Call us now:
A very important read for FIs in the EU, as European Banking, Insurance, and Securities regulators start the consultation process on the Digital Operational Resilience ACT (DORA). That will effect EU Financial Institutions from 2025.
The EU Banking Authority, Insurance and Occupational Pensions Authority, and the Securities and Market Authority has started to collect feedback on DORA. Specifically the ICT risk management framework, criteria for ICT related incidents, templates for the register of information, contractual arrangement and the policy on ICT services performed by ICT third party providers.
For those FIs and covered ICT providers these documents provide an outline of oversight and assurance that EU FI regulators are seeking under DORA. As the Act is on the EU Journal the final national regulation will be in place in 18 months. Reviewing the below, it will create a framework for the oversight and assurance of ICT risks, contracts and services. Requiring both covered FIs and ICT services providers to demonstrate that they are managing ICT risk.
For example Ted Dziekanowski. Chapter II Register of Information at Entity level (article 4), of the Draft technical standard is interesting. Covered entities are required to maintain and up to date register of information on all material subcontractors and contractual arrangements for at least 5 years after contract termination. Subcontractors that include those providing services to another ICT third party service provider in the same ‘ICT services supply chain’.
Another regulatory train for cybersecurity risk management, that has left the station. One suspect that the consultation process will be challenging.
Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA Jamie Foster
#cybersecurity #cyberriskmanagement #cyberregulation #dora
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7076817654195314689