BermudaBermuda Monetary Authority Operational Cyber Risk Management Code of Conduct, Governance and Programme
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a bank, deposit company, corporate service provider, trust company, money service business, investment business or fund administration provider licensed by the Bermuda Monetary Authority (reached by declaring that you hold a financial-services license). A bank or deposit company was bound from and the other licensed entities from , each with a compliance date of .
- Have your board and senior management oversee cyber risks, and have the board approve a cyber risk policy at least annually (paragraph 14).
- Deliver the policy through an operational cyber risk management programme that includes a risk assessment process, data governance, classification and information security controls, and detection, protection, response and recovery controls (paragraph 15).
- Appoint an appropriately qualified member of staff or a similarly experienced outsourced resource as Chief Information Security Officer (paragraph 17).
- Assess your risk and determine a suitable security testing programme (paragraph 56), and have patch management procedures that define the identification, categorisation, prioritisation and implementation of security patches (paragraph 57).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bermuda Monetary Authority, which takes a failure to comply with the Code into account in deciding whether a licensed entity conducts its business in a prudent manner.
What this law does
Paragraph 2 of the Operational Cyber Risk Management Code of Conduct requires each relevant licensed entity to implement adequate systems, appropriate to the nature, scale and complexity of its business risk profile. Section 8A of the Banks and Deposit Companies Act 1999 requires every institution to comply with any code of conduct the Authority issues.
A failure by a bank to comply with such a code is taken into account by the Authority in determining whether its business is being conducted in a prudent manner. The Operational Cyber Risk Management Code of Conduct requires the board to approve a cyber risk policy at least annually. The Operational Cyber Risk Management Code of Conduct requires the Chief Information Security Officer role to be filled by an appropriately qualified staff member or a similarly experienced outsourced resource.
The Operational Cyber Risk Management Code of Conduct requires banks and deposit companies to comply by .
When LexLint raises it
When your app profile says your app provides financial services.