+Airteagal 10 4.

Airteagal 10 4.

Déanfar na nithe seo a leanas leis na nósanna imeachta um bainistiú paistí dá dtagraítear i mír 3:

(a) 

paistí agus nuashonruithe bogearraí agus crua-earraí atá ar fáil a shainaithint agus meastóireacht a dhéanamh orthu a mhéid is féidir agus úsáid á baint as uirlisí uathoibrithe;

(b) 

nósanna imeachta éigeandála a shainaithint chun sócmhainní TFC a phaisteáil agus a thabhairt cothrom le dáta;

(c) 

na paistí agus na nuashonruithe bogearraí agus crua-earraí dá dtagraítear in Airteagal 8(2), pointí (b)(v), (vi) agus (vii) a thástáil agus a chur in úsáid;

(d) 

sprioc-amanna a shocrú maidir le suiteáil paistí agus nuashonruithe bogearraí agus crua-earraí agus nósanna imeachta um ghéarú a shocrú i gcás nach féidir na sprioc-amanna sin a chomhlíonadh.

1. Forbhreathnú

,

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
NOREA Resource Management
Identify and maintain relevant and trustworthy information resources to build and sustain awareness about vulnerabilities. Track the usage of thirdparty libraries, including open source, by monitoring versions and potential updates (see also 28.2-3).
NOREA Vulnerability Management

Conduct automated vulnerability scanning and assessments on ICT assets. For assets supporting critical or important functions, perform scans and assessments on a weekly basis. Record detected vulnerabilities, monitor their resolution status, and verify the remediation of vulnerabilities. Disclose vulnerabilities responsibly to clients/customers, financial counterparts, and the public when appropriate. Ensure thirdparty service providers report vulnerabilities related to the services they offer. This includes investigating vulnerabilities, determining root causes, and implementing appropriate solutions by the service providers.

*Specific to central securities depositories and central counterparties: perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions.
NOREA Patch Management
Identify and evaluate available ICT assets (e.g., software and hardware) patches and updates using automated tools, to the extent possible. Deploy patches to address identified vulnerabilities. Prioritize the deployment of patches and other mitigation measures based on the criticality of the vulnerability and the classification and risk profile of the affected assets. Establish emergency procedures for patching and updating ICT assets. Test and deploy ICT asset patches and updates. Set due dates for the installation of ICT asset patches and updates, and establish escalation procedures in case the due dates cannot be met. In cases where no patches can be applied or are available, identify and implement alternative mitigation measures within the set due dates.