CHAPTER II Further elements of systems, protocols, and tools to minimise the impact of ICT risk

access rights to information assets, ICT assets, and their supported functions, and to critical locations of operation of the financial entity, are managed on a need-to-know, need-to-use and least privileges basis, including for remote and emergency access;

user accountability, which ensures that users can be identified for the actions performed in the ICT systems;

account management procedures to grant, change, or revoke access rights for user and generic accounts, including generic administrator accounts;

authentication methods that are commensurate to the classification referred to in Article 30(1) and to the overall risk profile of ICT assets, and which are based on leading practices;

access rights are periodically reviewed and are withdrawn when no longer required.

monitor and manage the lifecycle of all ICT assets;

monitor whether the ICT assets are supported by ICT third-party service providers of financial entities, where applicable;

identify capacity requirements of their ICT assets and measures to maintain and improve the availability and efficiency of ICT systems and prevent ICT capacity shortages before they materialise;

perform automated vulnerability scanning and assessments of ICT assets commensurate to their classification as referred to in Article 30(1) and to the overall risk profile of the ICT asset, and deploy patches to address identified vulnerabilities;

manage the risks related to outdated, unsupported, or legacy ICT assets;

log events related to logical and physical access control, ICT operations, including system and network traffic activities, and ICT change management;

identify and implement measures to monitor and analyse information on anomalous activities and behaviour for critical or important ICT operations;

implement measures to monitor relevant and up-to-date information about cyber threats;

implement measures to identify possible information leakages, malicious code and other security threats, and publicly known vulnerabilities in software and hardware, and check for corresponding new security updates.

the identification and implementation of measures to protect data in use, in transit, and at rest;

the identification and implementation of security measures regarding the use of software, data storage media, systems and endpoint devices that transfer and store data of the financial entity;

the identification and implementation of measures to prevent and detect unauthorised connections to the financial entity’s network, and to secure the network traffic between the financial entity’s internal networks and the internet and other external connections;

the identification and implementation of measures that ensure the availability, authenticity, integrity, and confidentiality of data during network transmissions;

a process to securely delete data on premises, or that are stored externally, that the financial entity no longer needs to collect or store;

a process to securely dispose of, or decommission, data storage devices on premises, or data storage devices that are stored externally, that contain confidential information;

the identification and implementation of measures to ensure that teleworking and the use of private endpoint devices does not adversely impact the financial entity’s ability to carry out its critical activities in an adequate, timely, and secure manner.

ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements, including information security requirements, are clearly specified and approved by the business function concerned;

ensure the testing and approval of ICT systems prior to their first use and before introducing changes to the production environment;

identify measures to mitigate the risk of unintentional alteration or intentional manipulation of the ICT systems during development and implementation in the production environment.