+Risk Management Policy

Risk Management Policy

Description

Mechanisms exist to establish a formal, documented risk management policy that:
(1) Conveys executive management's intent;
(2) Provides organizational direction and expected behaviors;
(3) Is reviewed at least annually; and
(4) Is updated, as necessary, to adapt to evolving risks, threats and other changes that affect the organization.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Executive-approved written policy with documented annual review

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Executive-approved written policy with documented annual review
∙ Policy acknowledgement tracking (e.g., HR onboarding records)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.) for policy lifecycle management
∙ Documented annual policy review with version control

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.) for policy lifecycle management
∙ Policy governance committee with formal annual review and approval workflow
∙ Automated policy attestation and acknowledgement tracking

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Steering committee
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Enterprise GRC platform (e.g., Cyturus, Archer, MetricStream, ServiceNow IRM) for policy lifecycle management
∙ Automated policy attestation, exception tracking and change history
∙ Annual executive approval and board-level reporting

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti
EULAW Artikolu 6 1

1.   L-entitajiet finanzjarji għandu jkollhom qafas sod, komprensiv u ddokumentat sewwa għall-ġestjoni tar-riskju tal-ICT bħala parti mis-sistema globali tagħhom għall-ġestjoni tar-riskju, li jippermettilhom jindirizzaw ir-riskju tal-ICT malajr, b’mod effiċjenti u komprensiv, u jiżguraw livell għoli ta’ reżiljenza operazzjonali diġitali.
EULAW Artikolu 6 2

2.   Il-qafas għall-ġestjoni tar-riskju tal-ICT għandu jinkludi tal-anqas l-istrateġiji, il-politiki, il-proċeduri, il-protokolli tal-ICT u l-għodod li huma meħtieġa biex b’mod debitu u adegwat jiġu protetti l-assi kollha ta’ informazzjoni u l-assi kollha tal-ICT, fosthom is-software tal-kompjuters, il-hardware u s-servers, kif ukoll biex jiġu protetti l-komponenti fiżiċi u l-infrastrutturi rilevanti kollha, bħall-bini, iċ-ċentri tad-data u ż-żoni kklassifikati bħala sensittivi, sabiex jiġi żgurat li l-assi kollha ta’ informazzjoni u l-assi kollha tal-ICT ikunu protetti b’mod adegwat mir-riskji inkluż il-ħsara u l-aċċess jew l-użu mhux awtorizzat.
EULAW Artikolu 6 3

3.   F’konformità mal-qafas tagħhom għall-ġestjoni tar-riskju tal-ICT, l-entitajiet finanzjarji għandhom jimminimizzaw l-impatt tar-riskju tal-ICT billi jużaw strateġiji, politiki, proċeduri, protokolli tal-ICT u għodod xierqa. Huma għandhom jipprovdu informazzjoni kompleta u aġġornata dwar ir-riskju tal-ICT u dwar il-qafas tal-ġestjoni tar-riskju tal-ICT tagħhom lill-awtoritajiet kompetenti fuq talba tagħhom.
EULAW Artikolu 6 4

4.   L-entitajiet finanzjarji, għajr il-mikrointrapriżi, għandhom jassenjaw ir-responsabbiltà għall-ġestjoni u s-sorveljanza ta’ riskju tal-ICT lil funzjoni ta’ kontroll u jiżguraw livell xieraq ta’ indipendenza ta’ tali funzjoni ta’ kontroll sabiex jevitaw kunflitti ta’ interess. L-entitajiet finanzjarji għandhom jiżguraw segregazzjoni u indipendenza xierqa tal-funzjonijiet tal-ġestjoni tar-riskju tal-ICT, tal-funzjonijiet ta’ kontroll u tal-funzjonijiet tal-awditjar intern, skont it-tliet linji tal-mudell ta’ difiża, jew mudell intern ta’ kontroll u tal-ġestjoni tar-riskji.
EULAW Artikolu 6 5

5.   Il-qafas tal-ġestjoni tar-riskju tal-ICT għandu jiġi ddokumentat u rieżaminat mill-inqas darba fis-sena, jew perjodikament fil-każ tal-mikrointrapriżi, kif ukoll mal-okkorrenza ta’ inċidenti kbar relatati mal-ICT, u wara struzzjonijiet superviżorji jew konklużjonijiet derivati mill-ittestjar tar-reżiljenza operazzjonali diġitali jew il-proċessi tal-awditjar rilevanti. Huwa għandu jittejjeb kontinwament abbażi tal-lezzjonijiet meħuda mill-implimentazzjoni u l-monitoraġġ. Rapport dwar ir-rieżami tal-qafas tal-ġestjoni tar-riskju tal-ICT għandu jiġi ppreżentat lill-awtorità kompetenti fuq talba tagħha.
EULAW Artikolu 6 6

6.   Il-qafas tal-ġestjoni tar-riskju tal-ICT tal-entitajiet finanzjarji, għajr il-mikrointrapriżi, għandu jkun soġġett għal awditu intern minn awdituri fuq bażi regolari skont il-pjan ta’ awditu tal-entitajiet finanzjarji. Dawk l-awdituri għandu jkollhom biżżejjed għarfien, ħiliet u għarfien espert fir-riskju tal-ICT, kif ukoll indipendenza xierqa. Il-frekwenza u l-enfasi tal-awditi tal-ICT għandhom ikunu proporzjonati mar-riskju tal-ICT tal-entità finanzjarja.
EULAW Artikolu 6 7

7.   Abbażi tal-konklużjonijiet tar-rieżami intern tal-awditu, l-entitajiet finanzjarji għandhom jistabbilixxu proċess formali ta’ segwitu, inkluż regoli għall-verifika u r-rimedju f’waqthom tas-sejbiet kruċjali tal-awditu tal-ICT.
EULAW Artikolu 6 8

8.   Il-qafas tal-ġestjoni tar-riskju tal-ICT għandu jinkludi strateġija ta’ reżiljenza operazzjonali diġitali li turi kif għandu jiġi implimentat il-qafas. Għal dak l-għan, l-istrateġija ta’ reżiljenza operazzjonali diġitali għandha tinkludi l-metodi biex jiġi indirizzat ir-riskju tal-ICT u biex jintlaħqu l-objettivi speċifiċi tal-ICT, billi:

(a)

tispjega kif il-qafas tal-ġestjoni tar-riskju tal-ICT jappoġġja l-istrateġija u l-objettivi tan-negozju tal-entità finanzjarja;

(b)

tistabbilixxi l-livell ta’ tolleranza tar-riskju għar-riskju tal-ICT, f’konformità mal-predispożizzjoni għar-riskju tal-entità finanzjarja, u tiġi analizzata t-tolleranza tal-impatt għal tfixkil fl-ICT;

(c)

tistabbilixxi l-objettivi ċari għas-sigurtà tal-informazzjoni, inkluż indikaturi ewlenin tal-prestazzjoni u metriċi tar-riskju ewlenin;

(d)

tispjega l-arkitettura ta’ referenza tal-ICT u kwalunkwe bidla meħtieġa biex jintlaħqu objettivi speċifiċi tan-negozju;

(e)

tiddeskrivi l-mekkaniżmi differenti implimentati biex jindividwaw inċidenti relatati mal-ICT, jipprevjenu l-impatt tagħhom u jipprovdu protezzjoni minnu;

(f)

turi l-evidenza għas-sitwazzjoni attwali tar-reżiljenza operazzjonali diġitali abbażi tal-għadd ta’ inċidenti kbar marbuta mal-ICT irrappurtati u l-effikaċja tal-miżuri preventivi;

(g)

timplimenta l-ittestjar tar-reżiljenza operazzjonali diġitali, f’konformità mal-Kapitolu IV ta’ dan ir-Regolament;

(h)

tiddeskrivi strateġija ta’ komunikazzjoni f’każ ta’ inċidenti marbuta mal-ICT li d-divulgazzjoni tagħhom hija meħtieġa f’konformità mal-Artikolu 14.
EULAW Artikolu 6 9

9.   L-entitajiet finazjarji jistgħu, fil-kuntest tal-istrateġija ta’ reżiljenza operazzjonali diġitali msemmija fil-paragrafu 8, jiddefinixxu strateġija olistika tal-ICT b’diversi bejjiegħa, fil-livell ta’ grupp jew entità, waqt li juru d-dipendenzi ewlenin fuq fornituri terzi ta’ servizzi tal-ICT u jispjegaw ir-raġunament wara l-akkwist imħallat ta’ fornituri terzi ta’ servizzi tal-ICT.
EULAW Artikolu 6 10

10.   L-entitajiet finanzjarji jistgħu, f’konformità mal-liġi settorjali tal-Unjoni u dik nazzjonali, jesternalizzaw il-kompiti tal-verifika tal-konformità mar-rekwiżiti tal-ġestjoni tar-riskju tal-ICT lil impriżi intragrupp jew esterni. Fil-każ ta’ tali esternalizzazzjoni, l-entità finanzjarja tibqa’ terfa’ r-responsabbiltà aħħarija għall-verifika tal-konformità mar-rekwiżiti tal-ġestjoni tar-riskju tal-ICT.
EULAW Artikolu 11 6

6.   Bħala parti mill-ġestjoni komprensiva tar-riskju tal-ICT tagħhom, l-entitajiet finanzjarji għandhom:

(a)

jittestjaw il-pjanijiet ta’ kontinwità tal-operat tal-ICT u l-pjanijiet ta’ rispons u rkupru għall-ICT fir-rigward tas-sistemi tal-ICT li jappoġġjaw il-funzjonijiet kollha mill-anqas darba f’sena, kif ukoll fil-każ ta’ kwalunkwe bidla sostantiva fis-sistemi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti;

(b)

jittestjaw il-pjanijiet ta’ komunikazzjoni tal-kriżijiet stabbiliti f’konformità mal-Artikolu 14.

Għall-finijiet tal-ewwel subparagrafu, il-punt (a), l-entitajiet finanzjarji, għajr il-mikrointrapriżi, għandhom jinkludu fil-pjanijiet tal-ittestjar xenarji ta’ ċiberattakki u l-qlib minn infrastruttura primarja tal-ICT għall-oħra u l-kapaċità żejda, il-backups u l-faċilitajiet żejda meħtieġa biex jiġu ssodisfati l-obbligi stabbiliti fl-Artikolu 12.

L-entitajiet finanzjarji għandhom jirrevedu regolarment il-politika tagħhom tal-kontinwità tal-operat tal-ICT u l-pjanijiet tagħhom ta’ rispons u rkupru għall-ICT, filwaqt li jqisu r-riżultati tat-testijiet imwettqa f’konformità mal-ewwel subparagrafu u mar-rakkomandazzjonijiet li jirriżultaw minn kontrolli tal-awditjar jew rieżamijiet superviżorji.
EULAW Artikolu 32 Sigurtà tal-ipproċessar
-
EULAW Artikolu 21 Miżuri ta' ġestjoni tar-riskji taċ-ċibersigurtà
-

Kwistjonijiet marbuta

Links
is related to Annual
is related to relative Control Weighting = 10
is related to Process
is related to Govern
is related to SCRM Focus Tier 1 STRATEGIC
is related to SCRM Focus Tier 2 OPERATIONAL
is related to SCRM Focus Tier 3 TACTICAL
blocks Loss of Accountability / Attribution
blocks Excessive or Unauthorized Privilege
blocks Unauthorized Privilege Elevation
blocks Unauthorized Access
blocks Loss, Theft or Damage of Assets
blocks Unauthorized Modification / Loss of System Integrity
blocks Business / Service Interruption
blocks Data Loss / Integrity Compromise
blocks Reduced Operational Productivity
blocks System / Data Compromise (Technical Vector)
blocks System / Data Compromise (Non-Technical Vector)
blocks Revenue Loss
blocks Contractual Default / Termination
blocks Loss of Competitive Advantage
blocks Reputational Harm / Loss of Stakeholder Trust
blocks Regulatory / Legal / Contractual Financial Liability
blocks Exposure from Unaddressed Vulnerabilities
blocks System / Service Compromise
blocks Failure to Support Business / Mission Objectives
blocks Unaddressed Security / Compliance Exposure
blocks Unperformed / Unowned Control Responsibilities
blocks Uncontrolled Internal Security / Privacy Exposure
blocks Uncontrolled Third-Party Security / Privacy Exposure
blocks Lack of oversight of internal controls
blocks Lack of oversight of third-party controls
blocks Harm from Illegal, Abusive or Unsafe Content / Conduct
blocks Loss of Investigative / Evidentiary Capability
blocks Delayed Containment / Increased Incident Impact
blocks Incident Persistence / Recurrence
blocks Incident Response / Recovery Cost
blocks Undetected / Delayed Detection of Adverse Activity
blocks Lack of a security-minded workforce
blocks Third-Party Cybersecurity Compromise / Exposure
blocks Third-Party Physical Security Disruption / Exposure
blocks Sub-Tier / Fourth-Party Supply Chain Exposure
blocks Third-Party Legal / Compliance Exposure
blocks Harm from Unauthorized / Unintended Product or Service Use
blocks Third-Party Dependency Failure
blocks Loss of Authorization / Certification / License
blocks Inability to Demonstrate Due Diligence / Due Care
blocks Unreliable Assurance / Decision Information
blocks Drought & Water Shortage
blocks Earthquakes
blocks Fire & Wildfires
blocks Floods
blocks Hurricanes & Tropical Storms
blocks Landslides & Debris Flow
blocks Pandemic (Disease) Outbreaks
blocks Severe Weather
blocks Space Weather
blocks Thunderstorms & Lightning
blocks Tornadoes
blocks Tsunamis
blocks Volcanoes
blocks Winter Storms & Extreme Cold
blocks Dysfunctional Management Practices
blocks Human Error
blocks Statutory / Regulatory / Contractual Change
blocks Fraud, Corruption and/or Intentional Criminal Conduct
blocks Conflict of Interest (COI) / Undue Influence / Insider Misconduct
blocks Economic Shock / Market Disruption
blocks Workforce Shortage / Loss of Critical Skills / Labor Disruption
blocks OIS-07.01B
blocks Loss of Authorization / Certification / License
blocks Inability to Demonstrate Due Diligence / Due Care
blocks Unreliable Assurance / Decision Information
blocks Drought & Water Shortage
blocks Earthquakes
blocks Fire & Wildfires
blocks Floods
blocks Hurricanes & Tropical Storms
blocks Landslides & Debris Flow
blocks Pandemic (Disease) Outbreaks
blocks Severe Weather
blocks Space Weather
blocks Thunderstorms & Lightning
blocks Tornadoes
blocks Tsunamis
blocks Volcanoes
blocks Winter Storms & Extreme Cold
blocks Dysfunctional Management Practices
blocks Human Error
blocks Statutory / Regulatory / Contractual Change
blocks Fraud, Corruption and/or Intentional Criminal Conduct
blocks Conflict of Interest (COI) / Undue Influence / Insider Misconduct
blocks Economic Shock / Market Disruption
blocks Workforce Shortage / Loss of Critical Skills / Labor Disruption
blocks OIS-07.01B
is blocked by RSK-01 Risk Management Policy – Assessment Procedure
blocks GV GOVERN
blocks GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and …