184. With regard to ICT and security risk , competent authorities should be satisfied that the …

With regard to ICT and security risk⁶³ , competent authorities should be satisfied that the management framework will ensure the sound, reliable and secure functioning of information and communication systems supporting the activities of credit institutions as well as the adequate prevention, monitoring and mitigation of ICT risks at normal times and during times of stress. Competent authorities should assess, in particular:

• (a) whether the management body has overall accountability for setting, approving and overseeing the implementation of financial institutions’ ICT strategy, which should be aligned with financial institutions’ overall business strategy;
• (b) the clear definition and attribution of key roles and responsibilities, and relevant reporting lines, for the ICT and security risk management framework to be effective, including the allocation of appropriate budget to adequately support the ICT operational needs and the ICT and security risk management;
• (c) whether the management and oversight of ICT and security risks are entrusted to an independent and objective control function, appropriately segregated from ICT operational processes and not responsible for any internal audit, and an independent internal audit function;
• (d) the arrangements to ensure the identification, establishment and maintenance of updated mapping of business functions, roles and supporting processes to identify the importance of each and their interdependencies in relation to ICT and security risks;
• (e) to the extent that the information is held on ICT systems, whether the requirements for information security will be in place;
• (f) the scale, complexity and importance of ICT-related dependencies, if the outsourcing of operational functions of ICT services and any activity of ICT systems – including to group entities – or the use of third parties in relation to such functions and activity is envisaged.

⁶³ As defined in the EBA Guidelines on ICT security risk management , ‘ICT and security risk’ means: ‘Risk of loss due to breach of confidentiality, failure of integrity of systems and data, inappropriateness or unavailability of systems and data or inability to change information technology (IT) within a reasonable time and with reasonable costs when the environment or business requirements change (i.e. agility). This includes security risks resulting from inadequate or failed internal processes or external events including cyber-attacks or inadequate physical security’.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/