43. When assessing the potential impact of ICT risks on the critical ICT systems and services of an …

When assessing the potential impact of ICT risks on the critical ICT systems and services of an institution, competent authorities should consider:

a. The financial impact, including (but not limited to) loss of funds or assets, potential customer compensation, legal and remediation costs, contractual damages, lost revenue;
b. The potential for business disruption, considering (but not limited to) the criticality of the financial services affected; the number of customers and/or branches and employees potentially affected;
c. The potential reputational impact on the institution based on the criticality of the banking service or operational activity affected (e.g. theft of customer data); the external profile/visibility of the ICT systems and services affected (e.g. mobile or on-line banking systems, point of sale, ATMs or payment systems);
d. The regulatory impact, including the potential for public censure by the regulator, fines or even variation of permissions.
e. The strategic impact on the institution, for example if strategic product or business plans are compromised or stolen.

1. Overview

Summary	Regulation

Requirements
Source	Requirement

Standards
Source	Requirement