Bermuda BMA Cyber Risk Code

No changes recorded yet — we are watching, and nothing has been published.

1. 2021-12-31 Registrants must be in compliance with the Code
2. 2021-01-01 The Code comes into force
3. 2020-10-06 The Code is published by the Bermuda Monetary Authority

1. 2020-10-06
   Insurance Sector Operational Cyber Risk Management Code of Conduct (October 2020) Major versionCurrent

   The Code was published, coming into force on 1 January 2021 with compliance required by 31 December 2021. source

Every Bermuda registered insurer, insurance manager and intermediary, applied in proportion to the nature, scale and complexity of the business.

Registrants

All Bermuda registered insurers, insurance managers and intermediaries (agents, brokers and insurance marketplace providers), collectively "registrants". source

Proportionality

The Authority assesses compliance in proportion to the registrant's nature, scale and complexity, considered together. source

Board

The board must approve a cyber risk policy at least annually and have oversight of cyber risks, with regular status updates. source

CISO

The CISO role must be allocated to a qualified staff member or an outsourced resource; if outsourced, oversight stays with the board. source

Third parties

Registrants that outsource IT, for example to an insurance manager, must include a review of those third-party services in their assessment of cyber risk. source

Registrants run their own cyber risk programme under three lines of defence, with a board policy approved every year and an IT audit plan.

Programme

An operational cyber risk management programme with a risk assessment process, data governance and security controls, and detection, protection, response and recovery controls. source

Three lines of defence

Cyber risk governance follows operational management, risk management and audit. source

Shall and should

"Shall" or "must" is mandatory, or a comparable or higher standard; "should" may be departed from with a documented valid reason. source

Non-compliance counts against a registrant's duty to conduct business in a sound and prudent manner; cyber reporting events go to the Authority within 72 hours.

Sound and prudent

Failure to comply with the Code is a factor the Authority takes into account in deciding whether a registrant is conducting its business in a sound and prudent manner. source

72-hour notice

Cyber reporting events, such as those likely to adversely impact policyholders, clients or the insurance business, must be notified to the Authority within 72 hours of determination or confirmation, whichever is sooner. source

Incident report

A report on the incident, its root cause, actions taken and impact is due within 14 days of the initial notification. source

1. Law text Insurance Sector Operational Cyber Risk Management Code of Conduct (PDF)
2. Guidance BMA policy and guidance — insurance

1. NYDFS Part 500

   New York's cybersecurity regulation for financial services firms, including insurers licensed there; the BMA Code covers Bermuda registered insurers and intermediaries.

2. APRA CPS 234

   Australia's binding information security standard for APRA-regulated entities, including insurers.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Bermuda BMA Cyber Risk Code (RSS)