BermudaCybersecurity Act 2024, Critical National Information Infrastructure Regime
Cybersecurity Act 2024 (2024:13), ss. 9, 10, 12 and 16
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This Act is not yet in force: it comes into operation on the day the Minister appoints by notice published in the Gazette, and a CNII entity is bound only once the Minister designates it by order published in the Gazette.
- This binds an entity designated as a CNII entity by the Minister of National Security because it provides an essential service in a critical national infrastructure sector on which a cybersecurity event would have significant disruptive effects (reached by declaring that you operate an essential service).
- Act in accordance with any policy direction the Minister issues to the CNII enforcement authority for your sector (section 12).
- Meet any code of practice or minimum standard of performance the Minister issues for CNII entities (section 13).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The CNII enforcement authority designated for the entity's sector, and the Minister of National Security, who may apply to the Supreme Court for an order that a CNII enforcement authority or entity comply with a further policy direction.
Settledness
- As of
- Open questions
- On what day will the Minister appoint the Act to come into operation, and which entities will be designated as CNII enforcement authorities and CNII entities?
What this law does
The Cybersecurity Act 2024 lets the Minister, after consulting the Board and the appropriate CNII enforcement authority, designate an entity as a CNII entity if the entity is listed as an entity providing an essential service under the sector of a CNII enforcement authority. A CNII enforcement authority and any CNII entity to which a policy direction applies must act in accordance with the policy direction.
The Cybersecurity Act 2024 lets the Minister issue codes of practice or minimum standards of performance for CNII entities. The Cybersecurity Act 2024 lets regulations require a CNII enforcement authority or entity to report significant cybersecurity event threats, vulnerabilities and events to the relevant CNII enforcement authority and the National Cybersecurity Incident Response Team.
The Cybersecurity Act 2024 comes into operation on such day as the Minister may appoint by notice published in the Gazette.
When LexLint raises it
When your app profile says your app runs an essential service.