IA of Hong Kong published the guideline GL20 on cyber-security for authorized insurers. The guideline sets the minimum standard for cyber-security that authorized insurers are expected to have in place and the general guiding principles which the IA uses in assessing the effectiveness of the cyber-security framework of an insurer. The guideline applies to all authorized insurers, except for captive insurers and marine mutual insurers, in relation to the insurance business they conduct in, or from, Hong Kong. GL20 shall take effect on January 01, 2020.
Cyber risk is one of the most significant operational risks that insurers face, particularly with regard to the business operations they conduct digitally and online. Cyber-security incidents can result in financial loss, business disruption, damage to reputation, and other adverse consequences to an insurer. Accordingly, this guideline requires authorized insurers to put in place resilient cyber-security frameworks to protect their business data and the personal data of their existing or potential policyholders and to ensure continuity of their business operations. The guideline stipulates that authorized insurers should establish and maintain a cyber-security strategy and framework tailored to mitigate relevant cyber risks that are commensurate with the nature, size, and complexity of their business. The cyber-security strategy and framework should be endorsed by the Board of the insurer. Insurers should also develop a cyber-security incident response plan, which covers scenarios of cyber-security incidents and corresponding contingency strategies to maintain and restore critical functions and essential activities in such scenarios.
Keywords: Asia Pacific, Hong Kong, Insurance, Cyber Risk, Guideline, Cyber Guidance, IA
Previous ArticleFDIC Proposes to Rescind and Remove Regulatory Reporting Standards
The European Commission (EC) published the Delegated Regulation 2021/1527 with regard to the regulatory technical standards for the contractual recognition of write down and conversion powers.
The Australian Prudential Regulation Authority (APRA) published a new set of frequently asked questions (FAQs) to provide guidance to authorized deposit-taking institutions on the interpretation of APS 120, the prudential standard on securitization.
The Single Resolution Board (SRB) published a Communication on the application of regulatory technical standard provisions on prior permission for reducing eligible liabilities instruments as of January 01, 2022.
The Australian Prudential Regulation Authority (APRA) published a new set of frequently asked questions (FAQs) to clarify the regulatory capital treatment of investments in the overseas deposit-taking and insurance subsidiaries.
The European Banking Authority (EBA) published the final report on the guidelines specifying the criteria to assess the exceptional cases when institutions exceed the large exposure limits and the time and measures needed for institutions to return to compliance.
The Prudential Regulation Authority (PRA) issued the policy statement PS20/21, which contains final rules for the application of existing consolidated prudential requirements to financial holding companies and mixed financial holding companies.
The European Banking Authority (EBA) revised the guidelines on stress tests to be conducted by the national deposit guarantee schemes under the Deposit Guarantee Schemes Directive (DGSD).
The European Commission (EC) announced that Nordea Bank has signed a guarantee agreement with the European Investment Bank (EIB) Group to support the sustainable transformation of businesses in the Nordics.
The Hong Kong Monetary Authority (HKMA) issued a circular, for all authorized institutions, to confirm its support of an information note that sets out various options available in the loan market for replacing USD LIBOR with the Secured Overnight Financing Rate (SOFR).
The Office of the Comptroller of the Currency (OCC) issued a new "Problem Bank Supervision" booklet of the Comptroller's Handbook. The booklet covers information on timely identification and rehabilitation of problem banks and their advanced supervision, enforcement, and resolution when conditions warrant.