Financial Services Seminar at Hilton Barbados Resort: Sagicor Announces Advanced Data Privacy Programme Amid Rising Cyber Threats

In my cybersecurity awareness training sessions, I often emphasise that financial institutions in Barbados are the most in-tune and secure by local standards. Therefore, if I wanted to compromise any player in the financial sector, I wouldn’t attack Sagicor directly, given their rigorous policies and sophisticated security systems. Instead, I would target their outsourcing partners, such as legal and healthcare professionals who work with them through various medical plans, and outsource legal services i.e. mortgages.

I’ve personally tried to engage SMB healthcare practitioners and lawyers, but the response to understanding and implementing appropriate cybersecurity measures has been less than encouraging. Most of these professional service offices lack basic firewall services, trained staff, or documented policies on cybersecurity or data privacy.

To address these gaps, third-party professional services should prioritise developing a comprehensive cybersecurity and data privacy operations framework. This begins with adopting a cost-effective risk management methodology to identify, assess, and manage cyber risks. Security templates and predefined standards tailored to the requirements of the financial sector should be used, especially if the business frequently works with financial services.

Additionally, the framework should include:

Comprehensive yet concise compliance documentation, which is essential to align security measures with regulatory requirements. Periodic self-assessments or external cybersecurity services can help ensure consistent compliance.

Access control (systems that determine user identity) and endpoint security (advanced antivirus) are crucial. Secure access control tools like multi-factor authentication (typically requiring an additional step beyond just a username and password) and endpoint security software should be implemented. Regularly reviewing user access privileges and removing inactive accounts will help maintain security.

Service-level agreements (SLAs) should clearly outline response times and expectations. Offering niche or specialised services helps vendors distinguish themselves from larger competitors.

Data privacy and security awareness training need annual maintenance to keep staff updated on best practices. Using free or low-cost training materials and webinars can enhance team skills effectively.

In Barbados, the Data Protection Act imposes strict penalties on data controllers who fail to meet governance requirements with their third-party service providers, known as data processors. Non-compliance can result in fines of up to $500 000, imprisonment of up to three years, or both.

If businesses do not adapt quickly, their existing contracts and relationships may be at risk due to a prevailing culture of apathy toward securing technology. Their lack of commitment to data privacy and cybersecurity not only jeopardises companies like Sagicor but also exposes them to significant penalties for failing to meet due diligence standards.

Steven Williams is the executive director of Sunisle Technology Solutions and the principal consultant at Data Privacy and Management Advisory Services. He is a former IT advisor to the Government’s Law Review Commission, focusing on the draft Cybercrime bill. He holds an MBA from the University of Durham and is certified as a chief information security officer by the EC Council and as a data protection officer by the Professional Evaluation and Certification Board (PECB). Steven can be reached at: Mobile: 246-233-0090 Email: steven@dataprivacy.bb