57. Competent authorities should assess whether the institution has an effective framework in place …

Competent authorities should assess whether the institution has an effective framework in place for identifying understanding, measuring and mitigating ICT data integrity risk commensurate with the nature, scale and complexity of the institution’s activities and the ICT risk profile of the institution. The institution’s framework should consider the risks associated with preserving the integrity of the data stored and processed by the ICT systems. For this assessment, competent authorities should, in particular take into account whether the framework considers:

• a. a policy that defines the roles and responsibilities for managing the integrity of the data in the ICT systems (e.g. data architect, data officers⁹ , data custodians¹⁰ , data owners/stewards¹¹ ) and provides guidance on which data are critical from a data integrity perspective and should be subject to specific ICT controls (e.g. automated input validation controls, data transfer controls, reconciliations, etc.) or reviews (e.g. a compatibility check with the data architecture) in the different phases of ICT data life cycle;
• b. a documented data architecture, data model and/or dictionary, that is validated with relevant business and IT stakeholders to support the needed data consistency across the ICT systems and to make sure that the data architecture, data model and/or dictionary remain aligned with business and risk management needs;
• c. a policy regarding the allowed usage of and reliance on End User Computing, in particular regarding the identification, registration and documentation of important end user computing solutions (e.g. when processing important data) and the expected security levels to prevent unauthorised modifications, both in the tool itself, as well as data stored in it;
• d. documented exception handling processes to resolve identified ICT data integrity issues in line with their criticality and sensitivity.

9 A data officer is responsible for data processing and usage. 10 A data custodian is responsible for the safe custody, transport and storage of data. 11 A data steward is responsible for the management and fitness of data elements – both the content and metadata.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

3. Caighdeáin ghaolmhara

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/