Cybersecurity Risk Management – Financial Services Entities Required to Act
By Jim Bulling
It seems clear following the release in March this year of ASIC Report 429 Cyber Resilience, that all Australian Financial Services Licensees and superannuation funds are currently required to include in their risk management framework measures aimed at addressing the risks posed by cybersecurity breaches.
In addressing the risks ASIC recommends that the U.S. National Institute for Standards and Technology (NIST) framework is a relevant risk management tool. The NIST standards set out the key objectives of an appropriate risk framework:
- identify the critical assets and governance processes
- protect critical assets
- detect breaches and incidents
- responses to breaches and incidents
- recovery and reinstatement of systems.
You can download a copy of the framework here
These objectives will need to be merged into the existing financial services policy frameworks which financial services entities already have in place.