Provides financial services, in Bermuda

Digital Asset Business Act 2018, s. 20 · Read the law's page

• This reaches your organization only if it is a licensed undertaking under the Digital Asset Business Act 2018, which must appoint a senior representative approved by the Authority (s. 19); the duty in section 20 is placed on that senior representative (reached by declaring that you are a crypto-asset provider).
• Have your senior representative notify the Bermuda Monetary Authority forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that a cyber reporting event involving your undertaking has occurred (s. 20(1) and (3)).
• Have your senior representative furnish the Authority, within 14 days of that notification, with a written report setting out all the particulars of the case that are available to him (s. 20(2)).

Digital Asset Business (Cybersecurity) Rules 2018, BR 99 / 2018 · Read the law's page

• This reaches your organization only if it is a licensed undertaking under the Digital Asset Business Act 2018, to which the Bermuda Monetary Authority's Rules made under section 7 of the Act apply (reached by declaring that you are a crypto-asset provider). The Authority may, on your application or where it has made a determination, exempt you from a prudential standard or requirement applicable to you under the Act, such as these Rules, or modify it, and may grant one only if satisfied that it is appropriate having regard to your nature, scale and complexity (Act, s. 8).
• File with the Authority each year a written report prepared by your Chief Information Security Officer, the senior executive you appoint to oversee and implement your cyber security program and enforce your cyber security policies, assessing the availability, functionality and integrity of your electronic systems, any cyber risk arising from your digital asset business, and the cyber security program implemented with proposals to redress inadequacies (rule 3); file it not later than four months after the close of your financial year (Act, s. 7(4)), and keep a copy of the most recent Rule or return you filed with the Authority at your head office for at least five years from its filing date (Act, s. 7(5)).
• Include in your cyber security program penetration testing and vulnerability assessment of your electronic systems at least on a quarterly basis (rule 4(1)(a)).
• Include in your cyber security program audit trail systems that keep data allowing complete and accurate reconstruction of all financial transactions and accounting, protect that data and your hardware from alteration or tampering, limit electronic and physical access to hardware and log physical access, log system events including access, alterations and cyber security events, and maintain the audit trail records (rule 4(1)(b)).
• Engage a qualified independent party to audit your systems and give the Authority a written opinion that your cyber security program and controls are suitably designed and operating effectively to meet the Rules and applicable codes of practice (rule 4(2)).

Insurance Sector Operational Cyber Risk Management Code of Conduct (October 2020), para. 6.5 · Read the law's page

• This binds a Bermuda registered insurer, insurance manager or intermediary (agent, broker or insurance marketplace provider) (reached by declaring that you are an insurer). The Code came into force on 1 January 2021 and registrants were required to be in compliance by 31 December 2021.
• Have a Principal Representative (for insurers) or an appropriate officer (for insurance managers and intermediaries) notify the Authority within 72 hours from the time that there is either a determination or a confirmation of a cyber reporting event, whichever is sooner, where the event has a significant adverse impact on your operations, policyholders or clients (paragraph 6.5).
• Keep the Authority regularly updated on progress throughout remediation of the incident (paragraph 6.5).
• Submit an incident report with the details of the incident, the root cause, the actions taken to minimise impact and any actual adverse impact within 14 days of the initial notification (paragraph 6.5).
• Maintain logs of all cybersecurity incidents with details of the actions taken, available to the Authority at any time and kept for a minimum of five years (paragraph 6.5).

Insurance Sector Operational Cyber Risk Management Code of Conduct (October 2020), paras. 1, 5.1-5.3 and 8 · Read the law's page

• This binds a Bermuda registered insurer, insurance manager or intermediary (agent, broker or insurance marketplace provider) (reached by declaring that you are an insurer). The Code came into force on 1 January 2021 and registrants were required to be in compliance by 31 December 2021. The Authority assesses your compliance in proportion to your nature, scale and complexity (paragraph 4). A limited purpose insurer may rely on its insurance manager to confirm that the services the manager provides comply with the Code (paragraph 4), and you may meet a requirement through a comparable or higher standard that you can show yields similar protection (paragraph 3).
• Have your board of directors and senior management team oversee cyber risks, and have the board approve a cyber risk policy document at least annually (paragraph 5.1).
• Allocate the role of Chief Information Security Officer to an appropriately qualified member of staff or an outsourced resource, with oversight responsibility remaining with the board (paragraph 5.2).
• Deliver the cyber risk policy through an operational cyber risk management programme that includes a risk assessment process, data governance, classification and information security controls, and detection, protection, response and recovery controls (paragraph 5.3), documenting your risk assessments and retaining them for at least five years in a form that can be provided to the Authority on request (paragraph 5.5).
• Have patch management procedures that define the identification, categorisation and prioritisation of security patches (paragraph 6.16).
• Protect nonpublic data, including personally identifiable information, with encryption at rest and when transmitted over public networks, using mitigating controls only by exception where encryption is not feasible (paragraph 6.13).
• Where you outsource functions to third parties or affiliated entities, keep oversight and clear accountability for them as if you performed them internally, and make sure the service agreement covers compliance with jurisdictional laws and regulations, cooperation with the Authority and timely access to data and records (paragraph 5.10); risk-assess your use of cloud computing by type of cloud architecture, including its security architecture and operations (paragraph 5.11).
• Use network segregation to create zones of enhanced security, and route any service that accesses the internet first through a demilitarised zone (DMZ) (paragraph 6.18).
• Implement a staff vetting process (paragraph 5.13), complete staff cyber risk awareness training at least annually (paragraph 6.7), and implement business continuity and disaster recovery policies and procedures, with a documented business impact analysis and plans tested at least annually, the tests documented and any issues tracked for remediation (paragraph 7.1).

Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 2, 14-17, 56-57 and 67-68 · Read the law's page

• This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from 26 September 2022 and the other licensed entities from 15 March 2022, each with a compliance date of 15 February 2023.
• Have your board and senior management oversee cyber risks, and have the board approve a cyber risk policy at least annually (paragraph 14).
• Deliver the policy through an operational cyber risk management programme that includes a risk assessment process, data governance, classification and information security controls, and detection, protection, response and recovery controls (paragraph 15).
• Appoint an appropriately qualified member of staff or a similarly experienced outsourced resource as Chief Information Security Officer (paragraph 17).
• Assess your risk and determine a suitable security testing programme (paragraph 56), and have patch management procedures that define the identification, categorisation, prioritisation and implementation of security patches, installing security patches in a reasonable timeframe and testing them for effectiveness and potential side effects before installation (paragraph 57).
• Protect non-public data, including personally identifiable information, with encryption at rest and when transmitted over public networks, using mitigating controls only by exception where encryption is not feasible (paragraph 54).
• Where you outsource functions to third parties or affiliated entities, keep oversight and clear accountability for them as if you performed them internally, and make sure the service agreement covers compliance with jurisdictional laws and regulations, cooperation with the Authority and timely access to data and records (paragraphs 26-28); risk-assess your use of cloud computing by type of cloud architecture, including its security architecture and operations, and define which party operates and monitors each cyber risk control (paragraphs 29-30).
• Complete staff cyber risk awareness training at least annually (paragraph 47), and implement business continuity and disaster recovery policies and procedures, with a documented business impact analysis and plans tested at least annually, the tests documented and any issues tracked for remediation (paragraph 66).

Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 41-44 · Read the law's page

• This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from 26 September 2022 and the other licensed entities from 15 March 2022, each with a compliance date of 15 February 2023.
• Have an officer notify the Authority within 72 hours from the time that there is either a determination or a confirmation of a cyber reporting event, whichever is sooner, where the event has a significant adverse impact on your operations or clients (paragraphs 42 and 43).
• Keep the Authority updated regularly on progress throughout remediation of the incident (paragraph 43).
• Submit an incident report with the details of the incident, the root cause, the actions taken to minimise impact and any actual adverse impact within 14 days of the initial notification, and a final report at the conclusion of the investigation if the root cause was not confirmed (paragraph 43).
• Maintain logs of all cybersecurity incidents with timelines and actions taken, available to the Authority at any time and kept for a minimum of five years (paragraph 44).