+Artikel 8 2.

Artikel 8 2.

De in lid 1 bedoelde beleidslijnen en procedures voor ICT-operaties bevatten alle volgende elementen:

a) 

een beschrijving van ICT-assets, die alle volgende elementen bevat:

i) 

vereisten ten aanzien van veilige installatie, onderhoud, configuratie en verwijdering van een ICT-systeem;

ii) 

vereisten ten aanzien van het beheer van informatieassets die door ICT-assets worden gebruikt, met inbegrip van de verwerking en handling daarvan, zowel geautomatiseerd als handmatig;

iii) 

vereisten ten aanzien van de identificatie en controle van legacy ICT-systemen;

b) 

beheersmaatregelen en monitoring van ICT-systemen, met inbegrip van alle volgende elementen:

i) 

vereisten inzake back-up en herstel van ICT-systemen;

ii) 

vereisten inzake planning, rekening houdende met onderlinge afhankelijkheden van de ICT-systemen;

iii) 

protocollen voor audit-trail- en systeemlog-informatie;

iv) 

vereisten die borgen dat de uitvoering van interne audits en andere tests storingen van bedrijfsoperaties tot een minimum beperkt;

v) 

vereisten ten aanzien van de scheiding tussen de ICT-productieomgevingen en ontwikkelings-, test- en andere niet-productieomgevingen;

vi) 

vereisten om ontwikkeling en testen uit te voeren in omgevingen die gescheiden zijn van de productieomgeving;

vii) 

vereisten om ontwikkeling en testen uit te voeren in productieomgevingen;

c) 

foutafhandeling voor ICT-systemen, met inbegrip van alle volgende elementen:

i) 

procedures en protocollen voor foutafhandeling;

ii) 

ondersteunings- en escalatiecontacten, met inbegrip van contacten bij externe ondersteuning in het geval van onverwachte operationele of technische problemen;

iii) 

herstart-, rollback- en herstelprocedures van ICT-systemen voor toepassing bij een storing in het ICT-systeem.

Voor de toepassing van punt b), v), wordt bij de scheiding rekening gehouden met alle componenten van de omgeving, met inbegrip van accounts, gegevens en verbindingen, zoals voorgeschreven door artikel 13, eerste alinea, punt a).

Voor de toepassing van punt b), vii), wordt in de in lid 1 bedoelde beleidslijnen en procedures bepaald dat de gevallen waarin testen in een productieomgeving plaatsvindt, duidelijk geïdentificeerd worden, beargumenteerd worden, voor een beperkte tijd zijn en door de betrokken functie zijn goedgekeurd overeenkomstig artikel 16, lid 6. Financiële entiteiten borgen de beschikbaarheid, vertrouwelijkheid, integriteit en authenticiteit van ICT-systemen en productiegegevens tijdens de ontwikkelings- en testactiviteiten in de productieomgeving.

1. Overzicht

,

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde standaarden

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde standaarden

Standaarden
NOREA Critical and Important Functions
Identify, classify and adequately document all critical and important functions. This process involves determining which functions are essential for the entity's operational stability and continuity. Review as needed, and at least yearly, the adequacy of this classification.
NOREA Clear Segregation of Duties (SoD)
Establish Segregation of Duties (SoD) with regard to risk management functions, following the three lines of defence model or internal risk management and control model.
NOREA ICT Risk management framework

A sound, comprehensive and well-documented ICT risk management framework is in place. Which as goal to address all ICT risks properly and ensure a high level of digital resilience. The reponsibility for risk management is properly assigned to a control function. 

The ICT risk management framework shall be documented and reviewed at least annually, or periodically for microenterprises, with immediate reviews triggered by major ICT-related incidents or supervisory feedback. Continuous improvement will be ensured by incorporating lessons learned from implementation, monitoring, and audits. The report of the review will be prepared according to the requirements as stated in chapter 5 (Article 27) of the RTS RM and will be made available for submission to the competent authority upon request. 

Assess new standards and relevant technology developments in the field of information security, cybersecurity and resilience on a continuous basis and make proposals on how they can strengthen the information security and cybersecurity control measures of the institution.
NOREA Annual Framework Review and Audit Process

The effectiveness of the risk management framework is monitored based on the risk exposure over time to critical or important business functions. Implement a reviewing and auditing process, with a minimum yearly review of the framework, triggered by major ICT incidents, regulator instructions, or major audit findings. 

The tasks of verifying compliance with ICT risk management requirements may be outsourced to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the ICT risk management requirements.
NOREA Third-Party (Multi-vendor) Risk Management Program

Maintain a comprehensive third-party risk management program which includes:

  • A register of information related to the use of thirdparty service providers, especially those supporting critical or important functions (see also control 17.3).
  • Put in place a policy on the management of ICT third-parties, including the criteria for determining the criticality of service providers and the internal responsibilities for managing third-parties.
  • Ensuring that senior management reviews the policy and designate a member to monitor relations with the third-parties and the contractual arrangements.
  • A (holistic) multi-vendor strategy, if deemed relevant,  showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers.  
NOREA Change Procedures
Ensure that all changes to software, hardware, firmware components, and systems, along with security parameters, are appropriately placed and scoped. Document and communicate change details, including the purpose and scope of the change, the implementation timeline, and expected outcomes. Define clear roles and responsibilities to ensure that changes are defined, planned, transitioned, tested, and finalized in a controlled manner. Additionally, establish effective quality assurance procedures. Implement mechanisms to maintain independence between the functions that approve changes and those responsible for requesting and implementing them.
NOREA Security Requirements
Identify the potential impact of a change on existing security measures and assess whether additional security measures are required for its implementation. Verify that security requirements have been met for all implemented changes. Establish fallback procedures and assign responsibilities for aborting changes or recovering from changes not successfully implemented.
NOREA Emergency Change Management
Define procedures for documenting, reevaluating, assessing, and approving the implementation of emergency changes, including workarounds and patches.
NOREA OTAP Implementation
Ensure segregation of production environments from development, testing, and other non-production environments, encompassing all components of an environment. This also includes requirements to conduct the development and testing in production environments. Ensure that the instances in which testing is performed in production environment are clearly identified, justified, for limited periods of time approved by the relevant function.
NOREA Error Handling and Recovery
Establish guidelines for handling errors, including support and escalation contacts, as well as external support contacts in case of unexpected operational or technical issues. Define the procedures for ICT system restart, rollback, and recovery to be used in the event of an ICT system disruption. Ensure the contact details are available in case systems are unavailable as well.
NOREA Protection Measures

Implement policies and procedures to protect all information, ICT assets, and relevant physical ICT components and infrastructures. At least the following policies shall be established and maintained.

  • Security policy
  • Human resources policy
  • Encryption and cryptographic control policy
  • Identity and access management (IAM) policy
  • Change management policy
  • Network security policy
  • ICT operating policies and procedures
  • (Crisis) Communication policy
  • Vulnerability and patch management policy
  • Back up policy
  • Project management policy
  • Physical and environmental security policy
  • Business continuity policy with response and recovery plans (including testing plans), see control1.4 *
  • ICT third-party service providers management policy, see control 1.1. *
  • Operations of ICT assets (ensuring network security, protect against intrusions and data misuse and defining how the entity operates, monitors, controls, and restores ICT assets, including the documentation of ICT operations).

* must be approved by the Management body
NOREA ICT Monitoring

Develop, document and implement capacity and performance management procedures to identify capacity requirements of their ICT systems and apply resource optimisation and monitoring procedures to maintain and improve the availability of data and ICT systems and efficiency of ICT systems and prevent ICT capacity shortages.
NOREA Clock Synchronization Standardization

Ensure clock synchronization of all ICT systems to a single reliable reference source time.
NOREA System Management and Security

Provide system descriptions that encompass secure installation, maintenance, configuration, and deinstallation/disposal of ICT assets. This includes the management of assets, both automated and manual, and the identification and control of legacy ICT systems.
  • Builddate: 25.06.2024 00:00:00 -Doknr: CELEX:32024R1774
  • EULAW -

    EN: Legal acts of the European Union from EUR-Lex, https://eur-lex.europa.eu/. © European Union. Re-use is authorised by Decision 2011/833/EU, provided the source is acknowledged; the consolidated texts are licensed under CC BY 4.0 (EUR-Lex legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the legislation published in the Official Journal of the European Union is deemed authentic.

    DE: Rechtsakte der Europäischen Union aus EUR-Lex, https://eur-lex.europa.eu/. © Europäische Union. Weiterverwendung nach Beschluss 2011/833/EU mit Quellenangabe gestattet; die konsolidierten Fassungen stehen unter CC BY 4.0 (Rechtlicher Hinweis von EUR-Lex). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Verbindlich sind allein die im Amtsblatt der Europäischen Union veröffentlichten Rechtsakte.