1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4. Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate segregation and independence of ICT risk management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model.
5. The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request. L 333/30 EN Official Journal of the European Union 27.12.2022
6. The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity.
7. Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.
8. The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by:
(a) explaining how the ICT risk management framework supports the financial entity’s business strategy and objectives;
(b) establishing the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions;
(c) setting out clear information security objectives, including key performance indicators and key risk metrics;
(d) explaining the ICT reference architecture and any changes needed to reach specific business objectives;
(e) outlining the different mechanisms put in place to detect ICT-related incidents, prevent their impact and provide protection from it;
(f) evidencing the current digital operational resilience situation on the basis of the number of major ICT-related incidents reported and the effectiveness of preventive measures;
(g) implementing digital operational resilience testing, in accordance with Chapter IV of this Regulation;
(h) outlining a communication strategy in the event of ICT-related incidents the disclosure of which is required in accordance with Article 14.
9. Financial entities may, in the context of the digital operational resilience strategy referred to in paragraph 8, define a holistic ICT multi-vendor strategy, at group or entity level, showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers.
10. Financial entities may, in accordance with Union and national sectoral law, outsource the tasks of verifying compliance with ICT risk management requirements to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the ICT risk management requirements.
Organisaation tulee luoda ja ylläpitää kattava ja hyvin dokumentoitu riskienhallinan viitekehys.
Riskienhallinnan viitekehyksen tulisi sisältää ainakin:
joita käytetään kyberriskien hallintaan.
Riskienhallinnan viitekehys on tarkistettava vähintään kerran vuodessa.
Organisaatio on määritellyt menettelyt tietoturvariskien arviointiin ja käsittelyyn. Määrittely sisältää ainakin:
Tehtävän omistaja tarkistaa säännöllisesti, että riskikriteerit ovat selkeitä ja tuottavat johdonmukaisia arvioita.
Organisaatio pyrkii ennakoivasti listaamaan ja arvioimaan erilaisten tietoturvariskien todennäköisyyttä ja vakavuutta. Dokumentaatio sisältää seuraavat asiat:
Organisaation on huomioitava riskienhallintamenettelyjen tuottamat tulokset suunnitellessaan sisäisten auditointien aihepiirejä ja toteutusta sekä toteuttaessaan auditointeja.
Toteutettuja riskienhallintatoimenpiteitä sekä riskienhallinnan kokonaistilannetta tarkastalleen säännöllisesti.
Toimintamalli riskienhallinnan tilan seuraamiseen on selkeästi kuvattu.
Organisaation on luotava menettelykuvaus riskienhallintaprosesseille ja sen täytyy olla hyväksytty organisaatiossa. Organisaation on sovittava siitä organisaation sidosryhmien kanssa.
Organisaation on osana tietoturvariskien arviointia tehtävä arviot riskin toteutumisen vakavuudesta ja todennäköisyydestä.
Organisaatiolla on oltava selkeästi ohjeistettu riskiasteikko, jonka avulla jokainen riskien arviointiin osallistuva pystyy päättämään oikean tason vakavuudelle ja todennäköisyydelle.
Vastuu organisaatioiden ICT-riskien hallinnasta tulisi antaa toimijalle, joka on riittävän riippumaton riskienhallinnan suorittamiseksi ilman eturistiriitoja.
Riskienhallinnan riippumattomuus ja johtamis-, valvonta- ja auditointitoimien erottelu on varmistettava.
Kun esimerkiksi tietoliikenneverkon vikasietoisuus on kriittistä, sitä voidaan parantaa entisestään hankkimalla verkon peruspalvelut useampaa reittiä ja useamman palveluntuottajan kautta.
Organisaatiolla on toimintamalli riskienhallintaprosessin toimivuuden ja tehokkuuden jatkuvaan parantamiseen.
Parantamisessa voidaan hyödyntää mm. yleisiä standardeja (mm. ISO 27005) tai riskienhallintaan osallistuneiden henkilöiden palautteita.
Paranna osaamistasi viikoittaisten webinaarien, videokurssien, artikkeleiden ja blogien avulla.
