Cyber & IT Security Law And Regulation Guide 2025: Bermuda

Introduction

By the end of the last decade, the incidence rate of cybercrime, ransomware attacks and online security threats had escalated to levels where legislators and regulators around the world were stepping up the nature and quality of laws and regulation that were being specifically designed to address those governance and risk management challenges. As the decade closed, regulators such as the SEC began introducing draft cybersecurity risk management, governance and reporting rules (enacted July 2023), and both the Financial Conduct Authority and the Prudential Regulation Authority in the UK had made it clear that cyber risk had become a material business risk that registrants must prudently, diligently and effectively address in the management, governance and supervision of all their related operations. At the same time, similar regulatory developments were initiated by Canada's Office of the Superintendent of Financial Institutions (Canada's regulator of