+Environment Risk Mitigation Measures

1. Overview

Environment Risk Mitigation Measures

Put in place measures to mitigate the risk of unintentional alteration or intentional manipulation during development, maintenance, and deployment in production. Protect the integrity and confidentiality of data in non-production environments. Store only anonymized, pseudonymized, or randomized production data. 

Production data that are not anonymized, not pseudonymized or not randomized may be stored only for specific testing occasions, for limited periods of time and following the approval by the relevant function and, for financial entities other than microenterprises, the reporting of such occasions to the ICT
risk management function.

1.1 References

1.2 Identified Requirements

1.2 Related Regulation

2. Identified Requirements

Requirements

3. Related Regulations

Regulations
DORA RTS ICT Risk Management T. II Ch. I Sec. 7 Art. 16 , 1

1. As part of the safeguards to preserve the availability, authenticity, integrity, and confidentiality of data, financial entities shall develop, document and implement a policy governing the acquisition, development, and maintenance of ICT systems. That policy shall:

  • (a) identify security practices and methodologies relating to the acquisition, development, and maintenance of ICT systems;
  • (b) require the identification of:
    • (i) technical specifications and ICT technical specifications, as defined in Article 2, points (4) and (5), of
      Regulation (EU) No 1025/2012;
    • (ii) requirements relating to the acquisition, development, and maintenance of ICT systems, with a particular focus on ICT security requirements and on their approval by the relevant business function and ICT asset owner in accordance with the financial entity’s internal governance arrangements;
  • (c) specify measures to mitigate the risk of unintentional alteration or intentional manipulation of the ICT systems during the development, maintenance, and deployment of those ICT systems in the production environment.
DORA RTS ICT Risk Management T. II Ch. I Sec. 7 Art. 16 , 2

2. Financial entities shall develop, document, and implement an ICT systems’ acquisition, development, and
maintenance procedure for the testing and approval of all ICT systems prior to their use and after maintenance, in
accordance with Article 8(2), point (b), points (v), (vi) and (vii). The level of testing shall be commensurate to the criticality of the business procedures and ICT assets concerned. The testing shall be designed to verify that new ICT systems are adequate to perform as intended, including the quality of the software developed internally.
Central counterparties shall, in addition to the requirements laid down in the first subparagraph, involve, as appropriate, in the design and conduct of the testing referred to in the first subparagraph:

  • (a) clearing members and clients;
  • (b) interoperable central counterparties;
  • (c) other interested parties.

Central securities depositories shall, in addition to the requirements laid down in the first subparagraph, involve, as
appropriate, in the design and conduct of the testing referred to in the first subparagraph:

  • (a) users;
  • (b) critical utilities and critical service providers;
  • (c) other central securities depositories;
  • (d) other market infrastructures;
  • (e) any other institutions with which central securities depositories have identified interdependencies in their business continuity policy.
DORA RTS ICT Risk Management T. II Ch. I Sec. 7 Art. 16 , 3

3. The procedure referred to in paragraph 2 shall contain the performance of source code reviews covering both static and dynamic testing. That testing shall contain security testing for internet-exposed systems and applications in accordance with Article 8(2), point (b), points (v), (vi) and (vii). Financial entities shall:

  • (a) identify and analyse vulnerabilities and anomalies in the source code;
  • (b) adopt an action plan to address those vulnerabilities and anomalies;
  • (c) monitor the implementation of that action plan.
DORA RTS ICT Risk Management T. II Ch. I Sec. 7 Art. 16 , 4
4. The procedure referred to in paragraph 2 shall contain security testing of software packages no later than at the integration phase, in accordance with Article 8(2), points (b)(v), (vi) and(vii).
DORA RTS ICT Risk Management T. II Ch. I Sec. 7 Art. 16 , 5

5. The procedure referred to in paragraph 2 shall provide that:

  • (a) non-production environments only store anonymised, pseudonymised, or randomised production data;
  • (b) financial entities are to protect the integrity and confidentiality of data in non-production environments.
Impressum