Is a securities firm, in Bermuda

Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 2, 14-17, 56-57 and 67-68 · Read the law's page

• This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from 26 September 2022 and the other licensed entities from 15 March 2022, each with a compliance date of 15 February 2023.
• Have your board and senior management oversee cyber risks, and have the board approve a cyber risk policy at least annually (paragraph 14).
• Deliver the policy through an operational cyber risk management programme that includes a risk assessment process, data governance, classification and information security controls, and detection, protection, response and recovery controls (paragraph 15).
• Appoint an appropriately qualified member of staff or a similarly experienced outsourced resource as Chief Information Security Officer (paragraph 17).
• Assess your risk and determine a suitable security testing programme (paragraph 56), and have patch management procedures that define the identification, categorisation, prioritisation and implementation of security patches, installing security patches in a reasonable timeframe and testing them for effectiveness and potential side effects before installation (paragraph 57).
• Protect non-public data, including personally identifiable information, with encryption at rest and when transmitted over public networks, using mitigating controls only by exception where encryption is not feasible (paragraph 54).
• Where you outsource functions to third parties or affiliated entities, keep oversight and clear accountability for them as if you performed them internally, and make sure the service agreement covers compliance with jurisdictional laws and regulations, cooperation with the Authority and timely access to data and records (paragraphs 26-28); risk-assess your use of cloud computing by type of cloud architecture, including its security architecture and operations, and define which party operates and monitors each cyber risk control (paragraphs 29-30).
• Complete staff cyber risk awareness training at least annually (paragraph 47), and implement business continuity and disaster recovery policies and procedures, with a documented business impact analysis and plans tested at least annually, the tests documented and any issues tracked for remediation (paragraph 66).

Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 41-44 · Read the law's page

• This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from 26 September 2022 and the other licensed entities from 15 March 2022, each with a compliance date of 15 February 2023.
• Have an officer notify the Authority within 72 hours from the time that there is either a determination or a confirmation of a cyber reporting event, whichever is sooner, where the event has a significant adverse impact on your operations or clients (paragraphs 42 and 43).
• Keep the Authority updated regularly on progress throughout remediation of the incident (paragraph 43).
• Submit an incident report with the details of the incident, the root cause, the actions taken to minimise impact and any actual adverse impact within 14 days of the initial notification, and a final report at the conclusion of the investigation if the root cause was not confirmed (paragraph 43).
• Maintain logs of all cybersecurity incidents with timelines and actions taken, available to the Authority at any time and kept for a minimum of five years (paragraph 44).