GABCOENTERPRISES Book
A security analyst's desk with monitoring screens
  1. Home
  2. Cyber Security
  3. CIMA cybersecurity rule compliance

CIMA's cybersecurity rule, made practical.

Since November 2020, CIMA has required regulated entities to run a cybersecurity framework proportionate to their size and risk, approved by the board. Most firms have policies. Fewer can show the framework working.

Book a consultation All of Cyber Security
What it covers

CIMA cybersecurity rule compliance

Gap analysis against the rule

Your governance, controls and records measured against what the rule requires, with every gap rated and paired with a fix.

Board approved framework

A framework and policy set the board can approve with confidence, and reporting that keeps it informed.

Risk assessment

Threats, vulnerabilities and impacts assessed for your business, and reviewed regularly.

Incident response and notification

A plan that names who decides an incident is material and who notifies CIMA, within the 72 hour limit.

Outsourcing and cloud oversight

Cybersecurity expectations applied to your IT providers and cloud platforms, with due diligence on record.

Evidence and mock inspection

Records organised and a mock inspection run, so management is ready for supervisory questions.

  • CIMA Rule on Cybersecurity
  • NIST CSF 2.0
  • ISO/IEC 27001
  • Cayman Data Protection Act

How we do it

  1. Map

    Your obligations under the rule confirmed.

  2. Assess

    Controls and records tested against them.

  3. Remediate

    Gaps closed, highest risk first.

  4. Evidence

    Records maintained and reviewed each year.

Field notes

Worth knowing

2020November

The rule is not new

The CIMA Rule on Cybersecurity for Regulated Entities has been in force since November 2020. Inspectors expect a mature framework by now, not a first draft.

Source: CIMA

72hours

Notify CIMA within 72 hours

Regulated entities must notify CIMA immediately, and no later than 72 hours after discovering a material cybersecurity incident.

Source: CIMA Rule on Cybersecurity for Regulated Entities

5days

A second clock may also be running

If personal data is involved, the Data Protection Act requires notice to the Ombudsman and affected people within five days.

Source: Data Protection Act (2021 Revision), section 16

What you receive

  • Gap analysis against the CIMA rule
  • Cybersecurity framework and policy set
  • Risk assessment and treatment plan
  • Incident response plan with notification steps
  • Mock inspection report and evidence pack

Questions

Who does the CIMA cybersecurity rule apply to?

Entities regulated by CIMA. The requirements are proportionate, so a small firm's framework can be simpler than a bank's, but it must exist and be approved by the board.

What counts as a material cybersecurity incident?

One that significantly affects your operations, clients, data or reputation. Your incident plan should define the criteria in advance, so nobody debates it during an incident.

Can our IT provider handle compliance with the rule?

They can operate many of the controls, but the board remains accountable. Someone independent of daily operations should check the framework works.

More on Cyber Security

Talk to us about CIMA cybersecurity rule compliance

Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.

info@gabcoenterprises.com+1 345 769 4222
Book a consultation