Is a crypto-asset provider, in Bermuda

Digital Asset Business Act 2018, s. 20 · Read the law's page

• This reaches your organization only if it is a licensed undertaking under the Digital Asset Business Act 2018, which must appoint a senior representative approved by the Authority (s. 19); the duty in section 20 is placed on that senior representative (reached by declaring that you are a crypto-asset provider).
• Have your senior representative notify the Bermuda Monetary Authority forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that a cyber reporting event involving your undertaking has occurred (s. 20(1) and (3)).
• Have your senior representative furnish the Authority, within 14 days of that notification, with a written report setting out all the particulars of the case that are available to him (s. 20(2)).

Digital Asset Business (Cybersecurity) Rules 2018, BR 99 / 2018 · Read the law's page

• This reaches your organization only if it is a licensed undertaking under the Digital Asset Business Act 2018, to which the Bermuda Monetary Authority's Rules made under section 7 of the Act apply (reached by declaring that you are a crypto-asset provider). The Authority may, on your application or where it has made a determination, exempt you from a prudential standard or requirement applicable to you under the Act, such as these Rules, or modify it, and may grant one only if satisfied that it is appropriate having regard to your nature, scale and complexity (Act, s. 8).
• File with the Authority each year a written report prepared by your Chief Information Security Officer, the senior executive you appoint to oversee and implement your cyber security program and enforce your cyber security policies, assessing the availability, functionality and integrity of your electronic systems, any cyber risk arising from your digital asset business, and the cyber security program implemented with proposals to redress inadequacies (rule 3); file it not later than four months after the close of your financial year (Act, s. 7(4)), and keep a copy of the most recent Rule or return you filed with the Authority at your head office for at least five years from its filing date (Act, s. 7(5)).
• Include in your cyber security program penetration testing and vulnerability assessment of your electronic systems at least on a quarterly basis (rule 4(1)(a)).
• Include in your cyber security program audit trail systems that keep data allowing complete and accurate reconstruction of all financial transactions and accounting, protect that data and your hardware from alteration or tampering, limit electronic and physical access to hardware and log physical access, log system events including access, alterations and cyber security events, and maintain the audit trail records (rule 4(1)(b)).
• Engage a qualified independent party to audit your systems and give the Authority a written opinion that your cyber security program and controls are suitably designed and operating effectively to meet the Rules and applicable codes of practice (rule 4(2)).

Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 2, 14-17, 56-57 and 67-68 · Read the law's page

• This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from 26 September 2022 and the other licensed entities from 15 March 2022, each with a compliance date of 15 February 2023.
• Have your board and senior management oversee cyber risks, and have the board approve a cyber risk policy at least annually (paragraph 14).
• Deliver the policy through an operational cyber risk management programme that includes a risk assessment process, data governance, classification and information security controls, and detection, protection, response and recovery controls (paragraph 15).
• Appoint an appropriately qualified member of staff or a similarly experienced outsourced resource as Chief Information Security Officer (paragraph 17).
• Assess your risk and determine a suitable security testing programme (paragraph 56), and have patch management procedures that define the identification, categorisation, prioritisation and implementation of security patches, installing security patches in a reasonable timeframe and testing them for effectiveness and potential side effects before installation (paragraph 57).
• Protect non-public data, including personally identifiable information, with encryption at rest and when transmitted over public networks, using mitigating controls only by exception where encryption is not feasible (paragraph 54).
• Where you outsource functions to third parties or affiliated entities, keep oversight and clear accountability for them as if you performed them internally, and make sure the service agreement covers compliance with jurisdictional laws and regulations, cooperation with the Authority and timely access to data and records (paragraphs 26-28); risk-assess your use of cloud computing by type of cloud architecture, including its security architecture and operations, and define which party operates and monitors each cyber risk control (paragraphs 29-30).
• Complete staff cyber risk awareness training at least annually (paragraph 47), and implement business continuity and disaster recovery policies and procedures, with a documented business impact analysis and plans tested at least annually, the tests documented and any issues tracked for remediation (paragraph 66).

Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 41-44 · Read the law's page

• This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from 26 September 2022 and the other licensed entities from 15 March 2022, each with a compliance date of 15 February 2023.
• Have an officer notify the Authority within 72 hours from the time that there is either a determination or a confirmation of a cyber reporting event, whichever is sooner, where the event has a significant adverse impact on your operations or clients (paragraphs 42 and 43).
• Keep the Authority updated regularly on progress throughout remediation of the incident (paragraph 43).
• Submit an incident report with the details of the incident, the root cause, the actions taken to minimise impact and any actual adverse impact within 14 days of the initial notification, and a final report at the conclusion of the investigation if the root cause was not confirmed (paragraph 43).
• Maintain logs of all cybersecurity incidents with timelines and actions taken, available to the Authority at any time and kept for a minimum of five years (paragraph 44).