BermudaBermuda Monetary Authority Insurance Sector Operational Cyber Risk Management Code of Conduct, Governance and Programme
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a Bermuda registered insurer, insurance manager or intermediary (agent, broker or insurance marketplace provider) (reached by declaring that you are an insurer). The Code came into force on and registrants were required to be in compliance by .
- Have your board of directors and senior management team oversee cyber risks, and have the board approve a cyber risk policy document at least annually (paragraph 5.1).
- Allocate the role of Chief Information Security Officer to an appropriately qualified member of staff or an outsourced resource, with oversight responsibility remaining with the board (paragraph 5.2).
- Deliver the cyber risk policy through an operational cyber risk management programme that includes a risk assessment process, data governance, classification and information security controls, and detection, protection, response and recovery controls (paragraph 5.3).
- Have patch management procedures that define the identification, categorisation and prioritisation of security patches (paragraph 6.16).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bermuda Monetary Authority, which takes a failure to comply with the Code into account in deciding whether a registered person conducts its business in a prudent manner.
What this law does
The Insurance Sector Operational Cyber Risk Management Code of Conduct applies to all Bermuda registered insurers, insurance managers and intermediaries. Section 2BA of the Insurance Act 1978 requires every registered person to comply with the provisions of any code of conduct applicable to it that the Authority issues. A failure by a registered person to comply with such a code is taken into account by the Authority in determining whether the business is being conducted in a prudent manner.
The Insurance Sector Operational Cyber Risk Management Code of Conduct requires the board of directors to approve a cyber risk policy document at least on an annual basis. The Insurance Sector Operational Cyber Risk Management Code of Conduct requires registrants to be in compliance by .
When LexLint raises it
When your app profile says your app is an insurer.