itSMF Switzerland - Blog #riskmanagement

The internal investigations of organizations according to the ISO 37008 standard

Wed, 03 Sep 2025 07:00:00 +0200

Reading time: ~ 3 min.

The management of internal investigations of organizations according to the ISO/TS 37008 standard

For internal investigation we understand the professional fact-finding process lead by (or for, if this process leading is transfered outside) an organization to establish facts in relation to supposed or suspicious wrongdoing, misconduct or noncompliance.

The internal investigation in indeed an integral part of organizational management and the standard ISO/TS 37008:2023 on «Internal investigations of organizations – Guidance» provides support for its implementation.

The internal investigation of organizations can examine cases such as bribery, fraudulent activities, harassment, violence or discrimination (just to mention some typical situations we can apply the standard to manage the process of fact-finding).

We can have different reasons why we need to lead an internal investigation, such as:

civil actions (liability, responsibility,...);
whistleblowing reports (discern between substantiated or unsubstantiated allegation);
external investigations led by regulators (need for reporting);
decision-making process (requirements set by laws, regulations, codes, policies,...).

We have to keep in mind that internal investigation is part of a compliance management system of an organization.

The ISO/TS 37008 standard structure

The ISO/TS 37008 standard has 11 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions

Chapter 4: Principles

4.1 Independent
4.2 Confidential
4.3 Competent and professional
4.4 Objective and impartial
4.5 Legal and lawful

Chapter 5: Support of internal investigations

5.1 Resources
5.2 Leadership and commitment

Chapter 6: Establishment of investigation policy or procedure
Chapter 7: Safety and protection measures

7.1 Preserving and securing evidence
7.2 Protection of and support to personnel involved in investigations
7.3 Anti-retaliation
7.4 Safeguarding

Chapter 8: Investigative process

8.1 Investigation team
8.2 Preliminary assessment
8.3 Determining the scope of the investigation
8.4 Investigation planning
8.5 Maintaining confidentiality
8.6 Liability caution to deter disclosure
8.7 No interference
8.8 Evidence
8.9 Interviews
8.10 Finalization process
8.11 Investigation report

Chapter 9: Potential remedial measures or improvements

9.1 Proposal of remedial measures and improvements
9.2 Interim remedial measures
9.3 A final plan for post-investigation remedial measures
9.4 Proportionality of remediation and improvement measures
9.5 Monitoring and enforcement of remedial measures

Chapter 10: Interaction with stakeholders

10.1 General
10.2 Planning
10.3 Measures for the communication process
10.4 Effective communication channels
10.5 Government and regulator communication
10.6 Self-disclosure to the authorities

Chapter 11: Disciplinary actions

Annex A Guidance on the use of this document (10

ISO 37008 standard: correlations between other standards and regulations

The ISO/TS 37008 standard is logically downstream of whistleblowing reports (we can consider for example the Italian Legislative Decree 24/2023 on whistleblowing).

This standard is also useful in correlation with:

ISO 37002:2021«Whistleblowing management systems – Guidelines»;
ISO 37001:2016«Anti-bribery management systems standard».

ISO 37008 provides support also in the implementation of the organization and management models (OMM) set by the Italian Legislative Decree 231/01 (corporate criminal Liability).

Our infographic on ISO/TS 37008 standard

To better figure out the «big picture» about the ISO/TS 37008 standard, take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter: you will get a monthly update with the most relevant and valuable content from our experts!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

DORA Regulation and ISO Management Systems: a GRC approach

Wed, 06 Aug 2025 07:00:00 +0200

Reading time: ~ 2 min.

The Digital Operation Resilience Act (DORA) Regulation

The Regulation (EU) 2022/2554 of the European Parliament and the Council of 14 December 2022 on digital operational resilience for the financial sector entered into force on 16 January 2023 and it applies to EU financial service providers.

The Digital Operation Resilience Act (commonly known as DORA) amends all these regulations:

(EC) N. 1060/2009, commonly known as «Credit Rating Agencies»;
(EU) N. 648/2012, commonly known as «EMIR», OTC derivatives;
(EU) N. 600/2014, commonly known as «MIFIR», Markets in Financial Instruments;
(EU) N. 909/2014, commonly known as «CSDR»;
(EU) 2016/1011, commonly known as «Benchmark Regulation».

The requirements of digital resilience and security set by DORA

The Digital Operational Resilience Act (DORA) defines a set of requirements to ensure both digital resilience and security especially in the following chapters:

📘 I. General Provisions
📘 II. ICT Risk Management
📘 III. ICT Related Incident Management Process
📘 IV. Digital operational resilience test
📘 V. Managing of ICT third party risk
📘 VI. Information sharing arrengement

To manage these requirements, we can adopt – as usual – our GRC approach. These are the relevant ISO standards we can rely on:

ISO 38500 (Governance)
ISO 31000 (Risk Management)
ISO 37301 (Compliance)

The GRC approach provides a useful basis for addressing and integrating the main aspects of:

ISO 22301 (Resilience and business continuity)
ISO 27001 (Information security)
ISO 20000-1 (ICT services; such as: asset and configuration, management, threats and vulnerabilities)
ISO 27035 (incident and problem management)
backup and disaster recovery, etc.

Our infographic on the applicable ISO standards

To better figure out the «big picture» about the DORA regulation and the ISO Management Systems according to the suggested GRC approach, take a look at this infographic:

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The AI risk management according to the ISO/IEC 23894 standard

Wed, 25 Jun 2025 07:00:00 +0200

Reading time: ~ 3 min.

ISO/IEC 23894 standard: the risk management of artificial intelligence (AI)

The ISO/IEC 23894:2023 standard on «Information technology — Artificial intelligence — Guidance on risk management» provides an effective guidance for risk management related to Artificial Intelligence (AI) for all kind of organizations that:

develop
produce
deploy
use

AI-based products, systems or even services.

This standard is useful also to help organizations to integrate risk management into their AI-related activities and functions. It provides a description of the processes needed for the effective implementation and integration of AI risk management.

The ISO/IEC 23894:2023 standard structure

The ISO/IEC 23894:2023 standard has 6 main chapters and 3 «ANNEX» (A, B and C). This is an overview on its structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions

Chapter 4: principles of AI risk management
Chapter 5: framework

5.1 General
5.2 Leadership
5.3 Integration
5.4 Design
5.5 Implementation
5.6 Evaluation
5.7 Improvement

Chapter 6: Risk management process

6.1 General
6.2 Communication and consultation
6.3 Scope, context and criteria
6.4 Risk assessment
6.5 Risk treatment
6.6 Monitoring and review
6.7 Recording and reporting

Annex A (information) common AI-related objectives
Annex B (information) common AI-related risk sources
Annex C (information) Risk management and AI System life cycle; it provides an example mapping between the risk management processes and an AI system life cycle.

Our infographic on ISO/IEC 23894:2023 standard

To better figure out the «big picture» on the ISO 23894 standard, take a look at our infographic:

The ISO 23894 standard and the main references

The ISO 23894 standard is not only referred to by ISO 31000:2018. We find references to this guidance also on ISO 42001 standard on «Management Systems for Artificial Intelligence»

If we take a look at the EU Regulation 2024/1689 (known as «EU Artificial Intelligence Act) we find some correlations between it and the ISO 23894 standard.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Resilience and crisis management according to the ISO 22361 standard

Wed, 04 Jun 2025 12:13:52 +0200

Reading time: ~ 3 min.

ISO 22361 standard: the resilience and crisis management

The ISO 22361:2022 standard on «Security and resilience – Crisis management – Guidelines» provides an effective guidance for every kind of organizations aside from their type, size or industry to improve their crisis management capability.

This document is useful not only to plan, but also to set, keep up-to-date and enhance the strategic crisis management ability in every organization. It helps also to improve the capability to identify and manage crisis.

The ISO 22361 standard is relevant for the top management (strategic responsabilities) and useful for everyone who operates under the direction of top management. The guidance has several relationships and interdepencies with other topics.

In particular, the application of ISO 22361 can be suggested by ISO 22301:2019 standard on «Security and resilience – Business continuity management systems requirements».

This document defines the requirements for a business continuity management system, remembering that crisis management is very important.

The ISO 22361:2022 standard structure

The ISO 22361:2022 helps to design and develop the crisis management capability in organizations, setting out the principles and practises needed.

Organizations have to provide committed leadership, structures, supportive culture and competent personnel to enhance their crisis management capability. To make effective their approach to crisis management, organizations should apply a set of principles that determine the development of a crisis management framework.

The standard outlines them into the following main clauses:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions
Chapter 4: crisis management – context, core concepts, principles
Chapter 5: building a crisis management capabilities (with crisis management framework and crisis management process focus)
Chapter 6: crisis leadership
Chapter 7: strategic crisis decision making (challenges and complexities)
Chapter 8: crisis communication (guidelines from strategy, management of relationships and reputation, consistency of message, …)
Chapter 9: training, validation and learning from crises.

Our infographic on ISO 22361:2022 standard

To better figure out the «big picture» on ISO 22361 standard, take a look at our infographic:

ISO 22361 standard and its main references

The ISO 22361 standard not only provides an effective guidance on «Security and resilience – Crisis management»: it can be used to in the context of management systems for information security (ISO 27001 standard) and for IT services (ISO 20000-1 standard).

If we extend our point of view on ISO 22361 to other regulations, we find many references in the following:

📘 European Directive NIS 2 cybersecurity
📘 European DORA regulation (Digital Operational Resilience Act) for the finance sector
📘 Bank of Italy Circular 285 for resilience requirements
📘 Circular 01/2023 from FINMA (Switzerland) for resilience requirements

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The information security risk management according to the ISO 27005 standard

Tue, 15 Apr 2025 09:43:13 +0200

Reading time: ~ 2 min.

ISO 27005 standard: the risk management of the information security

The ISO/IEC 27005:2022 standard on «Information security, cybersecurity and privacy protection — Guidance on managing information security risks» provides a useful guidance for all kind of organizations (no matter which type, size or industry).

ISO 27005 is useful for all the organizations that have already adopted an Information Security Management System according to the ISO 27001 standard to evaluate (assessment) and treat the information security risks.

If you want to have an overview on ISO/IEC 27001 Information Security Management System, check out our previous post. in the next lines, we're going to have a look at the 27005 standard structure.

The ISO/IEC 27005 standard structure

The ISO/IEC 27005 standard has 10 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions; with focus on:

3.1 «terms related to information security risk»
3.2 «terms related to information security risk management».

Chapter 4: structure of the document
Chapter 5: information security risk management; with focus on:

5.1 «information security risk management process»
5.2 «information security risk management cycles»

Chapter 6: Context establishment; with focus on:

6.1 Organizational considerations
6.2 Identifying basi requirements of interested parties
6.3 applying risk assessment
6.4 establishing and maintaining information security risk criteria

6.4.1 general
6.4.2 risk acceptance criteria
6.4.3 criteria for performing information security risk assessments

6.5 choosing an appropriate method

Chapter 7 Information security risk assessment process

7.1 general
7.2 identifying information security risks

7.2.1 identifying and describing information security risks
7.2.2 identifying risk owners

7.3 analysing information security risks

7.3.1 general
7.3.2 assessing potential consequences
7.3.3 assessing likelihood
7.3.4 determining the levels of risk

7.4 evaluating the information security risks

7.4.1 Comparing the results of risk analysis with the risk criteria
7.4.2 Prioritizing the analysed risks for risk treatment

Chapter 8 Information security risk treatment process

8.1 general
8.2 selecting appropriate information security risk treatment option
8.3 determining all controls that are necessary to implement the information security
risk treatment options
8.4 comparing the controls determined with those in ISO/IEC 27001:2022, Annex A
8.5 producing a statement of applicability
8.6 information security risk treatment plan

8.6.1 formulation of the risk treatment plan
8.6.2 approval by risk owners
8.6.3 acceptance of the residual information security risks

Chapter 9 Operation

9.1. performing information security risk assessment process
9.2 performing information security risk treatment process

Chapter 10 leveraging related ISMS processes

10.1 context of the organization
10.2 leadership and commitment
10.3 communication and consultation
10.4 documented information

10.4.1 general
10.4.2 documented information about processes
10.4.3 documented inforrmation about results

10.5 monitoring and review

10.5.1 general
10.5.2 monitoring and reviewing factors influencing risks

10.6 management review
10.7 corrective action
10.8 continual improvement

Annex A Examples of techniques in support of the risk assessment process

Our infographic on ISO/IEC 27005:2022 standard

To better figure out the «big picture» about the ISO 27005 standard, take a look at our infographic:

The ISO 27005:2022 is indeed a useful supplementation of the ISO 31000:2018 standard on «risk management – guidelines», as it applies the guidance provided by the second one to the specific topic of the information security risks.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The management systems for artificial intelligence ISO 42001:2023 and risk treatment according the Annex A

Wed, 19 Mar 2025 07:00:00 +0100

Reading time: ~ 2 min.

The management systems for AI and risk treatment: the ISO 42001 standard

In our previous post, we took a look at the ISO 42001:2023 standard focusing on the tools that organizations can use to implement security, protection, equity, transparency and data quality for AI based products or services.

Today we're going to consider in particular the «Annex A» of the latest version of the ISO standard on management systems for AI: the document reports a series of control objectives and operational controls that as an organization we can apply to address risks.

The ISO 42001 standard and the Annex A: control objectives and operational controls

On the ISO/IEC 42001:2023 standard «ANNEX A» we have a series of controls objectives and operational controls useful to support an organization that needs to manage and mitigate AI systems related risks (risk treatment and management).

This is the structure of the Annex A:

A.2 «Policies related to AI»
A.3 «Internal Organization»
A.4 «Resources for AI Systems»
A.5 «Assessing Impact of AI Systems»
A.6 «AI System Life Cycle»
A.7 «Data for AI System»
A.8 «Information for parties interested in AI systems»
A.9 «Use of AI systems»
A.10 «Third parties and customer relationships».

In the nex lines, let's have a quick overview on the controls, one by one.

Annex A, Control A.2 «Policies related to AI»

According to the ISO 42001 standard control A.2, the policy for AI systems development and use is the pillar on the approach that an organization can adopt for AI governance.

Annex A, Control A.3 «Internal organization»

The control A.3 is focused on the requirement for an organization to define and allocate teams or professionals (role and responsability) in charge of the oversight of every aspects of AI system management.

Annex A, Control A.4 «Resources for AI systems»

The control A.4 sets the need to identify and document every AI system essential resource, such as data, tools, computing resources and team expertise.

Annex A, Control A.5 «Assessing impact of AI systems»

The control A.5 is focused on the need to identify, analyse, evalute and treat the AI system impacts on individuals and the society, adopting a well structured approach for the assessment.

Annex A, Control A.6 «AI system Life Cycle»

According to the Annex A control A.6, the every stage of AI system life cycle has to be managed through an approach (framework) that helps to ensure responsability and effectiveness on design, implementation and use of AI system.

Annex A, Control A.7 «Data for AI sytem»

The data quality and the source it comes from are very relevant for AI system: every organization has to manage carefully the definition and documentationabout requirements and standards.

Annex A, Control A.8 «Information for parts interested in AI systems»

According to the Annex A control A.8, organizations have to determine and share AI systems essential informations (purpose, instructions, limitations, capabilities,...) to users and other stakeholders.

Annex A, Control A.9 «Use of AI systems»

The Annex A control A.9 requires to define and document the process for the AI systems responsible use, in particular according to ethics, legal requirements and policies of the organization.

Annex A, Control A.10 «Thir parties and customer relationships»

According to the Annex A control A.10, organizations have to delineate internal and external responsabilities on AI systems, in particular among partners, suppliers and other third parties.

The correlations between ISO 42001 Annex A and other standards

We should remember that the the ISO 42001:2023 Annex A has relevant correlations with other standards, in particular the following ones:

ISO 27001 Information Security (Appendix A Operational Controls);
IT Services ISO 20000-1

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Artificial Intelligence (AI) and risk management with the ISO 23894 standard

Wed, 06 Dec 2023 07:00:00 +0100

Reading time: ~ 2 min.

Artificial Intelligence (AI) and risk management with the help of ISO 23894 standard

Artificial Intelligence is indeed one of the most relevant technological topic for companies and people, gaining more and more weight in our daily activities: but AI brings to the table also concerns about an effective risk management approach of AI systems.

We have to notice that the development and use of AI systems is indeed increasingly widespread and they affect many industries as well as very different types of data (in particular, personal data) we have to manage minimizing all the related risks.

So when it comes to find out a well structured risk management approach on systems, products and services with AI-related risks we can rely on the ISO/IEC 23894:2023 standard: let's focus together on this document in the next lines.

The ISO/IEC 23894 standard for AI Systems using ML

The «ISO/IEC 23894:2023 Information Technology Artificial Intelligence» (last update of the standard) is meant to be a guidance on risk management to all the organizations that develop or use intelligence-based products, systems and services to manage properly AI-related risks.

In this new version of the ISO 23894 standard (published on February 2023) we can find a guidance also to assist organizations on integration of risk management into their AI-related activities and functions.

We have to bear in mind that the guidance provides also a description of the expected processes to for the efficient implementation and integration of the Artificial Intelligence (AI) risk management.

The ISO/IEC 23894 standard table of contents

In this updated version of the document (ISO 23894:2023), we find the following chapters:

✅ 4. Principles of AI Risk Management

✅ 5. Framework

✅ 6. Risk Management Process

✅ Annex A Objectives

✅ Annex B Risk sources

✅ Annex C Risk management and AI system life cycle

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We should finally remember that the ISO/IEC 23984:2023 standard recalls the well-known (and related) ISO 31000 standard which provides useful guidelines for risk management.

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our blog, social media channels and newsletter. Don't miss out our next updates on the brand new YouTube Channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

A framework for Artificial Intelligence (AI) using Machine Learning (ML): ISO 23053 standard

Wed, 22 Nov 2023 07:00:00 +0100

Reading time: ~ 2 min.

Artificial Intelligence (AI) and Machine Learning (ML)

Since the announce of ChatGPT, we all have heard a lot of news about Artificial Intelligence (AI) as one of the most relevant technological innovation: but we have to keep in mind that Machine Learning (ML) is probably the real turning point on this evolution.

The Artificial Intelligence (AI) systems that are based on Machine Learning (ML) are indeed more popular in a lot of industries and are changing our daily habits, in our offices as well as at home.

If we should find a definition for Machine Learning (ML), we could consider it as a branch of Artificial Intelligence that uses computational techniques to allow IT systems to learn from data or even experience.

To better figure out an AI ecosystem with all its components and their respective functions, we can take a look at the ISO/IEC 23053 standard.

The ISO/IEC 23053 standard for AI Systems using ML

On the ISO/IEC 23053 standard we find a « Framework for Artificial Intelligence (AI) systems using Machine Learning (ML)» that helps us to understand the role of every systems component.

The ISO standard indeed applicable to every kind of organization, despite the industry and the size. The ISO/IEC 23053 standard can be apply to private or public companies, government entities, no-profit organizations which are implementing or using Artificial Intelligence systems.

Machine Learning Systems – despite their application – can be developed through the fine-tuning of the algorithms to fit to training data, or improve their performance base through maximizing a reward.

Speaking of Machine Learning methods, we have to consider that these include deep learning, a topic which is also addressed in this ISO standard.

The ISO/IEC 23053 standard table of contents

In this updated version of the document (ISO 23053:2002), we find the following chapters:

✅ 5.Overview

✅ 6. Machine learning system

✅ 7. Machine learning approach

✅ 8. Machine learning pipeline

✅ Annex A Examples data flow and data use statements for supervised learning process

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our blog, social media channels and newsletter.
Don't miss out our next updates on the brand new YouTube Channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our Sponsors

A special thanks to our Advanced Sponsors:

ICT resources in the Italian finance industry: the requirements set by Bank of Italy circular 285 (GRC approach and main related standards)

Wed, 25 Oct 2023 07:30:00 +0200

Reading time: ~ 5 min.

ICT resources in the Italian finance industry: the requirements set by Bank of Italy circular 285

In its Circular 285, Bank of Italy – the Italian central bank, member of the European System of Central Banks – defined the requirements for ICT resources in the finance industry, in regard to the companies that are subject to supervision.

In this 42th update to the original text of the Circular 285 released by the Italian central bank, we're going to dig deeper on the Title IV «corporate governance, internal controls and risk management» to figure out how to be compliant with a GRC approach (and the related ISO standards).

The circular 285 by Bank of Italy: focus on the 4th title

First of all, let's consider that these are the most relevant requirements which are applicable to ICT resources for all those finance industry companies under supervision according to the Circular 285 (chapter fourth):

Circular 285, Chapter 4: «Information systems»

✅ section I – general provisions

✅ section II – governance, organization and controls of the information system

✅ section III – ICT and security risk management

✅ section IV – the management of information security and ict operations

✅ section IV bis – the management of ict projects and changes

✅ section V – the data management system

✅ section VI – the outsourcing of the information system and the use of third parties for the provision of ICT services

✅ section VII – specific provisions on the «provision of payment services»

✅ annex A – corporate documents for the management and control of the information system.

In addition to all these requirements, according to our GRC approach we can focus on the Chapter V about business continuity too.

Circular 285, Chapter 5: «Business continuity»

In this case, we have to consider these requirements set by Bank of Italy:

✅ Annex A - business continuity requirements.

It is possible to manage the compliance to the Circular 285 requirements applicable to ICT resources with a modern approach?

GRC Approach (and related ISO standards) for the compliance to the Bank of Italy Circular 285 about requirements on ICT resources

Our answer is to manage the compliance according to a GRC approach that put together (combined management) the requirements applicable to ICT resources:

Information security
Business continuity
IT services.

We can match now for all these requirements the related ISO standards:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview about the BANK OF ITALYrequirements on ICT resources set by the Circular 285 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel too!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

FINMA requirements for ICT resources in Swiss finance industry: GRC approach and main related standards

Wed, 20 Sep 2023 07:00:00 +0200

Reading time: ~ 4 min.

The ICT resources requirements for Swiss finance industry set by FINMA

As you probably already know, in Switzerland FINMA – Eidgenössische Finanzmarktaufsicht; autorité fédérale de surveillance des marchés financiers; autorità federale di vigilanza sui mercati finanziari – is the Financial Market Supervisory Authority.

This authority set indeed a lot of mandatory requirements for all the financial industry players and in particular today we're going to take a closer look at the FINMA Circular 2023/1.

The document has been issued in January 2023 by the authority and it is intended to substitute the previous one – the old Circular 08/21.

In the following lines, we're going to better figure out the main ICT resources requirements set by FINMA for the Swiss financial market that, we have to keep in mind that are subjected to supervision.

The Swiss finance industry ICT resources requirements set by FINMA 23/01 Circular

First of all, we would like to focus our examination on the «Chapter IV» of the aforementioned Circular 23/01 issued by FINMA, due to our GRC approach.

This fourth chapter of the document is indeed about the «Management of Operational Risks» and set in particular these six details:

✅ A. Transversal Management of Operational Risks

✅ B. ICT Risk Management

✅ C. Cyber Risk Management

✅ D. Risk management of critical data

✅ E. Business continuity management (BCM)

✅ F. Management of risks relating to the provision of cross-border services

We just did a brief examination of the Chapter 4 of the FINMA Circular 23/01, but we should keep in mind too that there are other regulations that the document set.

If we take the «Chapter V», we noticed that this one relates to the need of «Ensuring operational resilience».

At this point, we can just have a big question for our compliance strategy: how to can we systematically manage the requirements of the Circular 2023/01 applicabile to the ICT resources?

How to manage the ICT requirements for Swiss finance industry set by FINMA according to the more relevant ISO standards

It is probably correct to say that a modern GRC approach – base on the main ISO standards we can put in relation with the matter – can help us on supporting the integrated management of all the requirements applicable to ICT resources, which are:

Information security
Business continuity
IT services.

We should now figure out which ones are the ISO standards we can rely on to manage the requirements; and these are indeed:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview on the FINMA requirements on ICT resources set by the Circular 2023/1 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program