+Article 21 Cyber risk
---+Article 21 1
---+Article 21 2
---+Article 21 3
---+Article 21 4
---+Article 21 5
---+Article 21 6

Article 21 Cyber risk

1. Przegląd

,
Article 21 1

1.   A SIPS operator shall establish a comprehensive cyber resilience framework with appropriate governance measures that enables it to effectively and efficiently manage cyber risks, and a cyber resilience strategy that takes into account the risk tolerance and risk appetite of the SIPS operator.
Article 21 2

2.   The cyber resilience framework referred to in paragraph 1 shall ensure at least:

(a)

the identification and classification of key roles, including accountability for decision-making within the organisation, processes, operations, services, and information assets that support the SIPS’s critical operations and services in order to ensure that appropriate measures are in place for their protection and timely recovery in the event of a cyber attack;

(b)

the adequate protection of the SIPS from cyber risks, including by implementing effective security controls and conducting control activities on the functioning and security of main ICT systems, processing or storing sensitive information;

(c)

the timely and appropriate detection of any cyber incident or signs of it, including through the monitoring of anomalous activities;

(d)

the response to and recovery from any cyber incident or any adverse event in a timely and appropriate manner, enabling the SIPS to resume critical operations rapidly and in a way that limits any damage to the SIPS.
Article 21 3

3.   A SIPS operator shall establish a testing programme to regularly test the operational effectiveness of all processes, procedures and controls of the cyber resilience framework referred to in paragraphs 1 and 2. As part of this testing programme, the SIPS operator shall conduct TIBER-EU threat-led penetration tests involving the use of techniques to simulate an attack on the SIPS’s critical functions and underlying systems as set out under the TIBER-EU framework.

Where a branch is identified as a SIPS operator, the competent authority may take into account the results of a penetration test performed by the legal entity of which the branch is a legally dependent part if such penetration test can be deemed a comparable exercise to a TIBER-EU test, and if it also captures the effectiveness of the branch’s relevant controls and systems.
Article 21 4

4.   A SIPS operator shall ensure that its Board and Management, and where applicable the Branch Management, as well as the staff of the SIPS operator have a sound understanding of cyber resilience and a sound level of situational awareness of the cyber threat environment within which it operates through an effective threat intelligence process and information sharing within its organisation and with other interconnected entities across the financial system.
Article 21 5

5.   A SIPS operator shall have in place appropriate systems, policies, procedures and controls that enable it to assess and gain understanding of the effectiveness of the implementation of its cyber resilience strategy and framework.
Article 21 6

6.   A SIPS operator shall have procedures in place to ensure that at least any major cyber incidents that negatively impact the SIPS, including incidents originating with the SIPS participants and third-party service providers, are reported to: (a) the Board, the Management, and, where applicable, the Branch Management; and (b) the competent authority. A SIPS operator shall have in place processes of continuous learning and improvement related to cyber security. These processes shall include, for instance, ensuring that the cyber resilience framework considers threat developments as well as reviews of cyber incidents with lessons learned.

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane normy

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane normy

Normy