On 7 October 2026, the Cayman Islands Monetary Authority (CIMA) opened consultation on a proposed Rule and Statement of Guidance on Cybersecurity and Incident Reporting for Regulated Entities, the "RSOG". It would bring CIMA's existing cybersecurity rule and guidance, first issued in 2020, together into one document and tighten how regulated firms report incidents.
Let's be clear from the start. If your business isn't regulated by CIMA, none of this is mandatory for you. The RSOG applies to CIMA-regulated entities such as banks, trust companies and insurers, and it excludes regulated mutual funds and private funds. It's also still a proposal. Only private-sector associations can respond, and their responses are due by 10 November 2026. The final rule would take effect within three months of being published in the Gazette.
So why should a small business in Cayman care? Because it's one of the clearest, most practical cybersecurity checklists we've seen. CIMA has spelled out what it expects from organisations that hold money and sensitive data. Most of it scales down neatly. Even for regulated firms, the proposed RSOG (section 4.2) says it should be applied "in accordance with the proportionality principles, that is, commensurate to the size, complexity, structure, nature of business and risk profile of their operations".
Here's what the proposal asks of regulated firms, and what we think the small-business version looks like.
1. The 72-hour reporting window
What CIMA proposes: regulated firms must tell CIMA about a material incident "without undue delay", and no later than 72 hours after they become aware of it. The 72-hour limit isn't new. What's new is the clear statement that the clock starts at awareness, plus a requirement that internal procedures set out reporting timelines and are actually followed. Reports must go through CIMA's digital form and secure portal.
The small-business version: you probably don't have a regulator to report to, but you do have customers, staff and perhaps an insurer who'll want answers. Ask yourself honestly: if something went wrong this morning, could you explain what happened by Friday?
That depends almost entirely on logs. Microsoft 365 records sign-ins, mailbox activity and admin changes, but standard retention is limited, and many small businesses never look at those logs until they need them. Collecting them into a SIEM (a security information and event management system that gathers and keeps logs in one place) means the evidence is there when you need it.
2. Breaches at vendors and outsourced providers
What CIMA proposes: new reporting triggers include breaches at third-party or outsourced vendors, alongside compromised private keys or wallets, financial loss, and extended service outages affecting customers. In other words, "it happened at our supplier" no longer gets a regulated firm off the hook.
The small-business version: your accountant, your payroll provider, your line-of-business software and your IT company can all hold or reach your data. You don't need a formal vendor-risk programme. You do need to know who has access, and to make sure they'd tell you quickly if something happened on their side.
3. A trained incident response team and an accountable senior officer
What CIMA proposes: a suitably qualified senior officer must be accountable for the cybersecurity framework, and a trained incident response team becomes mandatory.
The small-business version: name one person, usually the owner or general manager, who makes the calls when something goes wrong. Write down a one-page plan covering who to phone, what to switch off, and who talks to customers. If you have an IT partner, agree in advance what they'll do and how fast. A plan nobody has read is barely better than no plan, so walk through it together once a year.
4. An outsourcing log
What CIMA proposes: regulated firms must tell CIMA about changes to material cybersecurity or critical IT outsourcing arrangements, including new and terminated ones, and should keep a central log of those arrangements that CIMA can see on request. Arrangements within a group of companies are covered too.
The small-business version: a simple spreadsheet is enough. List each supplier, what they do, what data they can reach, who your contact is, and when you last checked their access. When you stop using a supplier, remove their access the same week. Forgotten accounts belonging to former vendors are one of the easiest ways in for an attacker.
5. A documented decision on cyber insurance
What CIMA proposes: a firm that decides not to buy cyber insurance should back that decision with a documented risk assessment.
The small-business version: cyber insurance isn't right for everyone, but the decision should be a deliberate one. Spend half an hour working out what a week without email, or a fraudulent payment, would actually cost you, then decide. Write down what you decided and why. If you do buy cover, read the security conditions in the policy closely: many insurers now expect multi-factor authentication (MFA), backups and endpoint protection before they'll pay out.
6. Five-year evidence retention
What CIMA proposes: incident reports and supporting evidence must be kept for at least five years.
The small-business version: when something happens, keep the record: what happened, when you found out, what you did, and the supporting logs or emails. A dispute, an insurance claim or a client question can come up long after the incident itself. Logs held in a SIEM and a simple incident register make that easy.
7. Vendor security questions are coming for suppliers
This last point isn't in the RSOG itself. It's our view of what follows from it.
If regulated firms have to report breaches at their vendors and keep track of their outsourcing, it's reasonable to expect them to ask more of the businesses that supply them. If you provide services to a bank, trust company, insurer or fund administrator in Cayman, expect more security questionnaires asking things like:
- Do all your staff use multi-factor authentication?
- Are your laptops and phones managed, encrypted and kept up to date?
- Do you keep and monitor sign-in and security logs?
- Who would tell us if you had a breach, and how quickly?
Having good answers ready doesn't just keep you on the supplier list. It's a real advantage over competitors who don't have them.
Where ICT 365 can help
We work with small and growing businesses across Cayman and the Caribbean that want the benefit of this checklist without the weight of a regulated firm's compliance programme. Practically, that usually means:
- SIEM log setup for Microsoft 365, so sign-in, mailbox and admin activity is collected, kept and searchable when you need it.
- Managed endpoint protection, so every laptop and phone is patched, encrypted and monitored.
- SOC monitoring, where a security operations centre watches for unusual activity and responds to it, so someone is paying attention when you're not.
Start with a free Microsoft 365 security report
For most businesses, Microsoft 365 is where the email, files and sign-ins live, so it's the best place to start. Our free Microsoft 365 security report shows where your Microsoft 365 setup stands today and which fixes are worth making first. It doesn't commit you to anything.
ICT 365, IT services across the Caribbean
- Email: sales@ict365.ky
- Phone: +1 (345) 745-0365, Monday to Friday, 8am to 5pm
- Web: https://ict365.ky
---
Sources
- Harneys, CIMA consults on consolidated cybersecurity and incident reporting framework, 2 November 2026
- CIMA, Private Sector Consultation: Rule and Statement of Guidance on Cybersecurity and Incident Reporting for Regulated Entities, October 2026
- CIMA, Appendix I: proposed Rule and Statement of Guidance, October 2026
- CIMA, Consultation page
*This article is general information, not legal or regulatory advice. Regulated entities should rely on CIMA's published documents and their own advisers.*
Client name has been intentionally removed from this case study to protect confidentiality. References are available upon request.