+214. In line with DORA, competent authorities should review the institution’s identification …

214. In line with DORA, competent authorities should review the institution’s identification …

In line with DORA, competent authorities should review the institution’s identification, classification and documentation of all ICT supported business functions, roles and responsibilities, the information assets43 and ICT assets44 supporting those functions, and their roles and dependencies in relation to ICT risk. This review should assist competent authorities to develop a thorough understanding of the institution’s inherent ICT risk exposures (ICT risk profile), identify its material inherent ICT risk and form an opinion on its prudential impact. For this purpose, competent authorities should consider at least the following, where relevant and applicable:

  • a. report on the review of ICT risk management framework (as per Article 6(5) of DORA);
  • b. sources of ICT risk, in particular the risk exposure to and from other financial entities, identified by the institution under Article 8(2) of DORA;
  • c. major ICT-related incidents reported (as per Article 19(1) of DORA), including the trend of aggregated annual costs and losses caused by major ICT-related incidents (as per Article 11(10) of DORA);
  • d. outcomes of the tests envisaged in the digital operational resilience testing programme (as per Article 24 of DORA)), including summary of the threat-led penetration testing (TLPT) findings and related remediation plans (as per Article 26(6) of DORA);
  • e. register of information (as per Article 28(3) of DORA), including degree of concentration on ICT third-party service providers, including ICT intra-group providers, per type of ICT services and/or ICT systems;
  • f. recommendations and opinions from the Lead Overseers (as per Article 40(3) and Article 42(7) of DORA) and related responses, reports and information from critical ICT third-party service providers (as per Article 35(1)(c), Article 42(1) and Article 48(2) of DORA);
  • g. level of complexity of ICT systems and results of ICT risk assessment on legacy ICT systems (as per Article 8(7) of DORA);
  • h. risk assessment on major changes (as per Article 8(3) of DORA);
  • i. level of adoption and integration of innovative ICT solutions;
  • j. locations, namely the regions or countries, of data centres and sensitive designated areas, including where contractual ICT services are provided by ICT third-party service providers, also covering data processing and storage location;
  • k. any related material deficiencies or weaknesses identified under Title 5;
  • l. ICT risk and controls self-assessments (if provided in the ICAAP information);
  • m. ICT risk-related management information submitted to the institution’s management body;
  • n. ICT-related internal and external audit findings;
  • o. external threat environment, including threat and vulnerability intelligence.

Review of ICT systems and ICT services

43 Article 3(6) of Regulation (EU) 2022/2554

44 Article 3(7) of Regulation (EU) 2022/2554

1. Übersicht

,

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Standards

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Standards

Standards
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/