Meet the BMA Cyber Risk Code with evidence ready for the Authority

The BMA Cyber Risk Code is the Insurance Sector Operational Cyber Risk Management Code of Conduct, published by the Bermuda Monetary Authority in October 2020. It sets minimum and recommended cyber security standards for Bermuda's insurance sector, grouped into identification of assets and risks, detect and protect controls, and response and recovery controls. It was issued under section 2BA of the Insurance Act 1978.

All Bermuda registered insurers, insurance managers and intermediaries must comply. Intermediaries include insurance agents, brokers and insurance marketplace providers. The BMA applies the code proportionately to each firm's nature, scale and complexity, and limited purpose insurers may rely on their insurance manager to confirm that the services it provides meet the code.

The code came into force on 1 January 2021, and registrants had to be fully compliant by 31 December 2021. Firms registered since then are expected to meet it from the start of their registration, scaled to the nature, scale and complexity of their business.

A cyber reporting event with significant adverse impact must be notified to the BMA within 72 hours of it being determined or confirmed, whichever is sooner. The principal representative or an appropriate officer makes the notification. A full incident report, covering root cause, actions taken and impact, must follow within 14 days, and incident response logs must be kept for at least five years.

Failure to comply is a factor the BMA takes into account when deciding whether a registrant is conducting its business in a sound and prudent manner. That assessment underpins a firm's registration, so persistent gaps can lead to supervisory action under the Authority's existing powers. The code itself does not set a separate fine schedule.

The code is not a certification, but it explicitly treats recognised standards such as NIST and ISO as best practice. Many of its requirements, including asset inventory, access management, cryptography, logging, supplier management and business continuity, overlap with ISO 27001 controls. A firm with a working ISO 27001 information security management system will already hold much of the evidence the BMA expects, though Bermuda-specific items like 72-hour reporting still need covering.

Key requirements include an annually approved board cyber risk policy, a designated CISO, an operational cyber risk management programme with documented risk assessments, three lines of defence, third-party and cloud risk assessment, staff vetting and annual awareness training, encryption of nonpublic data, patch management, penetration testing, logging and monitoring, and business continuity and disaster recovery plans tested at least annually.

Yes. OneClickComply supports the BMA Cyber Risk Code today. Because controls are mapped across frameworks, evidence you collect for ISO 27001, SOC 2 or other standards also counts towards the code. Automated evidence collection, AutoComplete policies and continuous monitoring cover its requirements, and our in-house audit team can advise on how the proportionality principle applies to you.