Click on the tag to access description and wallix recommendations.
Article 5
Governance and organisation
Article 5.1 - Governance and organisation
1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience.
Wallix recommendation
PAM can play a significant role in supporting an effective ICT risk management framework as required by Article 5(1). * Centralized Management: PAM centralizes the management of privileged accounts and access rights, allowing for easier identification, assessment, and mitigation of risks associated with these accounts. * Reduced Attack Surface: By restricting privileged access and enforcing least privilege principles, PAM reduces the potential impact of compromised privileged credentials. * Improved Monitoring and Logging: PAM solutions typically provide comprehensive logging of privileged user activity, which can be used for monitoring suspicious behavior and detecting potential threats. * Enhanced Accountability: PAM establishes a clear audit trail for privileged access, enabling better accountability and facilitating incident investigations.
Articles 5.1, 5.2
More details ?
Article 6
ICT risk management framework
Article 6 - ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.
Wallix recommendation
* Sound, Comprehensive, and Documented Framework:
• PASM supports a comprehensive approach by focusing on privileged access, a frequent target for attackers and a major ICT risk.
• PASM documentation details access controls and security measures, contributing to a well-documented framework.
Articles 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7, 6.8
More details ?
Article 7
ICT systems, protocols
and tools
Article 7 - ICT systems, protocols and tools
Description: In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools.
Wallix recommendation
Contact us to know more…
Article 7
More details ?
Article 8
Identification
Article 8 - Identification
1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.
Wallix recommendation
* Privileged accounts and their roles: PAM helps create a central repository of privileged accounts, aiding in documentation.
* Systems and data accessed by privileged users: This information can be used to identify information assets and ICT assets requiring access control.
Articles 8.1, 8.2, 8.3, 8.4
More details ?
Article 9
Protection and Prevention
Article 9 - Protection and Prevention
1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.
Wallix recommendation
Contact us to know more…
Articles 9.1, 9.2, 9.3, 9.4
More details ?
Article 10
Detection
Article 10 - Detection
1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.
Wallix recommendation
Contact us to know more…
Articles 10.1, 10.2, 10.3
More details ?
Article 11
Response and recovery
Article 11 - Response and recovery
1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.
Wallix recommendation
Contact us to know more…
Articles 11.1, 11.2
More details ?
Article 13
Learning and Evolving
Article 13 - Learning and Evolving
1. Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.
Wallix recommendation
Contact us to know more…
Articles 13.1, 13.2, 13,7
More details ?
Article 7
Further harmonisation
of ICT risk management tools, methods, processes and policies
Article 15 - Further harmonisation of ICT risk management tools, methods, processes and policies
The ESAs shall, through the Joint Committee, in consultation with the European Union Agency on Cybersecurity (ENISA), develop common draft regulatory technical standards.
Wallix recommendation
Contact us to know more…
Article 15
More details ?
You want more WALLIX Recommandations about DORA? Contact-us !
FOLLOW US
