EBA guidelines on ICT and security risk management
In the EBA guidelines for security risk management, the approach is to find a way to address outsourcing, innovation and balance it with compliance. Despite requests from public consultants to delete FinTech from the report, the ICT guidelines explicitly include provisions for security risk management that include all the relevant industry players.
The guidelines are comprised of the following categories:
Proportionality
All the financial institutions are obligated to comply with the provisions in the EBA guidelines in a way that is proportionate to the size of the institution, its internal organization, scope, nature, complexity, and riskiness of the product/services provided.
Governance and Strategy
The security risk management is obligated to involve the management body to ensure adequate governance, high standards of quality, and staff skills as well as the approval, supervision, and implementation of robust ICT strategies.
Within their strategy, the institutions have to evolve to effectively support organizational structure, ICT system changes, third-party dependencies as well as their staff and processes.
ICT and Security Risk Management Framework
The institutions are obligated to identify and manage their infrastructure according to ICT guidelines. In addition to that, responsibility has to be directly assigned in order to manage and oversee ICT and security risks. This section covers assigning key roles and responsibilities, determining risk, and fixing problems from lessons learned.
A system of risk classification and assessment lays out how to mitigate risk and how to report relevant information according to the EBA guidelines. It also continuously audits the systems in place.
Information Security
Under information security, the EBA guidelines define what constitutes an acceptable information security policy for security risk management. The ICT guidelines also outline logical security, physical security, ICT operations security, security monitoring, information security reviews, assessment and testing, and information security training and awareness.
ICT Operations Management
In this section of the EBA guidelines, the financial institutions are advised to manage their ICT operations based on procedures and processes implemented by the management body. Incident and problem management are also covered, and it is explained how to best collaborate with the relevant responder in the event of an issue.
ICT Project and Change Management
The institutions are instructed to set up a project governance process that defines responsibilities, assigns roles, and lays out accountability to support the implementation of ICT guidelines and strategies.
You will also find a section on ICT systems acquisitions and development and the ICT management change protocol.
Business Continuity Management
In the event of severe business disruptions as a result of any cyber-attacks or security breaches, the institutions must be prepared to smoothly transition back into normalcy. The process described involves a business impact analysis, a business continuity and response plan, recovery plans, testing the plans, and finally setting up channels of communication during a crisis.
Payment Service User Relationship Management
The PSPs' security risk management is mandated to establish and implement processes that increase awareness of security risks linked to each service. In light of new threats, assistance and guidance have to be implemented.
The rest of the EBA guidelines for PSPs are about the detection of fraudulent or malicious account uses, and ways to prevent breaches by disabling certain functions.
The use of third-party providers – EBA outsourcing guidelines
In the EBA outsourcing guidelines, the authority defines outsourcing as an arrangement between a regulated institution and a service provider who performs a process, service, or activity that would normally be taken care of internally.
Thus, each institution is advised to determine which arrangements fall under third-party outsourcing. The rules are stricter on the more sensitive tasks that could cause disruptions like systemic failure when compromised.
The EBA guidelines on outsourcing state that the institutions have to ensure that their risk-mitigating measures are effective when using third-party providers.
Therefore, third-party providers fall under the institution's definition of risk management.
To make sure that there is continuity of ICT services and ICT systems, the EBA outsourcing guidelines recommend institutions to ensure that the contracts and service- agreements, include the following measures:
- There has to be appropriate and proportionate information about the security-related objectives and measures. These have to include the minimum cyber security requirements, specs for the institution’s data life cycle, requirements about data encryption, network security and monitoring processes as well as the location of data centers.
- The EBA outsourcing guidelines state that there need to be operational and security incident handling procedures that include escalation and reporting.
The financial institutions that enter into these agreements with third-party providers have to monitor and ensure that the level of compliance with the security measures, objectives, and performance targets are met.
The security standard of third-party providers has to be up to par with the standard of the institutions that hire them, as stated in the EBA outsourcing guidelines.
Conclusion
The EBA guidelines particularly name cloud services as the highest security risk.
Cloud deployment efforts have increased across most industries, which was accelerated by the pandemic, forcing more people to work from home. The EBA guidelines on outsourcing, aim to cover the potential areas of risk that come with cloud-based workplaces.
Through software like LeanIX, large institutions are given the necessary tools and services within their enterprise architecture, while effectively managing application portfolios.
For enterprises that use more than 100 applications in their day-to-day operations, maintaining application transparency is an extremely difficult task. Thus, effective application management makes it much easier to adhere to the EBA guidelines on outsourcing.
LeanIX helps the mentioned institutions to keep a handle on all software from different vendors. After all, with an emphasis on third-party provider monitoring, conforming to complex EBA guidelines is much more feasible than it seems.
/EN/Reports/Thumbnail-Obsolescence-Gartner.png?width=260&height=171&name=Thumbnail-Obsolescence-Gartner.png)
/EN-Tech-Stacks-Poster_Resource_Page_Thumbnail.png?width=260&height=171&name=EN-Tech-Stacks-Poster_Resource_Page_Thumbnail.png)
