99.2%
MFA blocks most account takeovers
Microsoft research found multi factor authentication blocks over 99.2% of account compromise attacks. For exchange and custody staff it is the minimum.
Source: Microsoft
- Home
- VASP Readiness
- VASP cybersecurity and key management
Security built around the keys.
For a virtual asset business, a compromised key is a permanent loss. Your cybersecurity framework has to protect keys and wallets as carefully as a bank protects its vault, and show CIMA that it does.
What it covers
VASP cybersecurity and key management
Governance and risk assessment
A board approved framework with defined roles, a risk assessment and regular reporting, as CIMA's rule requires.
Wallet and key management
Key generation, storage, backup and recovery, multi signature or MPC controls and segregation of duties, documented and tested.
Access control
Privileged access limited, multi factor authentication enforced and access reviewed on a schedule.
Monitoring and detection
Logging and alerting across systems, wallets and cloud platforms, with someone responsible for responding.
Incident response
A tested plan covering containment, client communication and CIMA notification within 72 hours.
- CIMA Rule on Cybersecurity
- NIST CSF 2.0
- ISO/IEC 27001
- CCSS
How we do it
Assess
Threats and current controls reviewed.
Design
A proportionate framework and policies drafted.
Implement
Controls put in place and evidence recorded.
Test
Tabletop exercises and control testing run.
Field notes
Worth knowing
72hours
The CIMA clock starts at discovery
Material cybersecurity incidents must be notified to CIMA no later than 72 hours after discovery.
Source: CIMA Rule on Cybersecurity for Regulated Entities
What you receive
- Cybersecurity framework and policies
- Wallet and key management procedures
- Access control and review records
- Incident response plan and tabletop results
- Board reporting template
Questions
What does CIMA expect from a VASP cybersecurity framework?
A framework proportionate to the size, complexity and risk of the business, approved by the board, covering governance, risk assessment, protection, detection, response and recovery.
Do you design custody technology?
We do not build wallets. We document and test the controls around them, and assess the custody technology and providers you use.
How often should incident response be tested?
At least annually, and after major changes. A tabletop exercise is a practical, low cost way to do it.
More on VASP Readiness
Talk to us about VASP cybersecurity and key management
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.
info@gabcoenterprises.com+1 345 769 4222