Is an insurer, in Barbados

Financial Services Commission Technology and Cyber Risk Management Guideline (December 2024), s. 10 · Read the law's page

• This binds a financial institution regulated by the Financial Services Commission (reached by declaring that you provide financial services). The Guideline states most of its requirements as what an institution should do, and the extent to which it is implemented should be proportional to the level of risk and complexity of the services offered.
• Inform the Commission within four hours after an incident is classified, classifying it within the first twenty-four hours of its detection. The Guideline states this as what you should do (section 10(B)(1)).
• Submit the initial report within four hours from the moment the incident is classified as high or critical, and within twenty-four hours for an incident classified as low or medium (Instructions for the completion of the Cyber Incident Reporting Forms, section 5.2).
• If the incident has not been resolved 5 days after the initial report, populate and submit the Intermediate Report Form, and later deliver the final report, based on an independent assessment, within twenty working days after business is deemed back to normal. The Instructions state the final report as what you should do (sections 5.3 and 5.4).
• Notify the Commission of all reportable cyber incidents and also report unsuccessful attempts of any cyber incidents (Information Circular, Reporting Cyber Incidents, April 2025).
• Keep customers informed of any major incident or data breach where their data has potentially been compromised. The Guideline states this as what you should do (section 10(B)(4)).

Financial Services Commission Technology and Cyber Risk Management Guideline (December 2024), ss. 1 to 9 · Read the law's page

• This binds a financial institution regulated by the Financial Services Commission (reached by declaring that you provide financial services). The Guideline states most of its requirements as what an institution should do, and the extent to which it is implemented should be proportional to the level of risk and complexity of the services offered.
• Have senior management establish the technology and cyber risk management framework and strategy, and manage technology and cyber risks based on that framework and strategy (Governance).
• Carry out penetration testing after a vulnerability assessment has been conducted, to obtain an in-depth evaluation of your technology and cyber security defenses. The Guideline states this as what you should do (Technology and Cyber Risk Penetration Testing).
• Revise your cybersecurity program annually where it has identified areas, systems or processes that require material improvement, document the identification and the remedial efforts, and keep that documentation available for inspection by the Commission (section 10(B)(3)).

Central Bank of Barbados Technology and Cyber Risk Management Guideline (March 2026), ss. 2 to 5 · Read the law's page

• This binds an entity licensed under the Financial Institutions Act and a payment service provider as defined under section 2 of the National Payment System Act, 2021 (reached by declaring that you provide financial services). The Guideline states its mandatory requirements with the word must and its advisory ones with may (section 2.5).
• Establish IT policies, standards and procedures to manage technology and cyber risks and safeguard information system assets in line with current industry standards (section 3.2.1).
• Establish an information security policy based on your risk assessment and mitigate the identified cyber risk threats commensurate with your risk tolerance (section 3.2.7).
• Conduct penetration testing before commissioning a new system that offers internet accessibility and open network interfaces; where that is not possible, perform it within the first six months after implementation, explained and documented (section 5.2.6).
• Establish and maintain a comprehensive testing program that covers business continuity and incident response, among others, as part of your cyber risk management framework (section 5.2.7).

Central Bank of Barbados Technology and Cyber Risk Management Guideline (March 2026), ss. 6.6.8 and 6.6.9 · Read the law's page

• This binds an entity licensed under the Financial Institutions Act and a payment service provider as defined under section 2 of the National Payment System Act, 2021 (reached by declaring that you provide financial services). The Guideline states its mandatory requirements with the word must and its advisory ones with may (section 2.5).
• Classify an incident within the first twenty-four hours of its detection; an incident is major if it meets the criteria in the Classification Matrix in the M-CIRT instructions (section 6.6.8).
• Complete the stage 1 section of the Initial report template and submit it to the Central Bank within four hours after an incident is classified as major (section 6.6.8).
• Contact the Central Bank promptly, pending the report template, where a matter is classified as major within twenty-four hours or where a matter reaches the media or social platforms (section 6.6.9).