itSMF Switzerland - Blog #business continuity

ICT resources in the Italian finance industry: the requirements set by Bank of Italy circular 285 (GRC approach and main related standards)

Wed, 25 Oct 2023 07:30:00 +0200

Reading time: ~ 5 min.

ICT resources in the Italian finance industry: the requirements set by Bank of Italy circular 285

In its Circular 285, Bank of Italy – the Italian central bank, member of the European System of Central Banks – defined the requirements for ICT resources in the finance industry, in regard to the companies that are subject to supervision.

In this 42th update to the original text of the Circular 285 released by the Italian central bank, we're going to dig deeper on the Title IV «corporate governance, internal controls and risk management» to figure out how to be compliant with a GRC approach (and the related ISO standards).

The circular 285 by Bank of Italy: focus on the 4th title

First of all, let's consider that these are the most relevant requirements which are applicable to ICT resources for all those finance industry companies under supervision according to the Circular 285 (chapter fourth):

Circular 285, Chapter 4: «Information systems»

✅ section I – general provisions

✅ section II – governance, organization and controls of the information system

✅ section III – ICT and security risk management

✅ section IV – the management of information security and ict operations

✅ section IV bis – the management of ict projects and changes

✅ section V – the data management system

✅ section VI – the outsourcing of the information system and the use of third parties for the provision of ICT services

✅ section VII – specific provisions on the «provision of payment services»

✅ annex A – corporate documents for the management and control of the information system.

In addition to all these requirements, according to our GRC approach we can focus on the Chapter V about business continuity too.

Circular 285, Chapter 5: «Business continuity»

In this case, we have to consider these requirements set by Bank of Italy:

✅ Annex A - business continuity requirements.

It is possible to manage the compliance to the Circular 285 requirements applicable to ICT resources with a modern approach?

GRC Approach (and related ISO standards) for the compliance to the Bank of Italy Circular 285 about requirements on ICT resources

Our answer is to manage the compliance according to a GRC approach that put together (combined management) the requirements applicable to ICT resources:

Information security
Business continuity
IT services.

We can match now for all these requirements the related ISO standards:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview about the BANK OF ITALYrequirements on ICT resources set by the Circular 285 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel too!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

The integrated ICT GRC in Swiss and Italian financial services industry

Wed, 19 Oct 2022 09:24:34 +0200

Reading time: ~ 3 min.

The ICT GRC requirements in financial services industry in Switzerland and Italy

If we take a closer look to the Italian and Swiss financial services industry, we can easily note that Bank of Italy (with its 285 Circular letter) and FINMA (with its 21/2008 Guidance, at the moment under reform) set the GRC requirements of the ICT systems of the banking and financial services companies.

How can we setup a hassle-free compliance according to the GRC requirements set by the two supervisory authorities? What kind of approach can help us to make sure to be compliant with all the rules?

The answer is an integrated management of Bankitalia and FINMA requirements applicable to ICT services in the financial and banking industries according to the GRC approach and ISO standards. Check it out our advice on the paragraph below.

The integrated management of ICT GRC requirements in Italy and Switzerland

The proposal of adopting a common GRC approach (Governance, Risk Management and Compliance) is the key to support in the best way the integrated management of the (complex) requirements set on the two different countries by their own authorities.

If you take a look at our infographic, you can figure out how the two jurisdictions have a set of rules on ICT systems of the companies on the banking and financial services industry:

corporate governance;
quality requirements;
IT infrastructure;
business continuity;
data protection.

The GRC of ICT requirements on financial services industries according to the relevant ISO guidelines

The common GRC approach for managing the requirements applicable on ICT systems of financial and banking services can usefully refer to the guidelines of the relevant ISO standards for this industry.

We can take advantage in particular of these ISO standards:

ISO 38500 for the ICT Governance;
ISO 31000 for the Risk Management;
ISO 37301 for the Compliance Management.

You can probably be wondering about which are the benefits on adopting this GRC approach strategy for your organization.

You should keep in mind, for example, that the both of the jurisdictions set compliance requirements on information security: you could easily manage them according to the ISO 27001 standard, without the need to set up two different models.

Another interesting solution to to be compliant with the IT services management requirements - another common point between Italy and Switzerland financial industry guidance set by the authorities - is to implement the ISO 20000-1 standard.

The last example that can help us to figure out how to make sure to be compliant with business continuity requirements set by Bank of Italy and FINMA is to adopt the ISO 22301 standard.

The integrated GRC management approach: the benefits for data protection and digital innovation

If you have taken a closer look at our infographic, you should notice that there is a focus on data protection requirements set by the two different jurisdictions.

Please remember that GDPR entered into force in 2016 (application since 2018). In Switzerland, the new FADP - this act has some differences and similarities with the European General Data Protection Regulation - will enter into force in September 2023.

Also in this case, the adoption of a common GRC approach allows us to support an integrated management solution to provide the required data protection standards set by the GDPR (in the EU context Italy belongs to) and the FADP - known also as LPD and DSG - in Switzerland.

Finally our GRC approach strategy can be the best way to support the systematic management of digital innovation implementing the ISO 56002 standard, the best choice to fix a common a relevant issue in the fintech industry.

We will come back for sure to this topic in the next posts. If you don't want to miss our latest updates, subscribe to our newsletter or follow us on our social media channels.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

SIEM, siete sicuri che sia davvero superfluo?

Wed, 10 Apr 2019 07:58:19 +0200

Reading time: ~ 3 min.

SIEM: un focus sulla sua utilità nel comparto IT

Nella bibliografia digitale SIEM ha un duplice significato: “Security Information and Event Management” se applicato in un ambito legato prettamente alla sicurezza e “Security Incident and Event Management” in ambito più di IT Governance ed IT Service Management ma ad ogni modo i due ambiti sono correlati tra di loro.

Da un punto di vista IT Service Management

Genericamente un “incidente” è un qualunque evento che conduce ad una interruzione non pianificata del servizio: il processo di Incident Management di ITIL p.e. ha come obiettivo primario quello di ristabilire la piena funzionalità del servizio il prima possibile per ridurre al minimo gli impatti sul business.

Un “problema” è la causa che genera l’Incidente: il processo di Problem Management ha come obiettivo, una volta ristabilita la funzionalità del servizio, di indagare per determinare la causa principale che ha causato l’incidente al fine di evitare il riproporsi di incidenti simili.

ITIL suggerisce di trattare gli incidenti di sicurezza con una particolare categorizzazione ed un separato flusso di lavoro con annessi specifici processi e procedure, sebbene come “migliore pratica” di base ogni incidente andrebbe opportunamente:

✔️identificato e registrato

✔️correttamente descritto ed associato ad un preciso cespite

✔️categorizzato (per tipologia di richiesta)

✔️prioritizzato (generalmente in funzione dell’impatto e degli SLA)

✔️preso in carico dall’operatore nella diagnosi ed investigazione della problematica

✔️se il caso scalato agli specialisti tecnici

✔️risolto e documentato

✔️chiuso dal Service Desk o centro operativo

Mentre un Incidente spesso viene gestito in modo reattivo, tanto più un Problema può essere trattato in modo proattivo quanto più dovrebbe essere alimentato da un sistema di Event Management che colleziona ed analizza in tempo reale gli eventi associati ai vari sistemi e dispositivi e propone degli avvisi agli operatori quando i valori di misurazione si avvicinano alle opportune soglie di preallarme.

Sempre maggiori sistemi e dispositivi di sicurezza ed infrastrutturali si standardizzano a dialogare efficacemente con le architetture di gestione degli eventi.

Da un punto di vista di Cyber Security Management

La sicurezza ha assunto un ruolo centrale da diverso tempo. Firewalls, IDS, IPS e affini sono un "must" in ogni rete. Questi dispositivi si dimostrano utili durante un attacco (prevenzione o blocco).Nella maggior parte dei casi però, queste tecnologie non dialogano tra di loro, inoltre non sempre è facile creare regole ad-hoc e adatte ad ogni situazione.

A tutto questo va aggiunto lo sforzo necessario nella gestione degli eventi, spesso manca il tempo, la competenza o entrambe le cose. La correlazione degli eventi permette di anticipare attacchi di diverso genere nel futuro. Questa tecnica risulta molto complessa e dispendiosa se eseguita manualmente o comunque non con sistemi automatici. L'essere "agile" comprende anche la rapidità nel prevenire (e non solo combattere) le minacce.

Un sistema SIEM permette proprio questo: correlare gli eventi tra loro, fornire risultati sul comportamento (behaviour analytic) e dimostrare i progressi ottenuti tramite l'implementazione di nuove regole, sistemi o tecnologie. Il SIEM va visto un po' come il centro dell'ecosistema nell'ambito IT, è infatti l'unico prodotto in grado di leggere le informazioni raccolte dai vari sistemi e di produrre dei risultati tecnici per il reparto IT, ma anche report definiti "C-Level" per il management. La possibilità di creare dei casi su misura, rende infine questo prodotto estremamente versatile.

Do you SIEM or not?

Ignorare l'utilità di un sistema SIEM, equivale a ignorare un livello di sicurezza meno visibile ma estremamente efficace.

Oggigiorno lo scenario di mercato mostra le grandi aziende sempre più attive nel segmento SIEM per la crescente necessità di dotarsi di misure di sicurezza con maggior efficienza ed efficacia possibile, tendono quindi per questo a strutturare dalla base il loro concetto di sicurezza in modo imprescindibile rispetto ai sistemi SIEM, ma le PMI dove si situano rispetto al loro concetto di sicurezza e quale fetta di budget annuale tendono a destinare dunque in questo ambito? Le PMI si sentono ancora sicure di ritenere questo strato di “intelligence” ed “analytics” superfluo rispetto ai sistemi tradizionali attivi e passivi per proteggersi efficacemente contro le minacce di sicurezza?

Abbiamo deciso di lanciare un sondaggio su questo tema importante per preparare al meglio, per tempo, il nostro prossimo evento dopo la pausa estiva e permetterci di raccogliere informazioni importanti per poter dare risposte giuste ed utili agli interessati. Grazie del vostro prezioso contributo.

Autore: Andrea Cherubini, presidente itSMF

>> Compila il questionario <<

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program