Mandates cybersecurity governance, a CISO function, risk assessment, incident reporting and resilience standards. Later extended to OFIs (2022).
DMBs, payment service providers and (from 2022) OFIs.
