GFSC Cyber Security Rules and Guidance
Board-owned cyber security based on the NIST functions, for all licensees.
- Applies in
- Guernsey
- Edition
- 2021
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- IDIdentify: assets and cyber risk assessmentFunction
- PRProtect: controls proportionate to riskFunction
- DEDetectFunction
- RSRespond: incident plan and notification to the CommissionFunction
- RCRecoverFunction
How Amoreg keeps you on it.
Enable the GFSC Cyber Security Rules and Guidance and the Monitor suggests GFSC as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 5 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read gfsc.gg/news
- Check the library against 5 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: identify: assets and cyber risk assessment
- Rule
- GFSC Cyber Security Rules and Guidance, ID
- Area
- Function
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
Also in Guernsey
- GFSC Handbook on Countering Financial Crime (AML/CFT/CPF)The Bailiwick's AML/CFT/CPF rules and guidance for financial services businesses and prescribed businesses, issued under the Criminal Justice (Proceeds of Crime) regulations.Guernsey · 8 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- GFSC Finance Sector Code of Corporate GovernancePrinciples for the boards of all Guernsey licensees, with an annual confirmation of compliance.Guernsey · 5 controls
- GFSC Fiduciary Rules and GuidanceConduct, client asset, record keeping and resourcing rules for fiduciary licensees.Guernsey · 5 controls
- Guernsey Beneficial Ownership RegimeResident agent duties to identify and register beneficial owners of Guernsey legal persons.Guernsey · 3 controls
- Guernsey Protection of Investors Law & Collective Investment Scheme RulesLicensing and conduct for investment business and the rules for authorised and registered schemes.Guernsey · 4 controls
Questions
Does Amoreg watch for changes to the GFSC Cyber Security Rules and Guidance?
Yes. Enable it and the Monitor suggests Guernsey Financial Services Commission as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the GFSC Cyber Security Rules and Guidance?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records 2021. Editions were last verified in August 2026, and the Monitor records new publications as they appear.