Update to the Schedule of Cyber Risk Management (2021-12-17)

Summary

This is a notice from the Bermuda Monetary Authority updating the Schedule of Cyber Risk Management that insurers must file under Section 15A of the Insurance Returns and Solvency Regulations 1980. It applies to Class 1, 2, 3, A and B insurers, and sets out how the updated Schedule should be completed for the 2021 year-end filing.

• Self-managed (re)insurers: Must complete and file the full updated Schedule of Cyber Risk Management.
• Insurance manager managed (re)insurers: Only need to complete the first two questions of the Schedule and are otherwise waived, provided the insurance manager files the Schedule and confirms responsibility for IT services and cyber risk controls.
• Filing method: The Schedule must be filed as an attachment alongside the Electronic Statutory Financial Return (E-SFR) by the required deadline.
• Reference material: The Insurance Sector Operational Cyber Risk Management Code of Conduct (October 2020) may be used for further guidance.

The updated Schedule is also available on the BMA website as part of the Year-end Limited Purpose Insurers Supporting Documents Workbook. Queries should be directed to ESFRApplications@bma.bm.

Key obligations

• Self-managed (re)insurers must complete and file the full Schedule of Cyber Risk Management for the 31 December 2021 year-end filing, on a best efforts basis.
• (Re)insurers reliant on an insurance manager for IT services and cyber risk controls must complete only the first two questions of the Schedule, unless they notify BMA that the insurance manager is not responsible for cyber risk controls, in which case fuller completion may be required.
• Insurance managers relying on the waiver provision must complete and file the Schedule confirming their responsibility for IT services and implementation of cyber risk controls.
• The completed Schedule must be filed as an attachment alongside the Electronic Statutory Financial Return (E-SFR) by the required deadline.

Applies to

Class 1 insurers, Class 2 insurers, Class 3 insurers, Class A insurers, Class B insurers, insurance managers

Deadlines

• 31 December 2021: Year-end filing date for which the updated Schedule of Cyber Risk Management should be completed on a best efforts basis.