On June 12, 2024, the Bermuda Parliament passed the Cybersecurity Act 2024 (the Act). The Act establishes a cybersecurity framework to protect Critical National Information Infrastructure (CNII) including government systems and essential services like energy, telecommunications, healthcare, and emergency services.

What are the key provisions of the Act?

In particular, the Act provides for:

• the establishment of the Cybersecurity Advisory Board;
• duties, and powers of the National Cybersecurity Unit;
• the detection of, and response to, cybersecurity events in Bermuda; and
• the designation of CNII enforcement authorities and entities.

Additionally, the Act empowers the Minister of National Security to issue, amend, or revoke codes of practice and standards of performance for CNII entities after consultation with the Cybersecurity Advisory Board and CNII enforcement authorities.

Next steps

The Act will enter into effect on a date appointed by the Minister of National Security by notification in the Gazette.

You can read the Act here.

Update: September 27, 2024

Bermuda: Minister of National Security announces enactment of Cybersecurity Act 2024 and establishment of Cybersecurity Advisory Board

On September 20, 2024, the Minister of National Security announced that the Act, received royal assent on June 24, 2024. The Minister also confirmed the establishment of the Cybersecurity Advisory Board.

You can read the press release here.