BermudaBermuda Monetary Authority Insurance Sector Operational Cyber Risk Management Code of Conduct, Notification of Cyber Reporting Events
Insurance Sector Operational Cyber Risk Management Code of Conduct (October 2020), para. 6.5
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a Bermuda registered insurer, insurance manager or intermediary (agent, broker or insurance marketplace provider) (reached by declaring that you are an insurer). The Code came into force on and registrants were required to be in compliance by .
- Have a Principal Representative (for insurers) or an appropriate officer (for insurance managers and intermediaries) notify the Authority within 72 hours from the time that there is either a determination or a confirmation of a cyber reporting event, whichever is sooner, where the event has a significant adverse impact on your operations, policyholders or clients (paragraph 6.5).
- Keep the Authority regularly updated on progress throughout remediation of the incident (paragraph 6.5).
- Submit an incident report with the details of the incident, the root cause, the actions taken to minimise impact and any actual adverse impact within 14 days of the initial notification (paragraph 6.5).
- Maintain logs of all cybersecurity incidents with details of the actions taken, available to the Authority at any time and kept for a minimum of five years (paragraph 6.5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bermuda Monetary Authority, which takes a failure to comply with the Code into account in deciding whether a registered person conducts its business in a prudent manner.
What this law does
The Insurance Sector Operational Cyber Risk Management Code of Conduct requires a Principal Representative or appropriate officer to notify the Authority within 72 hours of a determination or confirmation of a cyber reporting event, whichever is sooner. The Insurance Sector Operational Cyber Risk Management Code of Conduct requires an incident report to be submitted within 14 days of the initial incident notification date.
The Insurance Sector Operational Cyber Risk Management Code of Conduct requires only cyber reporting events with significant adverse impact on operations, policyholders or clients to be reported to the Authority.
When LexLint raises it
When your app profile says your app is an insurer.