- ClassificationCategoryOperational ResilienceDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeFrameworkLegal InstrumentCodeSectorFinancial SectorIndustryFinancial Services
- Region / PublisherRegionNorth AmericaRegion DetailBermudaPublisherBermuda Monetary Authority (BMA)
- VersioningVersionOctober 2020 (insurance); September 2022 (other sectors)Effective DateJanuary 1, 2021 (insurance); March 15 and September 26, 2022Issue DateOctober 2020 (insurance sector Code); September 2022 (revised Code for the other sectors)
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Codes are published free by the Bermuda Monetary Authority at bma.bm and are included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- The BMA Operational Cyber Risk Management Code of Conduct requires Bermuda-regulated firms to run a board-approved cyber risk program.
- It covers insurers, insurance managers and intermediaries, banks, deposit companies, trust companies, corporate service providers, money service businesses, investment businesses, and fund administrators.
- The insurance sector Code took effect January 1, 2021; the Code for other sectors followed in 2022.
- Significant cyber incidents must be reported to the BMA within 72 hours, with a 14-day incident report.
- Firms approve a cyber risk policy annually at board level, appoint a CISO, keep a risk register, and test response plans yearly.
Overview
The BMA Operational Cyber Risk Management Code of Conduct is a set of Bermuda Monetary Authority codes for the sectors the Authority regulates. It covers Bermuda insurers, insurance managers and intermediaries, banks, deposit companies, trust companies, corporate service providers, money service businesses, investment businesses and fund administration providers. Each of them must run a board-approved cyber risk program and tell the BMA about significant cyber incidents within 72 hours.
The Bermuda Monetary Authority issues the Codes under the statutes that license each sector, such as the Banks and Deposit Companies Act 1999 (section 8A) and the Investment Business Act 2003 (section 10). The Insurance Sector Code (October 2020) took effect on January 1, 2021, with compliance by December 31, 2021. The Code for the other regulated sectors took effect on March 15, 2022 for trust companies, corporate service providers, money service businesses, investment businesses and fund administration providers, and in its revised September 2022 form on September 26, 2022 for banks and deposit companies, with compliance by February 15, 2023. A firm that does not follow the Code is assessed by the BMA against the minimum licensing criterion that it conducts business in a sound and prudent manner (September 2022 Code, paragraph 5).
Firms implement the Codes by approving an annual cyber risk policy at board level, appointing a Chief Information Security Officer (CISO), keeping a risk register, testing incident response, business continuity and disaster recovery at least annually, and preparing the 72-hour notice and 14-day incident report before an event happens.
Why does it matter?
The Codes make cyber risk a board matter. Under the revised September 2022 Code, the board and senior management must oversee cyber risk, the board must approve a cyber risk policy at least annually, and the Authority assesses firms against the Code in proportion to the nature, scale and complexity of their business (paragraphs 11 to 14).
Key benefits include:
- Board accountability
The board approves the cyber risk policy each year and receives regular updates on cyber risk status, so oversight cannot be delegated to IT.
- A fixed incident clock
An officer must notify the BMA within 72 hours of determining or confirming a reportable cyber event, with an incident report due 14 days after notice.
- Proportionate expectations
A small firm with complex activity still needs a sophisticated framework, because nature, scale and complexity are judged together.
- Outsourcing stays your risk
A firm may outsource the CISO role or IT functions but never its responsibility for governance and risk (paragraph 27).
- Evidence for supervisors
Risk assessments and incident logs must be kept for at least five years and be available to the BMA on request (paragraphs 21 and 44).
How does it work?
The Code is organized in three groups of controls: identification of assets and risks (Board governance, the operational cyber risk management program, the CISO, the three lines of defense, risk assessment, asset identification, outsourcing and cloud), detect and protect controls (incident management, notification, access, training, data protection, testing, patching, logging) and response and recovery controls (business continuity and disaster recovery).
The Code says "shall" or "must" is mandatory, "should" is a strong recommendation and "may" is optional, and it points to NIST or ISO standards as best practice (paragraph 10). The insurance sector Code of October 2020 follows the same structure for insurers, insurance managers, and agents, brokers and marketplace providers.
The Code comes into force on January 1, 2021 for insurance registrants (compliance by December 31, 2021), on March 15, 2022 for trust, corporate service provider, money service, investment and fund administration firms, and on September 26, 2022 for banks and deposit companies. The last two groups must comply by February 15, 2023 (paragraphs 67 and 68).
Key Elements
- Cyber risk policy and the CISO (paragraphs 14 to 18)
The board approves a cyber risk policy at least annually, which can be a section of the operational risk policy. A qualified employee or an experienced outsourced resource acts as CISO and delivers the operational cyber risk management program. Smaller firms may give the duties to a risk executive. The board remains responsible for outsourced activity.
- Risk assessment (paragraphs 20 and 21)
The assessment moves through identification, measurement, response and monitoring, and the Code expects a risk register. Assessments are documented and kept for at least five years so they can be produced to the Authority on request.
- Outsourcing and cloud (paragraphs 26 to 30)
Outsourced functions get the same oversight as internal ones. Service agreements must cover compliance with Bermuda law, cooperation with the Authority and timely access to data and records. Cloud use needs a risk assessment covering governance, legal issues, compliance and audit, and information governance.
- Notification of cyber reporting events (paragraphs 41 to 44)
A cyber reporting event is any act that causes unauthorized access to, disruption or misuse of systems or information. Only events with significant adverse impact must be reported. An officer notifies the BMA within 72 hours of determination or confirmation, whichever is sooner, and an incident report follows within 14 days. Incident logs are kept for five years.
- Detect and protect controls (paragraphs 45 to 65)
The Code requires annual staff training, encryption of non-public data at rest and over public networks, controls against malicious code, a security testing program that includes regular independent penetration testing of internet-facing services, documented patching, and logging and monitoring with an assessment of requirements.
- Response and recovery (paragraph 66)
Firms run a documented business impact analysis and test business continuity and disaster recovery plans at least annually, documenting the tests and tracking issues to remediation. Tabletop incident response exercises are expected every year (paragraph 39).
What does it cover?
The Codes apply to firms licensed or registered by the Bermuda Monetary Authority in the sectors named in each Code: insurers, insurance managers and intermediaries (October 2020 Code), and banks, deposit companies, corporate service providers, trust companies, money service businesses, investment businesses and fund administration providers (September 2022 Code). Digital asset businesses are covered by a separate BMA cyber code that this page does not describe.
What are its objectives?
The Codes set duties, standards and principles for operational cyber risk management.
Give the board and senior management oversight of cyber risk, with an annual policy approval.
Deliver an operational cyber risk management program through a qualified CISO.
Identify, measure, respond to and monitor cyber risk in a documented, retained risk assessment.
Keep outsourced and cloud services under the firm's own governance standards.
Report significant cyber events to the BMA within 72 hours and file an incident report within 14 days.
Test business continuity, disaster recovery and incident response at least annually.
Framework in Context
The Codes sit under the BMA's prudential regime and are read together with the Outsourcing Guidance Notes 2019 and, for insurers, the sector codes of conduct for insurance, insurance managers, and brokers and agents. The Code refers to NIST and ISO standards as best practice, which is why firms commonly map it to ISO/IEC 27001 and the NIST Cybersecurity Framework.
Common Framework Mappings
The BMA Cyber Risk Management Code of Conduct is commonly mapped to leading international cybersecurity and resilience frameworks to support benchmarking, simplify compliance efforts, and strengthen risk management across regulatory environments.
Mapped frameworks include:
CIS Critical Security Controls
Digital Operational Resilience Act (DORA)
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27017
ISO/IEC 27701
NIST Cybersecurity Framework
SOC 2
How SmartSuite Supports BMA Cyber Code
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk and Compliance Management records to hold the annual board-approved cyber risk policy, the risk register, incident logs and the evidence a BMA supervisor can ask for.
Cyber Risk Policy and CISO Accountability
Record the annual board approval of the cyber risk policy, the named CISO and the outsourced-resource oversight the Code requires (paragraphs 14 to 18).
Risk Register with Five-Year Retention
Track each risk through identification, measurement, response and monitoring, and keep the assessment history for the five-year minimum (paragraphs 20 and 21).
72-Hour Notice and 14-Day Report Tracking
Log each cyber reporting event with its determination time, notice date and incident report due date, using automations to notify owners as dates approach (paragraphs 43 and 44).
Outsourcing and Cloud Oversight
Keep each provider's service agreement terms, cloud risk assessment and responsible party in linked records (paragraphs 26 to 30).
Annual Testing and Training Evidence
Schedule the yearly tabletop exercise, staff training, penetration test and business continuity and disaster recovery test, and attach results and remediation items (paragraphs 39, 47, 56 and 66).
Board and Supervisor Reporting
Build dashboards of open risks, incident timelines and test status for the board and for BMA requests.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
DORA (Regulation (EU) 2022/2554) requires EU financial entities to manage ICT risk, report major incidents, test resilience and control ICT third-party risk, applying from January 17, 2025.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For Bermuda BMA Cyber Risk Management Code of Conduct (BMA Cyber Code)
The Code applies to firms the Bermuda Monetary Authority licenses or registers. Insurers, insurance managers and intermediaries follow the Insurance Sector Code (October 2020, in force January 1, 2021). Banks, deposit companies, corporate service providers, trust companies, money service businesses, investment businesses and fund administration providers follow the Code revised in September 2022. Digital asset businesses have a separate BMA code.
An officer must notify the Authority within 72 hours from the time the firm determines or confirms a reportable cyber event, whichever is sooner. An incident report with the root cause, actions taken and any impact follows within 14 days of the initial notice (paragraph 43 of the September 2022 Code). Only events with significant adverse impact must be reported, and firms in doubt should consult the BMA.
The board and senior management must oversee cyber risk, and the board must approve a cyber risk policy at least annually. Regular updates on cyber risk status must reach the board, and the board stays responsible for outsourced activity, including an outsourced CISO (paragraphs 14 and 17).
The BMA assesses compliance relative to the nature, scale and complexity of the business, considered together rather than separately. A small firm with a complex business is still expected to maintain a sophisticated risk management framework (paragraph 12).
Risk assessments must be documented and kept for at least five years, and incident investigation and response logs must be kept for a minimum of five years and be available to the BMA at any time (paragraphs 21 and 44).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.