72hours
CIMA expects to hear fast
Regulated entities must notify CIMA no later than 72 hours after discovering a material cybersecurity incident.
Source: CIMA Rule on Cybersecurity for Regulated Entities
- Home
- Cyber Security
- Incident response and breach notification
The first 72 hours, planned in advance.
An incident is the worst time to decide who is in charge. A tested response plan sets roles, decisions and notification steps in advance, so the first hours are spent containing damage, not arguing about process.
What it covers
Incident response and breach notification
Response plan and roles
Who leads, who decides, who talks to clients and regulators, and who to call outside the business.
Playbooks
Step by step responses for the likely scenarios: ransomware, compromised email, lost devices and data leaks.
Notification steps
The criteria, owners and templates for notifying CIMA, the Ombudsman, affected people, insurers and clients.
Logging and evidence
The logs you will need to answer 'what happened', switched on and kept long enough.
Tabletop exercises
Management walked through a realistic scenario, with lessons fed back into the plan.
- NIST SP 800-61
- CIMA Rule on Cybersecurity
- Cayman Data Protection Act
How we do it
Prepare
Plan, roles and contacts agreed.
Equip
Playbooks, templates and logging in place.
Exercise
A tabletop exercise with management.
Improve
Lessons learned built into the plan.
Field notes
Worth knowing
5days
A lost laptop can start a legal clock
Personal data breaches must be reported to the Ombudsman and the people affected within five days. Encryption can change what you must report.
Source: Data Protection Act (2021 Revision), section 16
14days
Deleted email does not wait
Exchange Online keeps deleted items recoverable for 14 days by default. Evidence can be gone before an investigation starts.
Source: Microsoft
What you receive
- Incident response plan
- Scenario playbooks
- Notification decision tree and templates
- Logging and retention recommendations
- Tabletop exercise report
Questions
Do we need an incident response plan if we have cyber insurance?
Yes. Insurers increasingly ask for one, and the policy pays for help after an incident; it does not make the early decisions for you.
How often should we test the plan?
At least once a year, and after significant changes to people, systems or providers.
What should we do first if we suspect an incident?
Follow your plan: contain without destroying evidence, inform the incident lead and start a written log of decisions and times.
More on Cyber Security
Talk to us about incident response and breach notification
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.
info@gabcoenterprises.com+1 345 769 4222