+Articolo 8 2.

Articolo 8 2.

Le politiche e le procedure per le operazioni riguardanti le TIC di cui al paragrafo 1 contengono tutti gli elementi seguenti:

a) 

una descrizione delle risorse TIC che includa tutti gli elementi seguenti:

i) 

requisiti relativi alla sicurezza dell’installazione, della manutenzione, della configurazione e della disinstallazione di un sistema di TIC;

ii) 

requisiti relativi alla gestione del patrimonio informativo utilizzato dalle risorse TIC, inclusi il trattamento e l’elaborazione, sia automatizzati che manuali;

iii) 

requisiti relativi all’identificazione e al controllo dei sistemi di TIC legacy;

b) 

i controlli e il monitoraggio dei sistemi di TIC, comprendenti tutti gli elementi seguenti:

i) 

requisiti di backup e ripristino dei sistemi di TIC;

ii) 

requisiti di scheduling, tenendo conto delle interdipendenze tra i sistemi di TIC;

iii) 

protocolli per le informazioni di audit trail e log di sistema;

iv) 

requisiti per garantire che l’esecuzione dell’audit interno e di altri test riduca al minimo le perturbazioni delle operazioni commerciali;

v) 

requisiti sulla separazione degli ambienti di produzione delle TIC dagli ambienti di sviluppo, test e da altri ambienti non di produzione;

vi) 

requisiti per condurre lo sviluppo e i test in ambienti separati dall’ambiente di produzione;

vii) 

requisiti per condurre lo sviluppo e i test in ambienti di produzione;

c) 

gestione degli errori relativi ai sistemi di TIC, che comprenda tutti gli elementi seguenti:

i) 

procedure e protocolli per la gestione degli errori;

ii) 

contatti dell’assistenza e dei livelli successivi di intervento, compresi i contatti dell’assistenza esterna in caso di problemi operativi o tecnici imprevisti;

iii) 

procedure di riavvio, riesecuzione e ripristino dei sistemi di TIC da utilizzare in caso di perturbazione dei sistemi di TIC.

Ai fini della lettera b), punto v), la separazione considera tutte le componenti dell’ambiente, compresi gli account, i dati o le connessioni, come previsto dall’articolo 13, primo comma, lettera a).

Ai fini della lettera b), punto vii), le politiche e le procedure di cui al paragrafo 1 prevedono che i casi in cui i test sono eseguiti in un ambiente di produzione siano chiaramente identificati, motivati, abbiano una durata limitata e siano approvati dalla funzione competente conformemente all’articolo 16, paragrafo 6. Le entità finanziarie garantiscono la disponibilità, la riservatezza, l’integrità e l’autenticità dei sistemi di TIC e dei dati di produzione durante le attività di sviluppo e di test nell’ambiente di produzione.

1. Panoramica

,

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Standard correlati

2. Requisiti identificati

Requisiti

3. Standard correlati

Standard
NOREA Critical and Important Functions
Identify, classify and adequately document all critical and important functions. This process involves determining which functions are essential for the entity's operational stability and continuity. Review as needed, and at least yearly, the adequacy of this classification.
NOREA Clear Segregation of Duties (SoD)
Establish Segregation of Duties (SoD) with regard to risk management functions, following the three lines of defence model or internal risk management and control model.
NOREA ICT Risk management framework

A sound, comprehensive and well-documented ICT risk management framework is in place. Which as goal to address all ICT risks properly and ensure a high level of digital resilience. The reponsibility for risk management is properly assigned to a control function. 

The ICT risk management framework shall be documented and reviewed at least annually, or periodically for microenterprises, with immediate reviews triggered by major ICT-related incidents or supervisory feedback. Continuous improvement will be ensured by incorporating lessons learned from implementation, monitoring, and audits. The report of the review will be prepared according to the requirements as stated in chapter 5 (Article 27) of the RTS RM and will be made available for submission to the competent authority upon request. 

Assess new standards and relevant technology developments in the field of information security, cybersecurity and resilience on a continuous basis and make proposals on how they can strengthen the information security and cybersecurity control measures of the institution.
NOREA Annual Framework Review and Audit Process

The effectiveness of the risk management framework is monitored based on the risk exposure over time to critical or important business functions. Implement a reviewing and auditing process, with a minimum yearly review of the framework, triggered by major ICT incidents, regulator instructions, or major audit findings. 

The tasks of verifying compliance with ICT risk management requirements may be outsourced to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the ICT risk management requirements.
NOREA Third-Party (Multi-vendor) Risk Management Program

Maintain a comprehensive third-party risk management program which includes:

  • A register of information related to the use of thirdparty service providers, especially those supporting critical or important functions (see also control 17.3).
  • Put in place a policy on the management of ICT third-parties, including the criteria for determining the criticality of service providers and the internal responsibilities for managing third-parties.
  • Ensuring that senior management reviews the policy and designate a member to monitor relations with the third-parties and the contractual arrangements.
  • A (holistic) multi-vendor strategy, if deemed relevant,  showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers.  
NOREA Change Procedures
Ensure that all changes to software, hardware, firmware components, and systems, along with security parameters, are appropriately placed and scoped. Document and communicate change details, including the purpose and scope of the change, the implementation timeline, and expected outcomes. Define clear roles and responsibilities to ensure that changes are defined, planned, transitioned, tested, and finalized in a controlled manner. Additionally, establish effective quality assurance procedures. Implement mechanisms to maintain independence between the functions that approve changes and those responsible for requesting and implementing them.
NOREA Security Requirements
Identify the potential impact of a change on existing security measures and assess whether additional security measures are required for its implementation. Verify that security requirements have been met for all implemented changes. Establish fallback procedures and assign responsibilities for aborting changes or recovering from changes not successfully implemented.
NOREA Emergency Change Management
Define procedures for documenting, reevaluating, assessing, and approving the implementation of emergency changes, including workarounds and patches.
NOREA OTAP Implementation
Ensure segregation of production environments from development, testing, and other non-production environments, encompassing all components of an environment. This also includes requirements to conduct the development and testing in production environments. Ensure that the instances in which testing is performed in production environment are clearly identified, justified, for limited periods of time approved by the relevant function.
NOREA Error Handling and Recovery
Establish guidelines for handling errors, including support and escalation contacts, as well as external support contacts in case of unexpected operational or technical issues. Define the procedures for ICT system restart, rollback, and recovery to be used in the event of an ICT system disruption. Ensure the contact details are available in case systems are unavailable as well.
NOREA Protection Measures

Implement policies and procedures to protect all information, ICT assets, and relevant physical ICT components and infrastructures. At least the following policies shall be established and maintained.

  • Security policy
  • Human resources policy
  • Encryption and cryptographic control policy
  • Identity and access management (IAM) policy
  • Change management policy
  • Network security policy
  • ICT operating policies and procedures
  • (Crisis) Communication policy
  • Vulnerability and patch management policy
  • Back up policy
  • Project management policy
  • Physical and environmental security policy
  • Business continuity policy with response and recovery plans (including testing plans), see control1.4 *
  • ICT third-party service providers management policy, see control 1.1. *
  • Operations of ICT assets (ensuring network security, protect against intrusions and data misuse and defining how the entity operates, monitors, controls, and restores ICT assets, including the documentation of ICT operations).

* must be approved by the Management body
NOREA ICT Monitoring

Develop, document and implement capacity and performance management procedures to identify capacity requirements of their ICT systems and apply resource optimisation and monitoring procedures to maintain and improve the availability of data and ICT systems and efficiency of ICT systems and prevent ICT capacity shortages.
NOREA Clock Synchronization Standardization

Ensure clock synchronization of all ICT systems to a single reliable reference source time.
NOREA System Management and Security

Provide system descriptions that encompass secure installation, maintenance, configuration, and deinstallation/disposal of ICT assets. This includes the management of assets, both automated and manual, and the identification and control of legacy ICT systems.
  • Builddate: 25.06.2024 00:00:00 -Doknr: CELEX:32024R1774
  • EULAW -

    EN: Legal acts of the European Union from EUR-Lex, https://eur-lex.europa.eu/. © European Union. Re-use is authorised by Decision 2011/833/EU, provided the source is acknowledged; the consolidated texts are licensed under CC BY 4.0 (EUR-Lex legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the legislation published in the Official Journal of the European Union is deemed authentic.

    DE: Rechtsakte der Europäischen Union aus EUR-Lex, https://eur-lex.europa.eu/. © Europäische Union. Weiterverwendung nach Beschluss 2011/833/EU mit Quellenangabe gestattet; die konsolidierten Fassungen stehen unter CC BY 4.0 (Rechtlicher Hinweis von EUR-Lex). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Verbindlich sind allein die im Amtsblatt der Europäischen Union veröffentlichten Rechtsakte.