DORA Ch. II Sec. II Art. 11 3.

NOREA

Critical and Important Functions
Identify, classify and adequately document all critical and important functions. This process involves determining which functions are essential for the entity's operational stability and continuity. Review as needed, and at least yearly, the adequacy of this classification.

NOREA

Clear Segregation of Duties (SoD)
Establish Segregation of Duties (SoD) with regard to risk management functions, following the three lines of defence model or internal risk management and control model.

NOREA

ICT Risk management framework

A sound, comprehensive and well-documented ICT risk management framework is in place. Which as goal to address all ICT risks properly and ensure a high level of digital resilience. The reponsibility for risk management is properly assigned to a control function.

The ICT risk management framework shall be documented and reviewed at least annually, or periodically for microenterprises, with immediate reviews triggered by major ICT-related incidents or supervisory feedback. Continuous improvement will be ensured by incorporating lessons learned from implementation, monitoring, and audits. The report of the review will be prepared according to the requirements as stated in chapter 5 (Article 27) of the RTS RM and will be made available for submission to the competent authority upon request.

Assess new standards and relevant technology developments in the field of information security, cybersecurity and resilience on a continuous basis and make proposals on how they can strengthen the information security and cybersecurity control measures of the institution.

NOREA

Annual Framework Review and Audit Process

The effectiveness of the risk management framework is monitored based on the risk exposure over time to critical or important business functions. Implement a reviewing and auditing process, with a minimum yearly review of the framework, triggered by major ICT incidents, regulator instructions, or major audit findings.

The tasks of verifying compliance with ICT risk management requirements may be outsourced to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the ICT risk management requirements.

NOREA

Third-Party (Multi-vendor) Risk Management Program

Maintain a comprehensive third-party risk management program which includes:

A register of information related to the use of thirdparty service providers, especially those supporting critical or important functions (see also control 17.3).
Put in place a policy on the management of ICT third-parties, including the criteria for determining the criticality of service providers and the internal responsibilities for managing third-parties.
Ensuring that senior management reviews the policy and designate a member to monitor relations with the third-parties and the contractual arrangements.
A (holistic) multi-vendor strategy, if deemed relevant, showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers.

NOREA

Audit approach and frequency

The Internal audit department shall conduct audits on the following domains:

Risk management framework, policies, related processes, and procedures
ICT Response and recovery plans
ICT Third-party service providers

Adjust audit frequency and focus based on the entity's ICT risk profile.

NOREA

Auditor requirements

Ensure that the internal audit staff possess sufficient ICT risk knowledge, skills, and expertise to perform the audits. Also, ensure the independence of the audit function.

NOREA

Audit findings

Establish a follow-up process for audit findings, including rules for timely verification and remediation of critical findings. Maintain a continuous learning and improvement process based on risk assessment results, resilience testing, (cyber) incidents, and testing of business continuity plans. The results of this process shall be reported to the management body and is input for the yearly “Report on the ICT risk management framework review” as stated in Chapter 5 (Article 27) of RTS RM.

NOREA

Reliance Third-Party Assurance and Certifications

Use, where appropriate, third-party certifications, third-party or internal audit reports made available by the ICT third-party service provider, or own audit reports to confirm adherence of contractual requirements on information access, inspection, audit, and ICT testing with the third-party. Rely on third-party certifications and audit reports from ICT third-party service providers only if the following specific conditions are met: the audit plan is aligned with contractual arrangements, the audit scope is comprehensive and covers identified systems and key controls, ongoing assessment of certification/report content are performed and validated, key systems and controls are covered in future versions of the certification or audit report, there is confidence in the certifying/auditing party's capabilities, certifications/audits adhere to recognized professional standards, the right to request scope expansion is covered in the contract, and right to perform discretionary audits is retained.

NOREA

Protection Measures

Implement policies and procedures to protect all information, ICT assets, and relevant physical ICT components and infrastructures. At least the following policies shall be established and maintained.

Security policy
Human resources policy
Encryption and cryptographic control policy
Identity and access management (IAM) policy
Change management policy
Network security policy
ICT operating policies and procedures
(Crisis) Communication policy
Vulnerability and patch management policy
Back up policy
Project management policy
Physical and environmental security policy
Business continuity policy with response and recovery plans (including testing plans), see control1.4 *
ICT third-party service providers management policy, see control 1.1. *
Operations of ICT assets (ensuring network security, protect against intrusions and data misuse and defining how the entity operates, monitors, controls, and restores ICT assets, including the documentation of ICT operations).

* must be approved by the Management body

SCF

Business Continuity Management System (BCMS)

Description

Mechanisms exist to facilitate the implementation of contingency planning controls to help ensure resilient Technology Assets, Applications and/or Services (TAAS) (e.g., Continuity of Operations Plan (COOP) or Business Continuity & Disaster Recovery (BC/DR) playbooks).