This article is a collaborative effort between Jeeves D’AI and Danny Zeegers, a Certified Lead Auditor and DORA Compliance Officer, to emphasize the critical importance of robust hardware and supplier risk assessments. In an era where digital operational resilience is not just a regulatory requirement but a business imperative, organizations must prioritize evaluating and mitigating risks associated with their hardware and supplier ecosystems. With the evolving regulatory landscape, including the Digital Operational Resilience Act (DORA), the need for mandatory and comprehensive assessments is no longer optional—it is a cornerstone of sustainable operational resilience and compliance.
lets start with risk assessment in alignment with DORA (Digital Operational Resilience Act) requirements, using the outlined policies and procedures, follow these steps:
1. Establish the Scope of Risk Assessment
- Identify Critical Functions: Use the ICT risk management policy to map critical business and ICT functions that require protection.
- Align with DORA Articles 6–14: Review these articles to understand the mandatory operational resilience and risk management requirements.
- Consider Dependencies: Include third-party services and interdependencies in your scope.
2. Leverage Existing Policies and Procedures
- Policies: Define strategic objectives and principles for each area in Column 1 (e.g., ICT asset management, encryption).
- Procedures: Detail operational steps for implementation based on Column 2 (e.g., vulnerability management, logging).
- Policies and Procedures Together: Areas in Column 3, such as ICT risk management, require both governance and practical measures to ensure risks are identified and mitigated effectively.
3. Develop a Risk Assessment Framework
- Create a Risk Inventory:
-
- Use the ICT asset management policies and procedures to identify all ICT assets.
- Categorize them based on their criticality to operations.
- Risk Identification:
-
- Map risks like system failures, cyberattacks, or third-party disruptions to each ICT asset or function.
- Use the data and system security and logging procedures to gather insights on vulnerabilities.
- Risk Analysis:
- Evaluate the likelihood and impact of identified risks using capacity and performance management metrics.
- Risk Evaluation:
- Prioritize risks based on their potential to disrupt business operations (aligned with DORA’s operational resilience goals).
4. Integrate Policies and Procedures with the Risk Assessment
- ICT Risk Management: Use this policy to establish risk acceptance criteria and ensure all identified risks are tracked.
- ICT Operations and Network Security Management:
-
- Establish safeguards for maintaining operational integrity and ensuring secure communication.
- Security Information in Transit: Identify and mitigate risks in data transmission as part of the risk assessment process.
5. Perform a Gap Analysis
- Compare your existing policies and procedures with DORA requirements to identify gaps.
- Pay special attention to areas requiring both policies and procedures (e.g., ICT risk management, ICT operations).
6. Establish a Risk Mitigation Plan
- Controls: Implement controls specified in ISO 27001:2022 Annex A and DORA guidelines.
- Monitor and Update:
-
- Use vulnerability and patch management procedures to address identified vulnerabilities.
- Regularly update the risk assessment as new risks emerge or business contexts change.
7. Incorporate Continuous Monitoring
- Set up a system for continuous risk monitoring using logging and data/system security procedures.
- Develop an incident response plan (aligned with ICT-related incident management policies) to address risks proactively.
8. Document and Report
- Document the risk assessment process and findings.
- Report results to stakeholders in alignment with ICT risk management policies.
9. Review and Improve
- Use feedback from regular audits and incidents to update your risk assessment and policies.
- Continuously align with updates to DORA and related standards.
By using the structure and elements in the provided table, you can create a risk assessment process that not only aligns with DORA but also strengthens your overall operational resilience framework.
Here’s an overview of the minimum needed policies and procedures for alignment with the requirements you shared. These are grouped based on the provided columns and categorized for clarity:
1. Policies (Strategic Guidance)
These policies provide high-level principles and objectives for critical areas.
- ICT Asset Management Policy
- Define the governance of ICT assets, including inventory and lifecycle management.
- Encryption and Cryptographic Controls Policy
- Establish guidelines for encryption standards and key management.
- ICT Project Management Policy
- Outline principles for managing ICT projects, ensuring they align with operational resilience goals.
- Acquisition, Development, and Maintenance of ICT Systems Policy
- Specify criteria for secure development and acquisition processes.
- Physical and Environmental Security Policy
- Address physical protection of ICT infrastructure.
- Human Resources Policy
- Cover employee roles, training, and security awareness.
- Identity Management Policy
- Set rules for identity governance, authentication, and access rights.
- Access Control Policy
- Define access levels and permissions based on roles.
- ICT-Related Incident Management Policy
- Establish high-level principles for managing and reporting ICT incidents.
- ICT Business Continuity Policy
- Provide guidance for ensuring continuity during disruptions.
2. Procedures (Operational Implementation)
These procedures detail step-by-step actions for critical operations.
- ICT Asset Management Procedures
- Include asset tracking, classification, and decommissioning processes.
- Capacity and Performance Management Procedures
- Define metrics and methods for monitoring system capacity and performance.
- Vulnerability and Patch Management Procedures
- Outline steps for identifying, assessing, and addressing vulnerabilities.
- Data and System Security Procedures
- Specify measures for securing data at rest, in transit, and during processing.
- Logging Procedures
- Detail requirements for system logs, including retention and analysis.
- Acquisition, Development, and Maintenance of ICT Systems Procedures
- Include steps for secure coding, testing, and deployment.
- ICT Change Management Procedures
- Establish guidelines for assessing, approving, and implementing changes.
- Identity Management Procedures
- Define processes for onboarding, offboarding, and access reviews.
3. Combined Policies and Procedures
These areas require both strategic guidance (policies) and detailed operational steps (procedures).
- ICT Risk Management
-
- Policy: Define the organization’s risk appetite and governance structure for managing ICT risks.
- Procedures: Include risk identification, assessment, mitigation, and monitoring processes.
- ICT Operations
-
- Policy: Establish objectives for ICT operations to ensure reliability and resilience.
- Procedures: Detail operational steps, such as monitoring, backup, and incident response.
- Network Security Management
-
- Policy: Set rules for securing network infrastructure and communication channels.
- Procedures: Specify firewall configurations, intrusion detection, and network segmentation.
- Security Information in Transit
-
- Policy: Define principles for protecting data in transit using encryption.
- Procedures: Include steps for implementing secure communication protocols (e.g., TLS).
Integration with DORA
- These policies and procedures should collectively support the ICT risk management framework required by DORA.
- Ensure alignment with Articles 6–14 of DORA to address governance, risk management, operational resilience, and incident reporting.
Key Notes
- Start by developing the policies and procedures listed under Column 3 (Combined) since these are foundational.
- Ensure that all other policies (Column 1) and procedures (Column 2) support the risk management framework and operational resilience goals.
This minimum overview provides a strong foundation while keeping complexity manageable. You can expand further as needed based on your organization’s size and risk profile.
Conclusion
In today’s complex regulatory landscape, understanding and implementing effective risk assessments is essential for maintaining operational resilience and compliance with frameworks like NIS2 and DORA.
Introduction of need to have toolsets
In today’s evolving cybersecurity landscape, companies need robust tools and strategies to enhance their resilience. With Qfirst’s innovative toolset, CATS, businesses can efficiently create tailored policies and procedures aligned with their unique setup through a structured self-assessment process. For added assurance, these can be reviewed by experienced auditors from Qfirst, ensuring alignment with industry standards.
To address ICT supplier risks, ComplianceGuard360 offers a cutting-edge solution using comprehensive surveys and dark web footprint scans to identify vulnerabilities and ensure third-party resilience. Together, these tools provide businesses with the power to elevate their cybersecurity footprint, aligning with frameworks like NIS2 and DORA, and staying ahead of emerging threats. 🚀
START2 RISK 3D is the ultimate guide for business decision-makers, offering a comprehensive exploration of the “ins and outs” of risk assessment tailored to these regulations. By ordering this book, you’ll gain valuable insights and practical strategies to enhance your organization’s risk management practices, ensuring not just compliance but also a competitive edge in navigating today’s digital challenges.
