident; quarterly report by the 10th day after quarter end | CBK | official | |
Part IV(b) requires institutions to notify the CBK of any incident that could significantly affect service provision, reputation or financial condition, using the Annex II format, and Part IV(c) requires a quarterly incident report in the Annex III format. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.