Cybersecurity Obligations and Incident Response

The first question a board asks after an incident is who has to be told, and by when. In Nepal the answer turns entirely on who licenses the company, and for most companies the honest answer is nobody.

The regulatory perimeter

Nepal has no cyber security act. A consolidating information technology and cyber security bill has been discussed across successive parliaments. It is not law, and its status as at August 2026 could not be verified. Nothing here should be read as describing it.

That leaves two regimes. Inside the financial perimeter, Nepal Rastra Bank supervises and its guidelines apply. Outside it, the operative instrument is the criminal law in the Electronic Transactions Act 2063, which punishes attackers and leaves defenders unregulated.

The Cyber Resilience Guidelines

Nepal Rastra Bank notified its Cyber Resilience Guidelines on 27 August 2023. They apply to A, B, C and D class banks and financial institutions and to institutions licensed by the Payment Systems Department, including payment system operators and payment service providers, and the Bank reserves the ability to extend them to designated financial market infrastructures.

They are unusually specific for a Nepali instrument, and four provisions carry most of the weight.

Governance. Clause 3 requires the board to approve the cyber resilience plan. Clause 17 makes the board ultimately responsible for ensuring cyber risk is properly managed. Clause 29 requires the institution to appoint at least one board member with cyber security expertise. That last requirement is a board composition rule, with consequences for nomination and succession, and institutions treating cyber resilience as an IT department matter overlook it more often than any other provision.

Accountability. Clause 30 requires a senior executive, such as a chief information security officer, responsible for the organisation’s cyber resilience architecture. Clause 32 sets the conditions that role must have: sufficient authority, direct access to the board, operational independence and the necessary skills. Operational independence is the substantive condition. It rules out the common arrangement in which security reports into the same head of technology whose delivery timetable it constrains.

Recovery. Clause 95 requires systems to enable safe resumption of critical operations within two hours of a disruption. That is the one testable number in the document, and it drives architecture. Backup-and-restore alone will not deliver a two-hour recovery time objective for critical services. Clause 118 requires backups at a redundant secondary system not co-located with the primary, and clause 120 requires backups to be protected at rest and in transit.

Reporting. Clause 127 requires that any cyber incident that could be material or systemic be reported immediately to the relevant oversight and regulatory authorities, following the Bank’s related directives when reporting. The guideline sets no hour-count deadline of its own. “Immediately” without a defined clock puts the judgement on the institution and leaves the regulator free to characterise a delay after the fact.

Nepal Rastra Bank also issued a Framework for Identifying Systemically Important Payment Systems on 1 September 2025. Designation under that framework is the mechanism by which heightened resilience expectations attach to a particular operator, so a payments business scaling toward systemic volumes should expect its supervisory obligations to change without any change in the underlying guidelines.

Outside the perimeter

For a technology company, a hospital, a university, a utility or a listed manufacturer, no equivalent instrument exists. The Electronic Transactions Act 2063 supplies offences without imposing duties.

Section	Conduct	Maximum penalty
44	Pirating, destroying or altering source code	NPR 200,000 or 3 years, or both
45	Unauthorised access to a computer system	NPR 200,000 or 3 years, or both
47	Publishing illegal material in electronic form	NPR 100,000 or 5 years, or both
48	Divulging confidentiality	NPR 10,000 or 2 years, or both
52	Computer fraud	NPR 100,000 or 2 years, or both
53	Abetting a computer offence	NPR 50,000 or 6 months, or both
58	Residual contraventions	NPR 50,000 or 6 months, or both

Chapter 10 of the Act establishes an Information Technology Tribunal of three members drawn from law, information technology and commerce, appointed for five-year terms, with appeals to an Information Technology Appellate Tribunal within thirty-five days. Whether the tribunal is currently constituted and hearing cases could not be verified, and a victim planning to rely on it should establish that first.

Two features of this list matter for incident response. Nothing in it obliges a victim organisation to report an intrusion to anyone. And section 47, on publishing prohibited material, has the largest practical footprint of any section in the Act, which gives the statute a public profile as a speech-regulating instrument rather than a computer security one.

Incident reporting

Put the two regimes side by side and the reporting picture is stark. A licensed bank reports a material incident immediately to its regulator under clause 127, on a clock it defines for itself. A payment service provider does the same. Everyone else has no regulator to report to. The only external body with a defined role is the police, whose interest lies in prosecuting an offence under Chapter 9 rather than in containing an incident.

Situational awareness suffers as a result. Where reporting is neither mandatory nor centralised, no institution accumulates a picture of what is happening across the economy. Nepali organisations learn about threats affecting their peers through informal channels or foreign threat intelligence, and a regulator responding to a sector-wide campaign has no early-warning data of its own. That is a design gap rather than an implementation failure. No instrument exists that would produce the data.

Questions for a board

Whether the organisation sits inside Nepal Rastra Bank’s licensing perimeter, because that single fact determines whether a detailed rulebook applies or none does. If it does, whether a director with cyber security expertise is actually on the board, whether the security executive has the independence clause 32 requires, and whether the two-hour resumption objective in clause 95 has been tested rather than asserted.

If it does not, the organisation’s obligations are whatever its contracts impose. A Nepali vendor to a foreign client will typically carry a notification deadline measured in hours under a data processing agreement, a stricter and more precise duty than anything Nepali law imposes on it. The operative standard is the contract, and the board should be reading it.

The gap

An economy with a state-owned incumbent telecom operator, a rapidly digitising banking system and a growing software export sector has one detailed cyber rulebook, and it applies only to licensed financial institutions. Critical national infrastructure outside finance has no sectoral cyber regulator that could be verified, no mandatory incident reporting, and no coordinating body with a statutory mandate. The consolidating bill, if it passes in a recognisable form, would change that. Until it does, the honest description of Nepal’s cybersecurity framework is one central bank guideline and a criminal statute written in 2006.

Sources

1. Cyber Resilience Guidelines

   Nepal Rastra Bank, Payment Systems Department · Issued August 2023; notified 27 August 2023 · Tier 1 — Primary legal instrument

   Supports: Applicability to A–D class BFIs, PSOs and PSPs; clause 3 board approval of the cyber resilience plan; clause 17 board responsibility; clause 29 board member with cyber security expertise; clause 30 senior executive such as a CISO; clause 32 authority, board access and independence; clause 95 two-hour resumption; clauses 118 and 120 backup separation and protection; clause 127 immediate reporting of material or systemic incidents.

   Accessed 26 August 2026

2. Electronic Transactions Act, 2063 — English text

   Government of Nepal; published by the Information Technology and Digital Governance Office · Authenticated 22 Mansir 2063 (8 December 2006) · Tier 1 — Primary legal instrument

   Supports: Chapter 9 computer-related offences: s.44 source code (up to NPR 200,000 or 3 years); s.45 unauthorised access (up to NPR 200,000 or 3 years); s.47 publication of illegal material (up to NPR 100,000 or 5 years); s.48 confidentiality (up to NPR 10,000 or 2 years); s.52 computer fraud (up to NPR 100,000 or 2 years); s.53 abetment (up to NPR 50,000 or 6 months); s.58 residual (up to NPR 50,000 or 6 months). Chapter 10 Information Technology Tribunal, ss.60–65.

   Accessed 26 August 2026

3. Framework for Identifying Systemically Important Payment Systems (SIPS)

   Nepal Rastra Bank, Payment Systems Department · 1 September 2025 · Tier 1 — Primary legal instrument

   Supports: That Nepal Rastra Bank formally designates systemically important payment systems, which is the mechanism by which heightened resilience expectations attach to particular operators.

   Accessed 26 August 2026

4. सूचना तथा संचार प्रविधि नीति, २०७२ (Information and Communication Technology Policy, 2072)

   Government of Nepal; listed under Policies by the Information Technology and Digital Governance Office · 20 October 2015 · Tier 2 — Official publication

   Supports: That the 2015 ICT Policy is the only policy document listed in the Office's policy category, and that no cyber security policy appears there.

   Accessed 26 August 2026