Beyond Firewalls: Governing Cyber Risk the BOJ Way

Dawgen Decodes — Bank-of-Jamaica Cyber-Risk Series | Article 1

The Bank of Jamaica’s new Standard of Sound Practice – Management of Cyber Risks elevates cyber security from “IT cost line” to board-level fiduciary duty. It requires every deposit-taking institution (DTI) to:

• establish a comprehensive Cyber-Risk Management Framework that covers people, processes, data and facilities—not just technology ;

• adopt a four-lines-of-defence model with clearly assigned owners and independent assurance layers ;

• define, monitor and report risk-tolerance thresholds for cyber threats, with board minutes evidencing challenge and decision-making ;

• embed a cyber-risk-aware culture driven by ten Cyber Resilience Principles and continuous board education .

Institutions that treat these measures as living governance assets—not compliance binders—will outpace regulatory expectations, protect brand trust and unlock competitive advantage in Jamaica’s digital-first economy.

1 | Cyber-Risk Governance: More Than a Technical Issue

The BOJ defines cyber-risk governance as the arrangements a board puts in place to establish, implement and review its approach to managing cyber risk and supporting incident response . In practice, this means the board must:

• own a fit-for-purpose framework that maps threats to controls, budgets and accountability;

• ensure the framework spans the full enterprise—people, third-party dependencies, critical operations, facilities and testing;

• receive regular, decision-ready reporting on cyber-security effectiveness, threat intelligence and resilience metrics.

Boards that still see cyber risk as a technology silo will quickly fall short of this standard.

2 | The Four Lines of Defence—Clarity, Checks and Balance

BOJ’s framework hard-codes a four-line model:

This architecture forces segregation of duties and prevents “single-line blindness,” ensuring issues spotted in operations are independently verified and escalated.

3 | Setting and Supervising Cyber-Risk Tolerance

The board must define explicit risk-tolerance thresholds—how much unavailability, data loss or customer impact the institution can stomach—and oversee management’s adherence . Typical metrics include:

• RPO / RTO for critical systems,

• dwell time between breach and eradication,

• percentage of high-risk vulnerabilities remediated .

Minutes must show the board reviewed, challenged and approved these limits; circulating reports for passive reading is no longer acceptable .

4 | Putting Cyber on the Board Agenda—And Keeping It There

BOJ expects cyber risk—and progress against the framework—to appear regularly on board agendas with sufficient time for informed debate . Good practice:

1. Quarterly deep-dives on framework effectiveness and industry threat trends.

2. Monthly KPI flash reports covering incidents, patch health, training uptake and major third-party issues.

3. Annual self-assessment against the 60 “must-ask” oversight questions in Appendix 3 of the Standard, ideally facilitated by an external advisor .

5 | Tone at the Top—Ten Cyber Resilience Principles

Adopted from the Financial System Stability Committee, the ten principles push boards to weave cyber resilience into enterprise DNA. Highlights include:

• Principle 1 – Not Just an IT Issue: Integrate cyber risk with business strategy and remote-working practices .

• Principle 3 – Adequate Attention on Agenda: Allocate real board time and insist on regular reporting of tech, people, process and data controls .

• Principle 6 – Defence in Depth: Require multiple, overlapping controls so one failure doesn’t sink the ship .

Board endorsement of these principles—visible in policy, budget and behaviour—signals to regulators and staff alike that cyber resilience is non-negotiable.

6 | Governance in Action—A 90-Day Board Roadmap

| Day 0–30 | Formally adopt the four-line Cyber-Risk Management Framework; approve initial risk-tolerance statement. |
| Day 31–60 | Schedule cyber on every board agenda; commission skills-gap analysis for directors & executives; enrol in targeted training. |
| Day 61–90 | Review the first consolidated cyber-risk report with KPI dashboard; minute challenges and actions; mandate remediation timelines. |

Dawgen Global’s Perspective

Implementing the BOJ Standard is less about ticking boxes and more about maturing governance discipline. Boards that embrace the four-line model, demand hard metrics and champion a resilience culture will:

• reduce breach probability and impact,

• earn regulator confidence,

• and strengthen customer trust in Jamaica’s digital banking era.

How Dawgen Global Can Help

Ready to transform compliance into competitive advantage? Let’s talk.

Next Step!