Circular on Cyber Incident Reporting for Microfinance Companies

In the name of Allah, the Most Gracious, the Most Merciful

Central Bank of Jordan

Reference: 1/28/1633 Date: 13/6/1442 AH Corresponding to: 25/1/2021 AD

Circular to Microfinance Companies Operating in the Kingdom

Greetings,

With reference to the Cyber Risk Adaptation Instructions No. (26/1/1984) dated 6/2/2018 and in accordance with the provisions of Article (49) of these Instructions, we emphasize the necessity of notifying the Central Bank of Jordan upon discovering any cyber incident or any attempt at a cyber attack—whether successful or repelled. We inform you of the requirement to provide us with details of the cyber incidents, their impacts, response measures, and preventive measures taken, according to the attached form, by sending it to the email address below:

MFISCB.Supervision@cbj.gov.jo

In this context, you will find attached the "Guide for Filling Out the Cyber Incident Notification Form" as a guidance document for completing the required data in that form.

Please accept our highest regards,

The Authorized Signatory Dr. Ziad Freiz

P.O. Box 37, Amman 11118, Jordan • Phone: 4630301 • Fax: 4638889 • Website: www.cbj.gov.jo • Email: info@cbj.gov.jo

---

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Cyber Incident Notification Form

Company Name
Time and Date of Incident Occurrence	Time and Date of Incident Discovery

Contact Person Information
Contact Person Name
Phone Number
Mobile Number

Incident Details
Incident Type
Infrastructure Components Affected by the Incident
Incident Location
Incident Severity Classification
Causes Leading to the Incident
Has this incident occurred before? (Yes or No)
Department or Entity Responsible for Incident Management

Incident Impact Assessment
Impact of the Incident on Company Operations Regarding Service Availability
Channels Affected by the Incident
Impact of the Incident on Company Systems and Technologies (Disruption of critical systems, disruption in any infrastructure components)
Impact of the Incident on the Company's Information System (Confidentiality, Integrity, and Availability)
Impact of the Incident on the Company's Financial Status and Market Position
Impact of the Incident on Stakeholders such as (Company Clients, Partners, ...)

Response and Recovery Measures
Incident Response Measures
Corrective Measures for the Incident Cause
Preventive Measures
Incident Status (Closed, In Progress)

Form (1/1/09)

---

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Guide for Filling Out Cyber Incident Notification Form

Form (1/1/09)

---

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Time and Date of Incident Occurrence	:	The time and date when the incident occurred, in the format (minute : hour, day/month/year)
Time and Date of Incident Discovery	:	The time and date when the incident was discovered, in the format (minute : hour, day/month/year)
Time and Date of Incident Correction	:	The time and date when the problem was corrected or expected to be corrected, in the format (minute : hour, day/month/year)

Contact Person Information
Contact Person Name	:
Phone Number	:
Mobile Number	:

Incident Details
Incident Type	:
Infrastructure Components Affected by the Incident	:

Form (1/1/09)

---

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Incident Location	:	The physical location affected by the incident (Main Site, DR Site, HA Site)
Incident Severity Classification	:	Incident severity classification (Crisis, Major, Minor, Negligible)
Causes Leading to the Incident	:	State the cause of the incident if known by the company, for example (Unpatched Operating Systems, ......)
Has this incident occurred before?	:	Answer Yes or No regarding the recurrence of the incident
Department or Entity Responsible for Incident Management	:	The department, entity, or third party responsible for monitoring and resolving the incident, including but not limited to (IT Department, Information Security Department....)

Incident Impact Assessment
Impact of the Incident on Company Operations Regarding Service Availability	:
Channels Affected by the Incident	:
Impact of the Incident on Company Systems and Technologies (Disruption of critical systems, disruption in any infrastructure components)	:

Form (1/1/09)

---

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Impact of the Incident on the Company's Information System (Confidentiality, Integrity, and Availability)	:	Was the company's information system affected by the cyber incident in terms of Confidentiality, Integrity, and Availability? And to what extent?
Impact of the Incident on the Company's Financial Status and Market Position	:	The extent of the company's impact from the incident financially, reputationally, and in terms of market presence
Impact of the Incident on Stakeholders such as (Company Clients, Partners, ...)	:	The extent of the impact on stakeholders (Stakeholders), including but not limited to (Customers, Service providers, Business partners, .....)

Response and Recovery Measures
Incident Response Measures	:
Corrective Measures for the Incident Cause	:
Preventive Measures	:
Incident Status (Closed, In Progress)	:

Form (1/1/09)