skills-il/security-compliance/israeli-cyber-regulations

Israeli Cyber Regulations

Legal notice

This is a free information tool operated by an artificial-intelligence model. It maps which Israeli cybersecurity regulatory instruments apply to an organisation, summarises their published requirements, and helps prepare gap analyses and audit evidence lists. All of its output is produced automatically, without the involvement, review or approval of a lawyer, a compliance officer, or any licensed professional.

The output is not legal advice and not a legal opinion, and any text it drafts is not a document prepared by a lawyer. It is a summary of published regulatory material. The tool does not read the organisation's contracts, licences or supervisory correspondence, does not know its licence conditions, its designation status, or which instruments actually bind it. Regulatory instruments are amended, consolidated and repealed frequently, sometimes with effect from a date later than this tool's information, and an artificial-intelligence model may err, omit an instrument, or cite one no longer in force.

Do not rely on this output to determine a reporting obligation, a filing deadline, or whether an incident is disclosable. Verify every directive, regulation and statute against the regulator's own current publication, and before any filing, disclosure, board representation or approach to a regulator, consult a lawyer or a qualified compliance professional. This tool is not a substitute for advice that takes account of the particular data and needs of each person. Any use of the output is the sole responsibility of the user.

Scope note. For privacy-law compliance (data protection, consent, PPA registration) use the israeli-privacy-compliance skill; only the cyber-facing breach-notification duty is carried here.

Instructions

Step 1: Identify Applicable Regulatory Framework

Determine which Israeli cybersecurity regulations apply to the user's organization.

Decision logic:

Is the organization a designated body under the Regulation of Security in
Public Bodies Law, 5758-1998?
  YES -> its cyber duties and its reporting line run through its statutory
         GUIDING BODY (gorem manche), not through the voluntary INCD baseline.
         An organisation does not work this out by self-assessment: designation
         happens through the Law's schedules and the organisation is told.
         If the user does not know, that itself is the answer to establish first,
         and INCD is not the body that designates them on its own
Is the organization a banking corporation or a credit-card company?
  YES -> BOI Directive 364 applies (357/361/363 are repealed), plus 366 reporting,
         362 cloud, 368 open banking (+ INCD if designated)
Is the organization an insurer, pension fund or provident fund (guf mosdi)?
  YES -> NOT the BOI directives. Capital Market, Insurance and Savings Authority,
         Institutional Bodies Circular 2016-9-14 on cyber risk management.
         Directive 364 does not mention insurance at all
Does the organization provide payment services?
  YES -> split by systemic importance. A payment-service provider of SYSTEMIC
         IMPORTANCE (section 36T of the Banking (Licensing) Law) is inside
         Directive 364 by its own applicability clause. Every other non-bank
         payment or initiation licensee is licensed and supervised by the
         ISRAEL SECURITIES AUTHORITY under the Payment Services and Payment
         Initiation Law, 5783-2023, whose licensing conditions cover information
         security and cyber via the Authority's regulator instructions
Is the organization a digital-service or hosting provider?
  YES -> the Severe Cyber Attacks (Digital Services and Hosting) Temporary Order
         Law, 5784-2023 imposes a STATUTORY reporting duty. This is the one
         binding civilian-sector reporting statute; see Step 2
Is the organization listed on TASE?
  YES -> ISA cyber disclosure requirements apply
Is the organization in healthcare?
  YES -> MOH health cyber directives apply
ALL organizations -> INCD voluntary baseline recommendations apply

Step 2: INCD (Ma'arach HaSyber) Framework Assessment

The Israel National Cyber Directorate (INCD) sets national cybersecurity policy.

INCD Five-Pillar Framework (Identify / Protect / Detect / Respond / Recover; זיהוי, הגנה, גילוי, תגובה, שחזור). The per-pillar requirements are in references/incd-guidelines.md.

INCD incident reporting: what is actually binding, and what is not.

INCD publishes no reporting timeline for any sector. Do not state one. Earlier versions of this skill asserted "critical infrastructure must report within hours" plus a four-tier deadline ladder; neither is sourced, and both were removed. Detail in references/incd-guidelines.md.

• The one binding civilian-sector reporting statute is the Severe Cyber Attacks in the Digital Services and Hosting Sector (Temporary Order), 5784-2023 (חוק התמודדות עם תקיפות סייבר חמורות במגזר השירותים הדיגיטליים ושירותי האחסון). INCD's reporting page cites it directly. If the organisation is a digital-service or hosting provider, its reporting duty is statutory, not voluntary. This is the most common mistake in scoping an Israeli cyber engagement.
• Everyone else: reporting to INCD is voluntary. INCD states expressly that sharing information with it does not substitute for a reporting duty owed to a sector regulator or guiding body, so a bank still reports under Directive 366 and a listed company still reports to the ISA.
• Sector regulators set the real clocks. Banks: Directive 366. Listed companies: ISA. Databases at medium or high security level: the PPA, immediately.
• Reporting channel: the INCD operational centre on 119, or 072-3990801, or 119@cyber.gov.il, 24/7.
• A designated body under the Regulation of Security in Public Bodies Law, 5758-1998, is a separate question. Its duties and reporting line come from its statutory guiding body. This skill does not carry the Law's schedules, so establish designation status from the organisation itself rather than inferring it from a sector list.
• A national cyber statute is close (see the Gotchas). It is not law yet, so do not apply its clocks today.

Annual INCD baseline checklist (risk assessment, asset inventory including OT/IoT, tested IR plan, supply-chain review, awareness training, backup validation, external penetration testing): see references/incd-guidelines.md.

Step 3: Bank of Israel Directive 364 (the operative framework)

Directive 361 is repealed. Do not build a control program against it.

Directive 364, "Management of IT, Information Security and Cyber Protection Risks" (published 18/11/2024, circular 2799), took effect 18/05/2026, or on earlier adoption by the banking corporation, whichever came first. The BOI page states that from that date Directives 357, 361 and 363 are cancelled, along with two 2009 supervision letters. Both dates are now past, so 364 governs every banking corporation.

The substantive control content of 361 largely carries forward into 364 with stronger board accountability and supply-chain expectations, so a mature 361 program is a good starting inventory. But the citation must be 364. An audit response, board paper, or gap analysis that cites "Directive 361" is citing a repealed instrument, and this is the single most common error on this topic because most training data predates 18/05/2026.

The surrounding directives, which 364 did NOT absorb:

Read this before using the table below. The control expectations that follow are a working inventory carried over from the repealed Directive 361. They are NOT a Directive 364 control list, and this skill has not mapped them to 364's clauses. Directive 364 is 57 pages and merges three directives (357 IT governance, 361 cyber, 363 supply chain), so an inventory derived from 361 alone is both over-specified, because it carries cadences 361 stated and 364 may not, and under-specified, because the absorbed IT-governance and supply-chain content is not represented here at all.