Frequently Asked Questions

The Cybersecurity Investment Tax Allowance is a new program introduced by the Minister of Finance of Trinidad and Tobago in the 2024 Budget, intended to incentivise businesses to invest in cybersecurity measures. The program will provide a tax deduction for eligible businesses that invest in cybersecurity software and network security monitoring equipment.

The purpose of the program is to encourage businesses to take steps to strengthen their defences against cyberthreats, which are becoming increasingly common and sophisticated. By investing in cybersecurity, businesses can protect their sensitive data, reduce the risk of financial losses, and improve their overall security posture.

The Cybersecurity Investment Tax Allowance is expected to be opened to the public in the second quarter of calendar year 2024. However, businesses are encouraged to start making their investments now.

iGovTT, as the implementation arm of the Ministry of Digital Transformation, will be providing regular updates on the Cybersecurity Investment Tax Allowance through its website and social media channels.

To learn more, please visit our website and sign up for email updates at https://www.igovtt.tt/cybertax/

The Cybersecurity Investment Tax Allowance will provide a deduction of up to $500,000 (for the two-year period 2024/2025) for eligible businesses that invest in cybersecurity software and network security monitoring equipment. The exact amount of the deduction will depend on the specific investments made by the business.

Investing in cybersecurity can benefit a business in many ways, including:

Protecting sensitivedata:  Cyberattacks can result in the loss of sensitive data, such as customer information, financial records, and intellectual property. Investing in cybersecurity can help to protect this data from being stolen or accessed by unauthorized individuals.

Reducing financial losses: Cyberattacks can also result in significant financial losses, such as business interruption, data recovery costs, and fines. Investing in cybersecurity can help to reduce the risk of these losses.

Improving brand reputation:  A cyberattack can damage a business's reputation and deter customers from doing business with them. Investing in cybersecurity can help to protect a business's reputation and build trust with customers.

Increasing compliance: Many businesses are required to comply with data privacy and security regulations. Investing in cybersecurity can help businesses to comply with these regulations and avoid penalties.

Gaining a competitive advantage: Businesses that are seen as being secure and trustworthy will have a competitive advantage in the marketplace. Investing in cybersecurity can help businesses to gain this advantage.

To be eligible for the Tax Allowance, a company must be registered and in good standing with the Registrar General's Company's Registry, be the end user of the cybersecurity software or network security monitoring equipment, and make the expenditure within the calendar years of 2024 and 2025.

Additional conditions include restrictions on resellers, vendors, and distributors, as well as specific considerations for VAT registered and non-registered companies.

The expenditure must be made within the 2024-2025 calendar years.

Items that have been returned or rebated, or expenditures made after a Purchase Order (PO) is generated outside the allowance period, do not qualify.

If a company is VAT registered, the allowance applies only to the VAT exclusive cost. For companies not VAT registered, the allowance is calculated on the full VAT inclusive cost associated with the investment.

Yes, cybersecurity products should adhere to recognized standards and certifications, such as ISO/IEC 27001, SOC 2, NIST frameworks, PCI standards, GDPR, HIPAA, and others. These standards ensure the effectiveness, reliability, and compliance of cybersecurity software and network security monitoring equipment.

These standards and certifications assure that cybersecurity products are built with best practices in information security, provide reliable data protection, assist in risk assessment, and minimize the introduction of new risks.

Compliance with these standards also provides third-party verification of the cybersecurity maturity of the products and services.