GABCOENTERPRISES Book
A consultant talking with a client across a meeting table
  1. Home
  2. Who we serve
  3. Corporate service providers

IT and cyber security for corporate service providers.

Company managers and corporate service providers hold registers, documents and personal data for every client entity they administer. CIMA expects that information to be secure, available and accounted for. We make sure it is, and that you can show it.

Obligations

The rules you answer to

What each one asks of your technology. Your legal and compliance advisers confirm how they apply to your licence.

CIMA

Rule on Cybersecurity for Regulated Entities

  • Applies to entities regulated by CIMA, which includes licensed corporate service providers.
  • A cybersecurity framework approved by your board, sized to your business and its risks.
  • Notify CIMA no later than 72 hours after discovering a material cybersecurity incident.
Read the CIMA rule guide
OUTSOURCING

Outsourced IT stays your responsibility

  • Under section 6.5 of the Rule, you remain ultimately responsible for IT functions you outsource.
  • You must assess your providers against the Rule and CIMA’s outsourcing guidance.
  • That covers hosted practice management systems, email and cloud storage.
Read the outsourcing guide
PERSONAL DATA

Data Protection Act (2021 Revision)

  • Client, director and beneficial owner records are personal data.
  • Protect them with appropriate technical and organisational measures.
  • Report a personal data breach to the Ombudsman and the people affected within five days.
Read the breach notification guide
Common gaps

Where the gaps usually are

What reviews, audits and incidents tend to find first.

  • Too many people can see too muchClient entity folders open to the whole firm, and access for leavers removed late or not at all.
  • Payment instructions arrive by emailBusiness email compromise targets firms that move money on behalf of clients. A call back to a known number stops most of it.
  • Registers and records live in spreadsheetsNo audit trail, several versions, and no quick way to produce a record when CIMA or a client asks.
  • The practice management system is outsourced and unexaminedThe vendor hosts it, but nobody has checked their controls or what happens if they fail.
  • Board minutes say little about technology riskAn approved framework means little if the board never sees how it is working.
How we help

Where we fit in

Take one service or several, under one agreement and one named lead.

Free tools

See where you stand

Work through them on screen. Nothing is sent unless you ask for a copy.

Questions

Does CIMA’s cybersecurity rule apply to corporate service providers?

The Rule applies to entities regulated by CIMA, so a licensed corporate service provider is in scope. It expects a board approved cybersecurity framework, risk assessment, oversight of outsourced IT and notice to CIMA within 72 hours of a material incident. Your legal advisers confirm how it applies to your licence.

Our practice management system is hosted by the vendor. Are we still responsible?

Yes. Section 6.5 of the Rule says regulated entities remain ultimately responsible for outsourced IT functions and their cybersecurity, and must assess the provider against the Rule. We help you do that assessment and keep the record.

Can you work alongside our existing IT provider?

Yes. Many firms keep their day to day provider and use us for security leadership, assessments and board reporting, or for hands on support in Grand Cayman.

Let’s talk about your firm.

Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.

info@gabcoenterprises.com+1 345 769 4222
Book a consultation