ICT Risk Management
What is ICT Risk Management?
The process of identifying, assessing, and managing risks associated with information and communication technology. ICT risk management is central to DORA, CPS 234, and other technology-focused regulations.
Terms that appear alongside ict risk management
Each of these is named in at least one of the same controls as ict risk management. The number is how many controls name both.
- risk management framework 5 shared controls
- digital operational resilience 4 shared controls
- resilience 4 shared controls
- operational resilience 4 shared controls
- gdpr 2 shared controls
- governance 2 shared controls
Frameworks that govern ict risk management
What the standards actually require on ict risk management
Requirements naming ict risk management across 5 standards, quoted from the control text.
Articles 5 to 15 are disapplied for: investment firms that are small and non-interconnected; payment institutions and electronic money institutions exempted under their directives;
DORA-Art.16 · Simplified ICT risk management framework →The simplified framework must set ICT risk tolerance in line with risk appetite; identify and assess ICT risks; set mitigation strategies at least for risks outside tolerance and monitor their effectiveness;
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::31 · Article 31: ICT risk management (simplified framework) →The policy must keep contracts consistent with the ICT risk management framework, information security policy, ICT business continuity policy and incident reporting duties of DORA;
dora-rts-on-ict-third-party-contractual-policy-commission-delegated-regulation-eu-2024-1773::3.6 · Article 3(6) to (8): Alignment, audit and non-negotiable contract principles →Article 99 obliges Member States to ensure adequate + effective out-of-court complaint + redress procedures for disputes between PSUs and PSPs. Article 100 designates competent authorities.
PSD2-Art.99_103 · Out-of-court redress, competent authorities and penalties (PSD2 Articles 99-103) →Agencies should assess data security risks for their datasets as part of the Government ICT Risk Management Methodology, using its Data Security Risk Assessment Methodology, when acquiring a new dataset, developing an ICT system holding personal or entity data...
singapore-government-instruction-manual-on-ictss-management-im8::DSP-01 · Data security risk assessment for datasets →Questions people ask about ict risk management
What is ICT Risk Management?
Why is ICT Risk Management important for compliance?
Which compliance frameworks address ICT Risk Management?
Where can I learn more about ICT Risk Management?
See how ICT Risk Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.