Provides financial services, in the Cayman Islands

Cayman Islands Monetary Authority Rule on Cybersecurity for Regulated Entities (April 2023), paras. 3, 5, 6 and 9 · Read the law's page

• This binds an entity regulated by the Cayman Islands Monetary Authority, including a controlled subsidiary as defined in the Banks and Trust Companies Act, other than a regulated mutual fund or a private fund (reached by declaring that you hold a financial-services license). A Class B, C or D insurer fully managed by a licensed insurance manager is bound only by Rule 6.3.
• Establish, implement and maintain a documented cybersecurity framework designed to promptly identify, measure, assess, report, monitor and control or minimise cybersecurity risks, and to respond to and recover from cybersecurity breaches that could have a material impact on your operations (paragraph 5.1.1).
• Include in the framework a cybersecurity risk management strategy approved by the governing body, adequate cybersecurity and IT security policies and procedures, clearly identified managerial responsibilities and controls, and documented processes for responding to, containing and recovering from cyber attacks, breaches and incidents (paragraph 5.1.2).
• Have your governing body approve a written cybersecurity risk management strategy and a comprehensive cybersecurity framework, oversee the framework, review it periodically and approve the cybersecurity audit plan (paragraph 6.1).
• Establish a comprehensive training and awareness programme relating to cybersecurity and cyber-resilience (paragraph 6.4.1).

Rule on Cybersecurity for Regulated Entities (April 2023), para. 8 · Read the law's page

• This binds an entity regulated by the Cayman Islands Monetary Authority, including a controlled subsidiary as defined in the Banks and Trust Companies Act, other than a regulated mutual fund or a private fund (reached by declaring that you hold a financial-services license). A Class B, C or D insurer fully managed by a licensed insurance manager is bound only by Rule 6.3.
• Immediately notify the Authority in writing of an incident that is deemed to have a material impact or has the potential to become a material incident, and no later than 72 hours following the discovery of the incident (paragraph 8.1).
• Define incident criticality in your incident management framework, and report an incident that falls under any listed criterion, including unauthorised dissemination of personal data, extended disruption of critical business systems and loss of card payment information (paragraph 8.2).
• Notify affected persons if a cyber attack results in the breach of non-public information or disrupts a service they use, with information on the action taken to contain, remedy and recover from the breach (paragraph 8.4).