CIMA Rule on Cybersecurity for Regulated Entities, Cybersecurity Framework and Governance

Cayman Islands Monetary Authority Rule on Cybersecurity for Regulated Entities (April 2023), paras. 3, 5, 6 and 9

In force.

A sector security regimes rule binding private bodies.

Private right of action: No
Instrument type: a regulation made under an act
Obligation class: Security, Governance

As of 27 October 2026.

What it requires

This binds an entity regulated by the Cayman Islands Monetary Authority, including a controlled subsidiary as defined in the Banks and Trust Companies Act, other than a regulated mutual fund or a private fund (reached by declaring that you hold a financial-services license). A Class B, C or D insurer fully managed by a licensed insurance manager is bound only by Rule 6.3.
Establish, implement and maintain a documented cybersecurity framework designed to promptly identify, measure, assess, report, monitor and control or minimise cybersecurity risks, and to respond to and recover from cybersecurity breaches that could have a material impact on your operations (paragraph 5.1.1).
Include in the framework a cybersecurity risk management strategy approved by the governing body, adequate cybersecurity and IT security policies and procedures, clearly identified managerial responsibilities and controls, and documented processes for responding to, containing and recovering from cyber attacks, breaches and incidents (paragraph 5.1.2).
Have your governing body approve a written cybersecurity risk management strategy and a comprehensive cybersecurity framework, oversee the framework, review it periodically and approve the cybersecurity audit plan (paragraph 6.1).
Establish a comprehensive training and awareness programme relating to cybersecurity and cyber-resilience (paragraph 6.4.1).

These lines are LexLint's reading of the law's text, as of 27 October 2026.

Who enforces it

Enforcement body

The Cayman Islands Monetary Authority, whose Enforcement Manual applies to a breach of the Rule, in addition to its other powers under the regulatory Acts and the Monetary Authority Act.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Rule on Cybersecurity for Regulated Entities applies to entities regulated by the Cayman Islands Monetary Authority, including controlled subsidiaries as defined in the Banks and Trust Companies Act. The Rule on Cybersecurity for Regulated Entities excepts regulated mutual funds and private funds. The Rule on Cybersecurity for Regulated Entities requires regulated entities to establish, implement and maintain a documented cybersecurity framework.

The Rule on Cybersecurity for Regulated Entities makes the governing body of a regulated entity ultimately responsible for cybersecurity. Section 34 of the Monetary Authority Act lets the Authority issue rules concerning the conduct of licensees and their officers and employees. Section 34 of the Monetary Authority Act provides that a breach of such rules does not constitute an offence.

The Rule on Cybersecurity for Regulated Entities states that the Authority's Enforcement Manual applies whenever a breach of the Rule occurs.

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example · Lint your app