Cyber-Security Management

Risk Assessment

Firms need to assess, and periodically reassess, the cyber-security threat to their firms. Each cyber-security threat needs to be evaluated and the firm should ensure that there are safeguards in place, and operational, to protect the firm.

Management/Planning/Resourcing

Each firm must nominate a cyber-security officer who will have a cyber-security plan, including resourcing, which needs to be approved by Senior Management.

Monitoring & Testing

Cyber-security needs to be monitored real-time and all threats, even if unsuccessful, have to be logged. Where material threats are identified then these need to be alerted to relevant personnel and escalated based on materiality.
Firms need to periodically test their cyber-security controls to ensure they are operating as specified.

Vendors & Outsource Service Providers

Firms have to ensure that all vendors and outsource service providers are included in the firm's cyber-security risk assessment.
Cyber-security testing should include vendor systems and outsource service providers.