BermudaBermuda Digital Asset Business (Cybersecurity) Rules 2018: Annual Cyber Security Report and Cyber Security Program
Digital Asset Business (Cybersecurity) Rules 2018, BR 99 / 2018
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This reaches your organization only if it is a licensed undertaking under the Digital Asset Business Act 2018, to which the Bermuda Monetary Authority's Rules made under section 7 of the Act apply (reached by declaring that you are a crypto-asset provider).
- File with the Authority each year a written report prepared by your Chief Information Security Officer, the senior executive you appoint to oversee and implement your cyber security program and enforce your cyber security policies, assessing the availability, functionality and integrity of your electronic systems, any cyber risk arising from your digital asset business, and the cyber security program implemented with proposals to redress inadequacies (rule 3); file it not later than four months after the close of your financial year (Act, s. 7(4)).
- Include in your cyber security program penetration testing and vulnerability assessment of your electronic systems at least on a quarterly basis (rule 4(1)(a)).
- Include in your cyber security program audit trail systems that keep data allowing complete and accurate reconstruction of all financial transactions and accounting, protect that data and your hardware from alteration or tampering, limit electronic and physical access to hardware and log physical access, log system events including access, alterations and cyber security events, and maintain the audit trail records (rule 4(1)(b)).
- Engage a qualified independent party to audit your systems and give the Authority a written opinion that your cyber security program and controls are suitably designed and operating effectively to meet the Rules and applicable codes of practice (rule 4(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
The cap applies for each failure to comply with a requirement imposed under the Act; the Authority does not impose it where the person took all reasonable steps and exercised all due diligence.
- Rule
- Fixed only
- As of
- Currency
- BMD
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The Bermuda Monetary Authority, which made the Rules under section 7 of the Digital Asset Business Act 2018.
What this law does
The Digital Asset Business (Cybersecurity) Rules 2018 (BR 99 / 2018) are made by the Bermuda Monetary Authority in exercise of the power conferred by section 7 of the Digital Asset Business Act 2018. Rule 3 requires every licensed undertaking to file annually with the Authority a written report prepared by its Chief Information Security Officer.
The Rules define the Chief Information Security Officer as the senior executive appointed by the licensed undertaking to oversee and implement its cyber security program and enforce its cyber security policies. Rule 4(1)(a) requires the cyber security program to include penetration testing and vulnerability assessment of the licensed undertaking's electronic systems at least on a quarterly basis.
Rule 4(2) requires every licensed undertaking to engage a qualified independent party to audit its systems and provide a written opinion to the Authority. Section 39 of the Act makes a person who fails to comply with a requirement imposed by or under the Act liable to a civil penalty not exceeding $10,000,000 for each failure.
Section 7 of the Act makes a licensed undertaking that fails to file information or documents required in relation to a Rule within the time specified liable to a civil penalty not exceeding $5,000 for each week or part of a week in default. Section 7 of the Act requires a licensed undertaking to file those Rule documents not later than four months after the close of its financial year.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.