CIMA’s cybersecurity rules: what regulated firms need to do now

Who the rules apply to

The Cayman Islands Monetary Authority (CIMA) sets out its expectations in the Rule and Statement of Guidance on Cybersecurity for Regulated Entities. The current version of the Rule is dated April 2023.

It applies to entities regulated by CIMA, including their controlled subsidiaries. That covers banks, trust companies, insurers, securities investment businesses and other licensees and registrants.

Regulated mutual funds and private funds are excluded. But the administrators, managers and other service providers that run them are often in scope themselves, and a fund’s investors and auditors increasingly ask about cyber controls anyway.

What the Rule requires

At its core, the Rule asks for a documented cybersecurity framework that can identify, measure, assess, report, monitor and control your cybersecurity risks. In practice that breaks down into six areas.

1. Governance and board oversight

The governing body has ultimate responsibility. It must approve a written cybersecurity risk management strategy and framework, review it periodically, and approve a cybersecurity audit plan. It must also make sure audit findings are dealt with in a timely way.

A suitable senior officer, such as a CIO or CISO, should oversee the framework day to day and have direct access to the board.

2. Risk identification and assessment

You need to know what you have, what matters most and what could go wrong. That means an up-to-date inventory of systems and data, and a regular risk assessment.

3. Protection and monitoring

Controls should match the risks you’ve identified: access control and multi-factor authentication, patching, endpoint protection, secure configuration, backups and continuous monitoring.

4. Incident response and recovery

You need a tested plan for detecting, containing and recovering from an incident, including who decides whether it is material and who notifies CIMA.

5. Third parties and outsourcing

You stay responsible for functions you outsource, including IT run by an affiliate or a provider like us. You need to assess whether your service providers meet the Rule’s expectations.

6. Training and awareness

Staff need a cybersecurity training and awareness programme that is reviewed and kept up to date. Phishing remains the most common way attackers get in.

The 72-hour clock

If you have a material cybersecurity incident, or one that could become material, you must notify CIMA in writing immediately and no later than 72 hours after you discover it. If you aren’t sure whether an incident is material, CIMA’s guidance is to consult it.

If the incident involves personal data, a second clock may be running. Under the Data Protection Act, a data controller must tell the Ombudsman and the affected individuals without undue delay, and within five days of when it should reasonably have become aware of the breach.

Both deadlines start from discovery, so your incident plan needs named people, templates and contact details ready in advance.

A 10-step checklist

Use this to check where you stand. Most firms we review have the technical basics in place but are missing the paperwork, the board sign-off or a tested incident plan.

• Name an accountable senior officer for cybersecurity, with a direct line to the board.
• Write or refresh your cybersecurity framework and core policies, sized to your business.
• Have the board approve the framework and minute it. Diarise a periodic review.
• Keep an inventory of your systems, data and service providers.
• Run a cybersecurity risk assessment at least once a year, and after major changes.
• Check the essentials: multi-factor authentication everywhere, patching, endpoint protection and tested backups.
• Write an incident response plan that covers the CIMA 72-hour report and the Data Protection Act 5-day notice, with templates.
• Rehearse it with a tabletop exercise so everyone knows their role.
• Review your IT and cloud providers against the Rule, and get the right terms in your contracts.
• Train staff regularly, run phishing simulations, and have the board approve an audit plan. Independent penetration testing is a common way to show your controls work.

How CNS can help

Our in-house security team works with banks, trust companies, insurers and fund service providers across Cayman. We can run a gap assessment against the Rule, draft or refresh your policies, carry out penetration testing and help you rehearse your incident response.

Our Regulated Client Addendum gives CIMA-regulated clients the outsourcing terms the Rule expects. If an incident happens, our team answers emergency calls 24/7 on (345) 926-7666.

This article is general information, not legal advice. Check CIMA’s current publications and take advice on your own obligations.