Duty LXD-7756
Is an insurer, in Trinidad and Tobago
Cybersecurity Best Practices Guideline, Notification of Cybersecurity Incidents to the Central Banksince 5 lines
Central Bank of Trinidad and Tobago Cybersecurity Best Practices Guideline (September 2023), Appendix II · Read the law's page
- This binds a company licensed under the Financial Institutions Act, 2008 or registered under the Insurance Act, 2018, the Acts under which the Central Bank established the Guideline (reached by declaring that you provide financial services). The Guideline says other companies are encouraged to adopt it but are not required to report to the Central Bank. The circular letter of is addressed to institutions licensed or holding a financial holding company permit under the Financial Institutions Act, 2008, registered under the Insurance Act, 2018, licensed under the Exchange Control Act, payment system operators and payment service providers, and e-money issuers.
- Alert the Central Bank, as soon as possible but within 24 hours of becoming aware of a cyber-incident, that a cyber-incident has occurred (Guideline Appendix II; Circular Letter CB-OIFI-399/2025).
- Complete the Cyber Incident Reporting Form and send it to cyberincident@central-bank.org.tt, copying your designated Relationship Officer, within 72 hours of the incident (Circular Letter CB-OIFI-399/2025). The Guideline states the 72-hour submission as what the company should do (Appendix II).
- Where specific details are unavailable at the initial report, indicate 'information not yet available', give best estimates and all other available details, and state when more information is expected (Guideline Appendix II).
- Provide regular updates, for example daily, as new information becomes available until the incident is contained or resolved, and a post-incident review and lessons learned report after closure (Circular Letter CB-OIFI-399/2025).
Cybersecurity Best Practices Guideline, Cybersecurity Framework of Financial Institutionssince 5 lines
Central Bank of Trinidad and Tobago Cybersecurity Best Practices Guideline (September 2023), Parts 1 to 3 · Read the law's page
- This binds a company licensed under the Financial Institutions Act, 2008 or registered under the Insurance Act, 2018, the Acts under which the Central Bank established the Guideline (reached by declaring that you provide financial services). The Guideline says other companies are encouraged to adopt it but are not required to report to the Central Bank.
- Establish a cybersecurity framework proportional to your business model, complexity of operations and risks. The Guideline states this as what you should do (Part 1).
- Develop a formal risk-based cybersecurity strategy covering identification, protection, detection, response and recovery, approved by your Board and kept under at least annual review. The Guideline states this as what you should do (Part 2.A).
- Provide regular and appropriate cybersecurity training to employees and customers in an understandable way (Part 2.C).
- Conduct an annual self-assessment against the Guideline and submit the Return to the Central Bank by March 31 of the next calendar year, attaching action plans for any material deficiencies (Circular Letter CB-OIFI-2976/2023).