230. Competent authorities should develop a thorough understanding of the institution’s ICT risk …

Competent authorities should develop a thorough understanding of the institution’s ICT risk management framework and assess whether the institution has in place sufficient and appropriate strategies, policies, procedures, ICT protocols and tools, including tolerance levels, to address effectively, efficiently and comprehensively the material ICT risk in line with DORA. For this purpose, competent authorities should consider, where applicable:

• a. appropriateness and effectiveness of institution’s ICT risk management policies⁴⁵ , processes and procedures, covering inter alia ICT third-party management, ICT-related incident detection and response, ICT assess management, encryption and cryptography, ICT operations security, network security, access control, and whether these have been approved by the management body and communicated to all relevant stakeholders (as per Article 14 of DORA);
• b. appropriateness of institution’s risk tolerance level of ICT risk and the impact tolerance for ICT disruptions (as per Article 6(8)(b) of DORA);
• c. appropriateness and implementation of the institution’s digital operational resilience strategy, including its alignment with the business strategy;
• d. consistency of the strategy on ICT third-party risk, including the ICT multi-vendor strategy, where available, with the overall business strategy and ICT risk management framework;
• e. residual risk from the institution’s identified risks in respect to contractual arrangements on the use of ICT services supporting critical or important functions;
• f. residual risk from the institution’s identified risks on ICT projects impacting critical or important functions reported to the management body, and also on ICT systems acquisitions, development and maintenance and ICT changes;
• g. soundness and comprehensiveness of digital operational resilience testing programme;
• h. trend and magnitude of major ICT-related incidents and findings reported to the management body as per Article 17(3)(e) and Article 13(5) of DORA;
• i. ICT risk controls specific for the identified material ICT risk;
• j. timely reporting of ICT risk management aspects to the management body and senior management;
• k. internal audit coverage and findings.

⁴⁵ In accordance with DORA, these should include at least the information security policy, backup policies, ICT asset management policy, encryption and cryptographic controls policy, cryptographic key management policy, ICT project management policy, acquisition, development, and maintenance of ICT systems policy, human resources policy, physical and environmental security policy, ICT-related incident management policy, policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers.

1. Oversigt

1.1 Referencer

• Artikel 14 Kommunikation
• Artikel 13 5

1.2 Identificerede krav

1.3 Relaterede standarder

2. Identificerede krav

3. Relaterede standarder

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/