+Vendor Recommended Security Settings

Vendor Recommended Security Settings

Consider the security measures and settings recommended by the third-party service provider delivering the ICT service. Implement technical and organisational measures to minimise the risks related to the infrastructure used and managed by the ICT third-party service provider.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations
EULAW Article 9 2

2.   Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.
EULAW Article 9 3

3.   In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall:

(a)

ensure the security of the means of transfer of data;

(b)

minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity;

(c)

prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data;

(d)

ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error.