ICT risk management policies

Development, Documentation and Implementation (Article 3 RTS RMF)

Financial entities must develop, document and implement ICT risk management policies and procedures.
These policies must contain all mandatory elements listed in Article 3 of the RTS on the Risk Management Framework (RMF).

The policies must include:

an indication of the approval of the ICT risk tolerance level established in accordance with Article 6(8)(b) DORA.

The policies must define the procedure and methodology for conducting ICT risk assessments, identifying:

vulnerabilities and threats that affect or may affect supported business functions, ICT systems and ICT assets.

quantitative or qualitative indicators used to measure impact and likelihood of the vulnerabilities and threats identified under point (i).

The policies must specify the procedure to identify, implement and document ICT risk treatment measures, including:

the determination of ICT risk treatment measures necessary to bring ICT risk within the established risk tolerance level.

Additionally, the procedure must ensure:

monitoring of the effectiveness of ICT risk treatment measures;
assessment of whether the risk tolerance levels have been attained;
assessment of whether the entity has taken actions to correct or improve risk treatment measures where necessary.

For residual ICT risks that remain after treatment, the policies must include:

Assignment of roles and responsibilities for:

accepting residual ICT risks that exceed the financial entity’s risk tolerance level;
executing the review process referred to in point (iv).

development of an inventory of accepted residual ICT risks, including the justification for acceptance.

Provisions for reviewing accepted residual ICT risks at least once per year, including:

identification of changes to residual ICT risks;
assessment of available mitigation measures;
assessment of whether the reasons justifying acceptance remain valid at the date of review.

The policies must include provisions on monitoring:

ICT risk of the financial entity, enabling prompt detection of changes affecting the ICT risk profile.

The policies must ensure that changes to:

the business strategy, and
the digital operational resilience strategy,
are duly taken into account in the ICT risk management process.

RTS RMF