Call us now:
A nice article that discusses the requirements of UK Financial Conduct Authority (FCA) for UK Covered Financial Institutions (FIs) to comply with Operational Resilience rules by March 2025. Specifically the obligations for FIs to demonstrate management over cybersecurity and maintain Operational Resilience. (https://lnkd.in/eJcbSt3T.)
While the FCA guidance is focused on Operations Resilience, cyber attacks are by far the largest non financial risk and by extension the largest operational risk FIs face. The guidance and policy requires covered entities demonstrate oversight, assurance and attestation over cyber resilience. With many overtones of the EU Digital Operational Resilience Act (DORA) that comes into force in January 2025 for many EU covered FIs. The FCA guidance requires covered FIs to
1. Identifying critical services, in line with business risk
2. Establish risk tolerance based upon business resilience.
3. Establish third party supply risk and resilience.
4. Evaluate business impact of cyber attacks through scenario testing.
5. Demonstrate risk mitigation.
6. Implement Plans of Action and Milestones to manage cyber risk resilience.
7. Demonstrate Governance oversight and assurance over cyber resilience.
8. Embed an appropriate corporate culture to center operational resilience from the shop floor to the board room.
When one reads the FCAs requirements there is clear alignment with EU DORA compliance, that can be achieve through current requirements to manage regulatory capital.
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC Financial Conduct Authority
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7212775429898694656