What it asks for. Financial entities must have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, covering strategies, policies, procedures, ICT protocols and tools needed to protect information and ICT assets.
In practice. The framework includes an information security management system based on recognised standards, a digital operational resilience strategy setting out ICT risk tolerance, objectives, key performance indicators and the approach to third-party risk, and clear segregation between ICT risk management, control and internal audit functions. A control function with appropriate independence is assigned responsibility for ICT risk. The framework is reviewed at least yearly, after major ICT-related incidents and following supervisory findings, and the review report is provided to the competent authority on request. Internal audit reviews it regularly, with formal follow-up of findings. Evidence includes approved policies, review reports, audit plans and the strategy document.
Common gaps. Gaps include frameworks that exist on paper without measurable tolerance levels, weak independence of the control function, and audit findings without tracked remediation.