BMA Cyber Supervision Has Moved On-Site. What It Will Ask to See.

The BMA's reports are not opinion pieces. They are drawn from filing return data submitted by every commercial insurer, insurance manager, and insurance agent and broker operating in Bermuda. The numbers paint a specific picture.

Ninety-seven per cent of entities report having a board-approved cyber risk policy. Ninety-nine per cent say they regularly communicate cyber risk updates to senior management and boards. Those headlines sound reassuring. The detail is less comfortable.

Twenty-one per cent of entities — roughly one in five — have not completed the classification of their data. Data classification is not an advanced capability. It is a foundational control: knowing what data you hold, how sensitive it is, and how it should be protected. Section 5.9 of the code requires information to be classified by value, legal requirements, sensitivity and criticality. A carrier that had not completed this three years after compliance was due, at the end of 2021, cannot meaningfully claim to be managing its cyber risk, regardless of what its board-approved policy says.

Third-party cyber risk management declined slightly in 2024. Eighty-six per cent of entities reported reviewing the cyber risks associated with outsourced IT providers in the past twelve months, down from eighty-seven per cent a year earlier. Among commercial insurers specifically, that figure dropped from ninety per cent to eighty-five per cent. In a market where outsourcing is the operational model, a decline in third-party cyber oversight is a decline in operational security.

These numbers reveal a pattern I saw repeatedly inside the Bank of England and across large financial institutions: the governance layer is in place, but the operational substance behind it is thin.

A board-approved cyber risk policy is necessary but not sufficient. The policy is a document. What matters is whether the organisation has actually implemented the controls the policy describes.

Cyber risk does not exist in isolation. This is the point most carriers miss and most consultants fail to address.

The BMA's own regulatory structure makes the intersection explicit. Section 6.10 of the Insurance Sector Operational Cyber Risk Management Code of Conduct requires that personally identifiable information be handled in accordance with applicable privacy laws. A cyber breach is therefore simultaneously a potential PIPA violation — with fines of up to $250,000 for a company and a duty to notify the Privacy Commissioner without undue delay. A carrier that treats its cyber incident response and its PIPA breach response as separate processes will find itself managing two regulatory crises instead of one, with conflicting timelines and different reporting obligations.

The new Operational Resilience and Outsourcing Code adds a third dimension. A cyber event that disrupts an important business service is an operational resilience event. The carrier must demonstrate that it remained within its impact tolerances during the disruption, that it communicated appropriately with the BMA, and that its outsourced providers maintained their own resilience. Three regulatory instruments. One incident. Three different compliance obligations triggered simultaneously.

And as carriers adopt AI-powered tools for underwriting, claims processing, and risk assessment — as the BMA's August 2026 AI governance consultation anticipates — a fourth dimension emerges. A cyber compromise of an AI system is a cyber event, a potential PIPA breach (if the AI processes personal data), an operational resilience event (if the AI supports an important business service), and a potential AI governance failure (if the AI's outputs can no longer be trusted). Four regulatory domains, one incident.

The code is organised in three sections: identification of assets and risks, detect and protect controls, and response and recovery. Mapping the BMA's own data against five of its requirements shows where the sector stands.

Strong on paper. Ninety-seven per cent have approved policies. But board reporting quality is untested — the BMA's on-site reviews will assess whether boards receive actionable intelligence or generic assurance.

Most entities have one. Whether it is proportionate to their actual risk profile — rather than copied from a group parent or downloaded from a consultancy — is the question the BMA will ask.

This is where data classification sits. At twenty-one per cent non-compliance, the sector has a foundational gap that undermines everything above it. Without knowing what data you hold and how sensitive it is, you cannot meaningfully assess your cyber risk.

Declining. In a market built on outsourcing, this trend moves in the wrong direction. The new OpRes Code will amplify this requirement — carriers must now assess not just their third parties' cyber controls but their third parties' operational resilience under stress.

The BMA's supervisory focus on cyber risk will continue through 2026 and beyond. On-site reviews are happening now. Filing return analysis will identify carriers whose self-reported data reveals compliance gaps. The window for quiet remediation is closing.

Four actions boards should prioritise:

This is the single most visible compliance gap in the BMA's report. Every piece of data the carrier holds — policyholder information, claims data, underwriting models, financial records, employee records — should be classified by sensitivity and criticality, with controls commensurate to that classification. If this exercise is not complete, it should be the board's first directive.

Not a procurement review. An assessment of whether each critical third party — insurance managers, IT outsourcers, cloud providers, TPAs — has adequate cyber controls, tested incident response capabilities, and contractual obligations around breach notification. The OpRes Code now requires this assessment to extend to operational resilience, not just cyber hygiene.

Design a scenario that triggers all four regulatory domains simultaneously: a cyber breach that compromises personal data (PIPA), disrupts an important business service (OpRes), and affects an AI-enabled process (AI governance). Test whether the carrier's response framework handles all four obligations coherently, with consistent communication to the BMA. If it doesn't, that is the remediation priority.

As Appleby's cyber and IT security guide for Bermuda and EY's work on Bermuda cyber and privacy risk management both illustrate, the regulatory framework is maturing rapidly. The BMA's increasing supervisory investment in cyber risk — from filing return analysis to on-site reviews to the integration of cyber with operational resilience and AI governance — reflects a regulator that is building toward continuous, evidence-based oversight.

Carriers that respond to this by treating cyber governance as a genuine operational capability — not a policy document that sits in a drawer — will find themselves better prepared for every regulatory requirement that follows. The OpRes Code, PIPA, the AI governance framework — all of them depend on the same foundational controls: know your data, know your third parties, test your response, and report honestly to your board.

The BMA is already inside the network. The question is whether what they find matches what the board has been told.