Who We Work With
Garrison works with Bermuda's regulated firms and the firms that advise them. The work is the same discipline; what it looks like depends on who you are.
Large and group-owned carriers
You have the leadership. Garrison adds what is hard to get on the island.
Can we evidence group controls here?
Your group framework (NIST, ISO 27001 or your own) mapped to the BMA's operational resilience and cyber codes and evidenced locally, not a new framework on top.
Do we have the depth?
Specialists on a defined scope, for work your own teams cannot absorb: insurance platforms, exposure and cat-modelling data, cyber assurance, resilience testing.
Who runs delivery here?
Programme leadership for Bermuda technology change, agreed with your group technology function.
Ask for the one-page brief for large and group-owned carriers: adam@garrison.re
Mid-sized and newer carriers
Most run technology through the COO, with no CTO or CISO.
Are we safe and compliant, and can we prove it?
A five-week cross-domain diagnostic across the two BMA codes, PIPA and the AI consultation, with every adverse rating second-reviewed and your board deciding.
Who is running it?
Fractional technology leadership: a named CTO, CIO, CISO or operational and technology risk lead, accountable to the COO or CEO.
Will it hold?
Programme leadership for the change, and evidence kept current to the 2028 self-assessment.
Ask for the one-page brief for mid-sized and newer carriers: adam@garrison.re
Insurance managers
The codes reach you and nearly every company you manage, and most will turn to you for the answers.
A readiness assessment of your own controls and shared platform, with findings written for the clients who will ask for them.
One method across the book, and one outsourcing evidence pack for every board.
Delivered under your service or directly to client boards, alongside your compliance team, not instead of it.
Captive reviews. Cyber, PIPA and the Insurance Code of Conduct for each captive. Your controls are evidenced once, and each captive's board is the client.
Ask for the one-page brief for insurance managers: adam@garrison.re
Brokers and agents
The cyber and operational resilience codes and PIPA reach you too, with your own conduct code underneath. In 2024 returns, 18% of agents and brokers had not tested BCP and DR, and 22% had no contracted IT security expert for a major incident (BMA cyber report, 2025).
Are our cyber answers true?
Every answer in your annual return's cyber schedule traced to evidence, and your conduct code's duty to report any attempted or successful material cyber breach built into your procedures.
What about client data?
PIPA in full: notice, transfers to insurers and reinsurers, retention and breach handling.
Does operational resilience apply to us?
A short check of whether you have important business services, plus the outsourcing rules that apply to you either way.
Banks and trust companies
Banks and deposit companies come under the BMA's operational resilience code on 1 January 2027, fifteen months before insurers. Trust companies and investment businesses have been under the cyber code since February 2023.
Can the board sign the first self-assessment?
An independent read of the self-assessment against the code: what is in place, what is missing, and the evidence behind each answer.
Can we report within 24 hours?
The monitoring and decision path behind the 24-hour notice when a service goes outside tolerance.
Who runs the change?
Programme leadership for remediation, platform consolidation or an integration, under the COO's authority.
Digital asset businesses
Licensed businesses sit under their own cyber rules and the custody code, with PIPA alongside and, for Class F, the resilience code from 2028.
Is the application package ready?
The technology, custody and outsourcing package the BMA's guidance asks for, matured by class: an outline for Class T, an advanced draft for Class M, fully developed for Class F.
Is technology controlled from Bermuda?
Evidence that technology run from abroad is overseen locally, and a cyber return the senior representative can sign.
Administrators and corporate service providers
Fund administrators and corporate service providers come under the resilience code, and their clients increasingly ask them for evidence.
One answer for every client?
Your own controls evidenced once, in a pack your clients' boards and auditors can rely on.
What about group services?
Services drawn from group functions or other jurisdictions count in full under the code; Garrison maps and evidences them.
Partners
Search firms, law firms, audit firms, governance firms and technology suppliers whose clients need technology expertise alongside their own.
Executive search
Interim technology leadership while you run the search, technical assessment of candidates, and a running function for your placement. Garrison never competes for the placement.
Legal and regulatory advisers
The technology side of the codes, working alongside your advice.
Audit and assurance firms
Remediation, programme leadership and interim leadership where your independence rules mean you cannot act. You stay the reviewer.
Technology suppliers
A standard evidence pack your Bermuda clients can rely on for their outsourcing and resilience obligations. Disclosed to those clients, and Garrison never assesses an arrangement it helped document.
Referrals both ways, disclosed to the client, with no fees either way.
Ask for the partner brief: adam@garrison.re
Garrison · Hamilton, Bermuda · adam@garrison.re
A first conversation, on-island, at your convenience: adam@garrison.re
Garrison · Hamilton, Bermuda · garrison.re