+RTS ICT Risk Management T. II Ch. II Art. 19 , 1

1. Overview

RTS ICT Risk Management T. II Ch. II Art. 19 , 1

Financial entities shall include in their human resource policy or other relevant policies all of the following ICT security related elements:

  • (a) the identification and assignment of any specific ICT security responsibilities;
  • (b) requirements for staff of the financial entity and of the ICT third-party service providers using or accessing ICT assets of the financial entity to:
    • (i) be informed about, and adhere to, the financial entity’s ICT security policies, procedures, and protocols;
    • (ii) be aware of the reporting channels put in place by the financial entity for the detection of anomalous behaviour, including, where applicable, the reporting channels established in line with Directive (EU) 2019/1937 of the European Parliament and of the Council (11);
    • (iii) for the staff, to return to the financial entity, upon termination of employment, all ICT assets and tangible information assets in their possession that belong to the financial entity."

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards
NOREA Resilience Training Programs
Implement security awareness and digital operational resilience training as integral components of staff training schemes and ensure training extends to all staff members, including senior management. Customize training intensity based on employee roles and functions. For the training content, cover topics such as network security, insights from prior incidents, threat intelligence, defenses against intrusions, data protection measures (e.g., encryption, cryptography). Conduct the resilience training program on an annual basis. Staff shall be informed on the ICT security policies, procedures and protocols and be made aware of the reporting channels put in place for detecting anomalous activities. Upon termination of employment, all staff are required to return all ICT assets and information assets.
NOREA Inclusion of Third-Party Providers

Incorporate ICT third-party service providers as participants in relevant training programs, where appropriate. Third-parties shall be informed on the ICT security policies, procedures and protocols and be made aware of the reporting channels put in place for detecting anomalous activities. Upon termination of employment or contract termination, the third-parties are required to return all ICT assets and information assets that belong to the financial entity. 
Impressum