Over the past 15 years, Jersey has joined the rest of the world in embracing numerous new technologies and systems, creating opportunities for the island’s economy and society. However, with these advancements come new risks, particularly in cybersecurity, as threat actors continuously evolve their tactics to exploit vulnerabilities and access sensitive data.
As an independent jurisdiction, Jersey faces a unique blend of risks. It manages its own critical infrastructure (power, water supplies, and healthcare), and the island’s economy relies heavily on professional industries that handle sensitive information, making it a potential target for cyber attacks with far-reaching consequences.
Jersey’s financial regulator (the Jersey Financial Services Commission) was rudely reminded of this in January 2024, when it discovered a bug had compromised its online registry system. The bug had been on the system for three years – that is, ever since the system was installed in January 2021.
As a result, users of the registry search portal could see the names and addresses of 67,000 beneficial owners, controllers, directors, members, nominated persons, and company secretaries that were not supposed to be made public. It is still not known whether threat actors have used this information.
Meeting the challenges
The Government of Jersey established the Jersey Cyber Security Centre (JCSC) in 2021 as part of the Department for the Economy. The JCSC works to prevent, protect, and defend the island against cyber threats. Jersey is now establishing a legal framework to support the JCSC’s aims without imposing ‘undue burdens on industry’ – the Cyber Security (Jersey) Law (CSJL).
Consultations and reporting standards
The law introduces reporting standards for operators of essential services (OES), i.e., the critical organisations obligated to enhance cybersecurity and promptly notify JCSC and customers of significant cyber incidents.
To ensure broad stakeholder engagement, the Government and JCSC are conducting consultations, with specific focus on OES requirements. Feedback from these consultations will inform the final version of the CSJL, which is intended to be the product of a collaborative effort.
The second round of consultation on the proposed CSJL closed at the end of April 2024. That consultation sought feedback from OES, and the next consultation phase (scheduled for Q3 2024) will focus on how OES are going to implement the requirements of Part 4, Part 5, and Schedule 3 of the CSJL.
The draft legislation defines the role and accountability of the JCSC as an operationally independent body, empowered to collaborate with organisations in confidence in the event of cyber incidents. Additionally, it establishes a Technical Advisory Council (TAC) to provide expert guidance, and mandates regular reporting to ensure transparency.
Who are the OES and who will be most affected?
For the purposes of the CSJL, an OES is defined as, “any service which is essential for the infrastructure of Jersey or the maintenance of critical societal or economic activities in Jersey.”
This includes utilities such as water and power, and infrastructure services like transport and communication. Crucially, it also covers financial services.
The list extends to all financial service establishments engaged in trust companies, investment businesses, money services, fund services, and general insurance mediation, along with banks. All must incorporate the anti-cyber-crime measures outlined in the CSJL for their network and information systems.
Orbit Security
Insights
Why Cybersecurity Due Diligence is Critical to Deal Completion
It’s a common story: after months of meticulous financial, operational, and market analysis, a critical finding emerges in the final weeks before deal closure – threatening what seemed like a near-certain transaction with a three-month delay.
DORA Compliance Checklist: Practical Guidance for Q4 and 2026
Our structured, expert-led checklist, will help you to prioritise and demonstrate readiness to supervisors and regulators.
Ransomware at Europe’s Airports: Case for Community-Driven Third Party Risk Management
The recent ransomware attack on Collins Aerospace’s Muse software, which brought chaos to airports across Europe, serves as a stark reminder of a critical gap in how organisations approach Third Party Risk Management (TPRM).
JLR Cyber Attack: What it Means for Private Equity, Credit, and Equity Investments
From the iconic E-Type Jaguar to images of the late Queen driving modern Range Rovers on her estate, JLR has long held a uniquely British place in the national consciousness, even under Tata ownership. The incident has affected the owners of the business, the supply chain, and customers, and offers learnings for the Private Equity (PE) industry.