Reply S.p.A. · MIL:REY
Reply — Avantage Reply Briefing Note DORA CP Overview
25 slides from Reply's investor presentation, Jul 7, 2023
Slide 1: EU DORA Reforms
EU DORA Reforms Overview of the Joint Consultation on the First Batch of DORA Policy Products 7th July 2023
Slide 2: Contents
Confidential Contents Section 1: Introduction Regulatory Technical Standards (RTS) on ICT Risk Management Framework and Section 2A: Simplified ICT Risk Management Framework Section 2B: RTS on Criteria for the Classification of ICT-related Incidents Section 2C: RTS to Specify the Policy on ICT Servic
Slide 3: Section 1: Introduction
Section 1: Introduction
Slide 4: Introduction (1/2)
Introduction (1/2) The Digital Operational Resilience Act (DORA) On 19th June 2023 The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) launched a public consultation on the first batch of policy products under the DORA. This pack provides an overview of the four draft regulatory te
Slide 5: Introduction (2/2)
Introduction (2/2) DORA mandates the ESAs to prepare through the Joint Committee (JC), a set of policy products with two main submission 19/06/2023 ESAs publish deadlines: 17 January 2024 (first batch) and 1st batch of draft technical 17 June 2024 (second batch). standards The first batch consists o
Slide 6: Section 2A: Draft RTS 1 & 2
Section 2A: Draft RTS 1 & 2 To further harmonise ICT risk management tools, methods, processes and policies
Slide 7: Overview of Draft RTS 1 & 2 – ICT Risk Management
Overview of Draft RTS 1 & 2 – ICT Risk Management PURPOSE: To provide more specific guidance to financial entities (FEs) on the requirements for ICT risk management, with a simplified framework provided under Title II for the small and non-interconnected firm. KEY MESSAGES: Chapter I: ICT security p
Slide 8: Section 2B: Draft RTS 3
Section 2B: Draft RTS 3 Specifying the criteria for the classification of ICT related incidents, materiality thresholds for major incidents and significant cyber threats
Slide 9: Overview of Draft RTS 3 – Defining Major Incidents and Classification Criteria
Overview of Draft RTS 3 – Defining Major Incidents and Classification Criteria PURPOSE: this CP outlines: • The classification criteria for ICT-related incidents or, as applicable, operational or security payment-related incidents • Materiality thresholds for determining major incidents • The criter
Slide 10: Section 2C: Draft RTS 4
Section 2C: Draft RTS 4 To specify the detailed content of the policy in relation to the contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers
Slide 11: Overview of Draft RTS 4 - Policy on ICT Services Performed by ICT TPPs
Overview of Draft RTS 4 - Policy on ICT Services Performed by ICT TPPs PURPOSE: This CP further specifies what the policy in relation to the contractual arrangements on the use of ICT services supporting critical or important functions should include, and the governance surrounding the policy KEY ME
Slide 12: Section 2D: Draft ITS
Section 2D: Draft ITS To establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers
Slide 13: Overview of Draft ITS
Overview of Draft ITS PURPOSE: The CP includes a set of templates which form the register of information (at entity, sub-consolidated and consolidated levels) in relation to all contractual arrangements on the use of ICT services provided by ICT Third Party Service Providers (ICT TPPs). KEY MESSAGES
Slide 14: Next Steps
Next Steps
Slide 15: Next Steps
Next Steps The ESAs deadline for the submission of comments in response to the consultation is 11 September 2023. A public hearing has been organised in the form of a webinar on 13 July 2023 from 09:00 to 18:00 CET. The ESAs have invited interested stakeholders to register using this Registration fo
Slide 16: Contact Us
Contact Us Vishwas has international FS consulting and risk management Ritianne is a highly experienced professional in the financial experience across Europe, the US, the Middle East and SE Asia, services industry, with a career spanning over fifteen years. Having leading a multitude of risk transf
Slide 17: About Reply
About Reply
Slide 18: We combine geographical footprint with deep specialist domain expertise
We combine geographical footprint with deep specialist domain expertise Reply Group – a leading global consulting services partner operating across a number of different segments, combining specific sector expertise with wide experience in delivery services and technology capabilities UK GERMANY Che
Slide 19: Appendix
Appendix
Slide 20: Structure of Draft RTS 1 & 2 (ICT RMF) – List of Articles: Title I
Structure of Draft RTS 1 & 2 (ICT RMF) – List of Articles: Title I Chapter I. ICT SECURITY POLICIES, PROCEDURES, PROTOCOLS, AND Chapter III. ICT-RELATED INCIDENT DETECTION AND RESPONSE TOOLS 24. Anomalous activities detection and criteria 1. General elements of ICT security 11. Data and system secur
Slide 21: Structure of Draft RTS 1 & 2 (ICT RMF) – List of Articles: Title II - Simplified
Structure of Draft RTS 1 & 2 (ICT RMF) – List of Articles: Title II - Simplified Chapter I. SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK Chapter IV. REPORT ON THE REVIEW OF THE ICT RMF 30. Governance and organisation 33. ICT risk management 43. Format and content 31. Information security policy and 34.
Slide 22: Structure of Draft RTS 3 (Criteria for Classification of Incidents) – List of Articles
Structure of Draft RTS 3 (Criteria for Classification of Incidents) – List of Articles Section II. MAJOR INCIDENTS AND THEIR MATERIALITY THRESHOLDS Section I. CLASSIFICATION CRITERIA AND SIGNIFICANT CYBER THREATS 1. Classification criterion ‘Clients, financial counterparts and transactions’ in accor
Slide 23: Structure of Draft RTS 4 (Policy on Services by ICT TPPs) – List of Articles
Structure of Draft RTS 4 (Policy on Services by ICT TPPs) – List of Articles Main Articles 1. Complexity and risk considerations 2. Group application 3. Governance arrangements regarding the policy on the use of ICT services supporting critical or important functions 4. ICT third-party service provi
Slide 24: Structure of Draft ITS (Register of Information Templates) – List of Articles
Structure of Draft ITS (Register of Information Templates) – List of Articles Chapter I. SUBJECT MATTER AND DEFINITIONS Chapter IV. AVAILABILITY OF THE REGISTER OF INFORMATION 1. Subject matter 9. Access of the competent authorities to the Registers of Information 2. Definitions Chapter V. FINAL PRO
Slide 25: Slide 25