+Guidelines on ICT Risk Assessment under the SREP (EBA/GL/2017/05)
---+1. Compliance and reporting obligations
------+Status of these Guidelines
---------+1. This document contains Guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 …
---------+2. Guidelines set the EBA view of appropriate supervisory practices within the European System of …
------+Reporting requirements
---------+3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify …
---------+4. Notifications will be published on the EBA website, in line with Article 16(3).
---+2. Subject matter, scope and definitions
------+Subject matter and scope of application
---------+5. These Guidelines, drawn up pursuant to Article 107(3) of Directive 2013/36/EU aim to ensure the …
---------+6. Competent authorities should apply these Guidelines in line with the level of application of …
------+Addressees
---------+7. These Guidelines are addressed to competent authorities as defined in point (i) of Article 4(2) …
------+Definitions
---------+8. Unless otherwise specified, terms used and defined in Directive 2013/36/EU, Regulation (EU) No …
---+3. Implementation
------+Date of application
---------+9. These Guidelines apply from 1 January 2018.
---+4. Requirements for the ICT Risk Assessment
---+Title 1 - General provisions
------+10. Competent authorities should perform the assessment of ICT risk and the governance arrangement …
------+11. The principle of proportionality applies throughout these Guidelines to the scope, frequency …
------+12. Competent authorities may rely on and take into consideration work already undertaken by the …
------+13. Competent authorities should summarise the findings of their assessments of the criteria …
------+14. In particular, the assessment of governance and ICT strategy performed in accordance with Title …
------+15. The outcome of the assessment of ICT risk as specified in Title 3 of these Guidelines should …
------+16. It is noted that whilst generally competent authorities should assess sub-categories of risks …
------+17. To reach a view on whether ICT risk should be considered as material and therefore the …
------+18. When applying these Guidelines competent authorities should, where relevant, consider the …
------+19. Where these Guidelines are applied in relation to cross-border banking groups and their …
---+Title 2 - Assessment of institutions’ governance and strategy on ICT
------+2.1 General principles
---------+20. Competent authorities should assess whether the institution’s general governance and internal …
---------+21. In conducting this assessment, competent authorities should refer to the requirements and …
---------+22. The assessment in this Title does not cover the specific elements of the ICT system governance …
---------+23. Point a) referred to in paragraph 22, while providing information about elements of the …
---------+24. The outcome of this assessment should inform, where relevant, the assessment of risk management …
------+2.2 ICT strategy
---------+25. Under this section competent authorities should assess whether the institution has an ICT …
---------+26. Competent authorities should assess whether the institution has a framework in place …
---------+27. If the institution’s ICT strategy requires the implementation of important and complex ICT …
------+2.3 Overall internal governance
---------+28. In accordance with Title 5 of the EBA SREP Guidelines, competent authorities should assess …
---------+29. Further to section 5.2 of the EBA SREP Guidelines, competent authorities should assess whether …
------+2.4 ICT risk in the institution’s risk management framework
---------+30. In assessing the institution’s institution-wide risk management and internal controls, as …
---------+31. Competent authorities should conduct the assessment under point (a) above having regard to both …
---------+32. With specific regard to b), competent authorities should assess whether the independent control …
------+2.5 Summary of findings
---------+33. These results should be reflected in the summary of findings under Title 5 of the EBA SREP …
---------+34. For the assessment of ICT strategy, the following points should be considered in concluding the …
---+Title 3 - Assessment of institutions’ ICT risks exposures and controls
------+3.1 General considerations
---------+35. Competent authorities should assess whether the institution has properly identified, assessed …
---------+36. Competent authorities should first identify the material inherent ICT risks to which the …
---------+37. When performing the assessment under this Title, competent authorities should use all available …
------+3.2 Identification of material ICT risks
---------+38. Competent authorities should identify the material ICT risks to which the institution is or …
---------+39. When reviewing the institution’s ICT risk profile, competent authorities should consider all …
---------+40. As part of the process to identify the ICT risks with a potential significant prudential impact …
---------+41. To this end, competent authorities should review the methodology and processes applied by the …
---------+42. Taking into account the performed reviews of the institution’s ICT risk profile and critical …
---------+43. When assessing the potential impact of ICT risks on the critical ICT systems and services of an …
---------+44. Competent authorities should then map the identified ICT risks that are considered material …
------+3.3 Assessment of the controls to mitigate material ICT risks
---------+45. To assess the institution’s residual ICT risk exposure, competent authorities should review how …
---------+46. To this end, for the identified material ICT risks, competent authorities should review the …
---------+47. The assessment should take into account the outcome of the analysis of the overall risk …
---------+48. Competent authorities should perform the following assessment steps in a manner that is …
---------+49. Competent authorities should review whether the institution has appropriate risk management …
---------+50. Competent authorities should assess how the applicable risk management roles and …
---------+51. Competent authorities should consider whether the Internal Audit Function is effective with …
---------+52. For the identified material ICT risks, competent authorities should assess whether the …
---------+53. In addition to the requirements in the EBA SREP Guidelines (para 279 - 281) competent …
---------+54. For this assessment, competent authorities should, in particular, take into account whether the …
---------+55. Competent authorities should assess whether the institution has an effective framework in place …
---------+56. Competent authorities should assess whether the institution has an effective framework in place …
---------+57. Competent authorities should assess whether the institution has an effective framework in place …
---------+58. For supervised institutions that fall under the scope of the BCBS 239 principles for effective …
---------+59. Competent authorities should assess whether the institution’s outsourcing strategy, in line …
---------+60. In particular competent authorities should assess whether the institution has an effective …
------+3.4 Summary of findings and scoring
---------+61. Following the above assessment, competent authorities should form an opinion on the …
---------+62. If competent authorities deem ICT risk to be material and the competent authority decides to …
---------+Annex – ICT Risk Taxonomy
 English - European Union - Financial Industry -

Guidelines on ICT Risk Assessment under the SREP (EBA/GL/2017/05)

Guidelines on ICT Risk Assessment under the SREP (EBA/GL/2017/05)

https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/supervisory-review-and-evaluation-process-srep-and-pillar-2/guidelines-ict-risk-assessment-under-srep – PDF

1. Forbhreathnú

,
1. Compliance and reporting obligations

1. Compliance and reporting obligations
2. Subject matter, scope and definitions

2. Subject matter, scope and definitions
3. Implementation

3. Implementation
4. Requirements for the ICT Risk Assessment

4. Requirements for the ICT Risk Assessment
Title 1 - General provisions

Title 1 - General provisions
Title 2 - Assessment of institutions’ governance and strategy on ICT

Title 2 - Assessment of institutions’ governance and strategy on ICT
Title 3 - Assessment of institutions’ ICT risks exposures and controls

Title 3 - Assessment of institutions’ ICT risks exposures and controls

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/