NorthRock Cyber-Risk and Compliance Limited has launched in Bermuda to help local businesses independently assess their cybersecurity defences and manage growing privacy, cyber-risk and regulatory compliance responsibilities.

Mike Perkins, the founder and Bermudian cybersecurity executive, has spent decades working in information technology, cybersecurity, risk management and regulatory compliance in the United States.

“For me, this is much more than identifying another market for our services,” Mr Perkins said. “Bermuda is home. I was born here, much of my family is here, and I believe the experience we have developed helping organisations manage cybersecurity and regulatory requirements can be valuable to Bermuda businesses.”

He said the launch comes as cybersecurity continues to receive increased attention across the island.

“Bermuda Government chief information security officer Anthony Francis recently said the National Cybersecurity Unit was tracking more than 200 breaches that directly or indirectly affect Bermuda, along with at least 100 vulnerabilities,” Mr Perkins said. “He encouraged businesses to develop cybersecurity governance plans.”

NorthRock’s approach is designed to complement, rather than replace, the work already being performed by a company’s internal information technology department or technology provider.

“One of the biggest questions for business leadership is not simply whether cybersecurity tools are installed,” Mr Perkins said.

“It is whether those defences actually work when they are tested. Our role is to independently pressure-test those safeguards, identify gaps and give management and their IT teams a practical road map for addressing them.”

The company will provide independent cybersecurity assessments and penetration testing, cyber-risk and governance services and managed compliance programmes designed around Bermuda’s Personal Information Protection Act.

The firm’s managed Pipa programme is intended to help organisations move beyond simply producing policies by providing an ongoing framework for privacy governance, risk assessment, documentation and security verification.

“Privacy compliance and cybersecurity increasingly intersect,” Mr Perkins said. “If an organisation is responsible for protecting personal information, having policies is important, but management also needs confidence that the technical safeguards protecting that information are functioning as intended.”

As part of its initial Bermuda launch, NorthRock will accept a limited number of organisations into its managed cybersecurity and Pipa compliance programme.

“We want our first Bermuda clients to have direct access to us and a very hands-on experience,” Mr Perkins said. “We are not trying to sign up every business on the island. We would rather work closely with a smaller group of organisations, demonstrate measurable value and grow from there.”

NorthRock will also offer its cybersecurity pressure test, an independent assessment designed to test an organisation’s existing security controls without replacing its current IT provider.

NorthRock Cyber-Risk and Compliance Ltd is a Bermudian company supported by the cybersecurity experience and resources of its US-based affiliate, NorthRock Cybersecurity.