Aerial view of the Grand Cayman coastline and reef

Home
Resources

Cayman IT and compliance resources.

Name: GABCO Enterprises
Address: PO Box 1184, George Town, Grand Cayman, KY1-1503, KY
Telephone: +1 345 769 4222

Plain explanations of the rules, dates and facts that shape technology decisions in the Cayman Islands, each linked to the detail.

The rules, explained

Three laws every Cayman IT plan answers to.

What each one asks of your technology, in plain language. Your legal and compliance advisers confirm how they apply to you.

CIMA

Rule on Cybersecurity for Regulated Entities

In force since November 2020.
A cybersecurity framework sized to the business and its risk, approved by the board.
Notify CIMA immediately, and no later than 72 hours after discovering a material incident.

Read the CIMA rule guide

VIRTUAL ASSETS

Virtual Asset (Service Providers) Act

VASPs register with or are licensed by CIMA.
Custodians and trading platforms have needed a licence since April 2025.
Applications cover systems, security, continuity and outsourcing.

Read the VASP licensing guide

PERSONAL DATA

Data Protection Act (2021 Revision)

Personal data protected with appropriate technical and organisational measures.
Breaches reported to the Ombudsman and affected people within five days.
Transfers abroad only where the destination protects data adequately.

Read the breach notification guide

Key dates

Dates to plan around.

Support deadlines, standards and the season that most often turn into unbudgeted work.

31 Mar 2025In effect
PCI DSS v4.0 future dated requirements became mandatory.
Read more
Apr 2025In effect
Virtual asset custodians and trading platforms need a CIMA licence.
Read more
14 Oct 2025Passed
Windows 10, Exchange Server 2016 and Exchange Server 2019 left support.
Read more
31 Oct 2025Passed
ISO/IEC 27001:2013 certificates expired; certification is now to the 2022 version.
Read more
12 Jan 2027Upcoming
Windows Server 2016 extended support ends. No more security fixes.
Read more
1 Jun to 30 NovEvery year
Atlantic hurricane season. Test recovery before it starts.
Read more

Field notes

Six facts most Cayman firms learn too late.

Each one is sourced, and links to the service that handles it.

72hours

CIMA expects to hear about a material cyber incident fast

Regulated entities must notify CIMA immediately, and no later than 72 hours after discovering a material incident. Few firms have rehearsed who sends that notice, or what it says.

Get an incident plan

Source: CIMA Rule on Cybersecurity for Regulated Entities

5days

A lost laptop can start a legal clock

Controllers must report a personal data breach to the Ombudsman and the people affected within five days. A stolen laptop with an encrypted drive is a hardware problem; without encryption it can be a reportable breach.

Get managed devices

Source: Data Protection Act (2021 Revision), section 16

14days

Microsoft 365 is not a backup

Exchange Online keeps deleted items recoverable for 14 days by default, extendable to 30. Under Microsoft's shared responsibility model, keeping your own copy of your data is your job.

Get Microsoft 365 backup

Source: Microsoft Learn, Exchange Online retention

12Jan 2027

Windows Server 2016 stops getting security fixes

Extended support ends on 12 January 2027. Servers still running 2016 after that date run unpatched, and unsupported systems are among the first findings in any audit.

Plan a server refresh

Source: Microsoft Lifecycle Policy

99.2%

Multi factor authentication stops most account takeovers

Microsoft found MFA blocks over 99.2% of account compromise attacks. Text message codes are the weakest kind; app approval with number matching, or passkeys, hold up far better.

Request a security review

Source: Microsoft Security research

15°F

Heat halves the life of your UPS batteries

Sealed lead acid UPS batteries are rated at 77°F. Roughly every 15°F above that halves their life, so a warm comms cupboard can kill a battery in a year or two, right before the power cut.

Request a site survey

Source: battery manufacturer and IEEE guidance

Guides

Every guide, by service.

In depth pages on specific parts of each core service.

Virtual CIO

IT strategy and roadmapA costed, multi year plan that ties every technology spend to a business goal.
Technology governance and board reportingPolicies, a risk register and plain board reporting on technology risk.
Vendor and contract managementSupplier selection, service levels and renewals, managed by one accountable owner.

Cyber Security

CIMA cybersecurity rule complianceWhat the rule requires, where firms fall short and how to evidence it.
Penetration testingExternal, internal, web and cloud tests, with every finding retested.
Virtual CISO and managed complianceOne accountable security leader, and compliance run all year round.
Incident response and breach notificationA tested plan for the first 72 hours, including CIMA and Ombudsman notices.

VASP Readiness

CIMA registration and licensing supportThe technology, security and continuity sections of your application, with evidence.
VASP cybersecurity and key managementA proportionate framework covering wallets, keys, access and incident response.
Outsourcing and provider oversightDue diligence and monitoring that prove you oversee every material provider.

AI Advisory

Microsoft 365 Copilot readinessFix oversharing and label sensitive data before Copilot can find it.
AI policy and governanceAn acceptable use policy and a framework for every AI tool your staff touch.
Workflow automation and reportingPower Automate for routine work and Power BI for numbers management trusts.

Cloud

Microsoft 365 setup and securityTenant setup, migration, Intune and hardening done properly once.
Azure and AWS migrationReadiness, landing zones and phased migration with a cost comparison.
Microsoft 365 backup and recoveryIndependent backup for mail, OneDrive, SharePoint and Teams.

On Premises Infrastructure

Backup and disaster recovery3 2 1 backup, immutable copies and restore tests that prove it works.
Hurricane season IT preparednessPower, cooling, shutdown and recovery planned before June, every year.
Network, firewall and Wi-FiSegmented networks, reviewed firewall rules and Wi-Fi that covers the building.
Windows Server 2016 end of support12 January 2027: your options and a plan to move before the date.

Managed IT Services

Help desk and user supportOne number, every request logged and prioritised by business impact.
Monitoring and patch managementSystems watched around the clock and updates deployed on a schedule.
Endpoint security and device managementEDR, email filtering, MFA and encryption managed and reviewed.

Professional IT Services

IT project managementA named lead who controls scope, schedule, budget and risk to closure.
System selection and RFPsRequirements, RFPs and scored demos that end in a clear recommendation.
Migrations and implementationsMicrosoft 365, email, ERP and data migrations with tested cutover plans.
On site technical supportHands on the ground in Grand Cayman, for your team or your IT provider overseas.

Questions about your obligations?

Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.

info@gabcoenterprises.com+1 345 769 4222

Book a consultation