+Title 3 - Assessment of institutions’ ICT risks exposures and controls
---+3.1 General considerations
------+35. Competent authorities should assess whether the institution has properly identified, assessed …
------+36. Competent authorities should first identify the material inherent ICT risks to which the …
------+37. When performing the assessment under this Title, competent authorities should use all available …
---+3.2 Identification of material ICT risks
------+38. Competent authorities should identify the material ICT risks to which the institution is or …
------+39. When reviewing the institution’s ICT risk profile, competent authorities should consider all …
------+40. As part of the process to identify the ICT risks with a potential significant prudential impact …
------+41. To this end, competent authorities should review the methodology and processes applied by the …
------+42. Taking into account the performed reviews of the institution’s ICT risk profile and critical …
------+43. When assessing the potential impact of ICT risks on the critical ICT systems and services of an …
------+44. Competent authorities should then map the identified ICT risks that are considered material …
---+3.3 Assessment of the controls to mitigate material ICT risks
------+45. To assess the institution’s residual ICT risk exposure, competent authorities should review how …
------+46. To this end, for the identified material ICT risks, competent authorities should review the …
------+47. The assessment should take into account the outcome of the analysis of the overall risk …
------+48. Competent authorities should perform the following assessment steps in a manner that is …
------+49. Competent authorities should review whether the institution has appropriate risk management …
------+50. Competent authorities should assess how the applicable risk management roles and …
------+51. Competent authorities should consider whether the Internal Audit Function is effective with …
------+52. For the identified material ICT risks, competent authorities should assess whether the …
------+53. In addition to the requirements in the EBA SREP Guidelines (para 279 - 281) competent …
------+54. For this assessment, competent authorities should, in particular, take into account whether the …
------+55. Competent authorities should assess whether the institution has an effective framework in place …
------+56. Competent authorities should assess whether the institution has an effective framework in place …
------+57. Competent authorities should assess whether the institution has an effective framework in place …
------+58. For supervised institutions that fall under the scope of the BCBS 239 principles for effective …
------+59. Competent authorities should assess whether the institution’s outsourcing strategy, in line …
------+60. In particular competent authorities should assess whether the institution has an effective …
---+3.4 Summary of findings and scoring
------+61. Following the above assessment, competent authorities should form an opinion on the …
------+62. If competent authorities deem ICT risk to be material and the competent authority decides to …
------+Annex – ICT Risk Taxonomy

Title 3 - Assessment of institutions’ ICT risks exposures and controls

Title 3 - Assessment of institutions’ ICT risks exposures and controls

1. Forbhreathnú

,
3.1 General considerations

3.1 General considerations
3.2 Identification of material ICT risks

3.2 Identification of material ICT risks
3.3 Assessment of the controls to mitigate material ICT risks

3.3 Assessment of the controls to mitigate material ICT risks
3.4 Summary of findings and scoring

3.4 Summary of findings and scoring

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/