Cayman IslandsCIMA Rule on Cybersecurity for Regulated Entities, Notification Requirements
Rule on Cybersecurity for Regulated Entities (April 2023), para. 8
In force.
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds an entity regulated by the Cayman Islands Monetary Authority, including a controlled subsidiary as defined in the Banks and Trust Companies Act, other than a regulated mutual fund or a private fund (reached by declaring that you hold a financial-services license). A Class B, C or D insurer fully managed by a licensed insurance manager is bound only by Rule 6.3.
- Immediately notify the Authority in writing of an incident that is deemed to have a material impact or has the potential to become a material incident, and no later than 72 hours following the discovery of the incident (paragraph 8.1).
- Define incident criticality in your incident management framework, and report an incident that falls under any listed criterion, including unauthorised dissemination of personal data, extended disruption of critical business systems and loss of card payment information (paragraph 8.2).
- Notify affected persons if a cyber attack results in the breach of non-public information or disrupts a service they use, with information on the action taken to contain, remedy and recover from the breach (paragraph 8.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Cayman Islands Monetary Authority, whose Enforcement Manual applies to a breach of the Rule, in addition to its other powers under the regulatory Acts and the Monetary Authority Act.
What this law does
The Rule on Cybersecurity for Regulated Entities requires a regulated entity to notify the Authority in writing of a material incident immediately and no later than 72 hours following its discovery. The Rule on Cybersecurity for Regulated Entities requires a regulated entity to notify affected persons if a cyber attack results in the breach of non-public information or disrupts a service that is utilised.
When LexLint raises it
When your app profile says your app provides financial services.