The Bank Negara Malaysia (BNM) is seeking feedback, until July 15, 2022, on the guideline to assess common key risks and considerations of control measures when financial institutions adopting cloud services. The proposed guideline will be applicable to Islamic as well as non-Islamic banks and insurers, operators of a designated payment system, and across various cloud service models, among others.
The proposed guideline, which complements the Risk Management in Technology (RMiT) policy document to strengthen cloud risk management capabilities of financial institutions, consists of two parts:
- Cloud Governance, which describes the considerations governing the cloud usage policy and technology skills capacity to implement cloud services securely and effectively. This part covers areas related to cloud risk management, cloud usage policy, due diligence, access to third-party certifications, contract management, and oversight over cloud service providers and skilled persons with knowledge on cloud services.
- Cloud Design and Control, which describes the considerations related to designing robust cloud infrastructure and in operationalizing the cloud environment. This part covers aspects on cloud architecture, cloud application delivery model, high velocity software development, cloud backup and recovery, business continuity management, cryptographic key management, user access management, data protection, and cyber-security management.
With a heightened focus on the aforementioned areas, the proposed guideline states that the financial institutions should:
- develop and implement a cloud risk management framework, for the Board’s approval, proportionate to the materiality of cloud adoption in its business strategy, to assist in the identification, monitoring and mitigating of risks arising from cloud adoption.
- regularly review and update the cloud usage policy at least once every three years.
- review their cloud service providers’ certifications prior to cloud adoption.
- set out clearly and where relevant, measurable, contractually agreed terms and parameters on the information security and operational standards expected of the cloud service provider.
- ensure effective oversight over cloud service providers and the cloud service providers’ sub-contractor(s).
- design a robust cloud architecture and ensure such design is in accordance with the relevant international standards for the intended application.
- review its risk management policies and practices to ensure effective oversight over the cloud application delivery model.
- ensure its existing change management process is extended to cover cloud services to promote effective and secure system development.
- ensure existing backup and recovery procedures are extended to cover cloud services.
- establish a robust cloud exit strategy as part of its cloud risk management framework to prepare for extreme adverse events such as the unplanned failure or termination of cloud service providers.
- implement appropriate and relevant encryption techniques to protect the confidentiality and integrity of sensitive data stored on the cloud.
- ensure the governance and management of cybersecurity operations is extended to cover cloud services, with appropriate control measures to prevent, detect and respond to cyber incidents in the cloud environment to maintain the overall security posture of the institution.
- ensure the data loss prevention strategy and processes are extended to protect data hosted in cloud services.
- enhance existing cyber crisis management policies and procedures to remain in a state of readiness to respond to cyber threats in a cloud environment.
Keywords: Asia Pacific, Malaysia, Banking, Cloud Service Providers, Operational Risk, Cyber Risk, Insurance, Regtech, Cloud Computing, BNM
Previous ArticleEBA Guide to Monitor Threshold for Intermediate Parent Undertakings
The Australian Prudential Regulation Authority (APRA) has published the findings of its latest climate risk self-assessment survey conducted across the banking, insurance, and superannuation industries.
The French Prudential Supervisory Authority (ACPR) published a notice related to the methods for calculating and publishing prudential ratios under the Capital Requirements Directive (CRD IV) and the minimum requirement for own funds and eligible liabilities (MREL).
The Financial Stability Institute (FSI) of the Bank for International Settlements recently published a paper proposing a framework for classifying financial stability regulation as either entity-based or activity-based.
The European Insurance and Occupational Pension Authority (EIOPA) published the risk dashboard based on Solvency II data and the final version of the application guidance on climate change materiality assessments and climate change scenarios in the Own Risk and Solvency Assessment (ORSA).
The European Banking Authority (EBA) and the European Central Bank (ECB) published their responses to the consultations of the International Sustainability Standards Board (ISSB) and the European Financial Reporting Advisory Group (EFRAG) on sustainability-related disclosure standards.
A Consultative Group on Risk Management (CGRM) at the Bank for International Settlements (BIS) published a report that examines incorporation of climate risks into the international reserve management framework.
The European Banking Authority (EBA) published the final guidelines on liquidity requirements exemption for investment firms, updated version of its 5.2 filing rules document for supervisory reporting, and Single Rulebook Question and Answer (Q&A) updates in July 2022.
The European Insurance and Occupational Pensions Authority (EIOPA) published Version 2.8.0 of the Solvency II data point model (DPM) and XBRL taxonomy.
The European Union published, in the Official Journal of the European Union, an opinion from the European Economic and Social Committee (EESC); the opinion is on the proposal for a regulation to amend the Capital Requirements Regulation (CRR).
HM Treasury published a draft statutory instrument titled “The Financial Services (Miscellaneous Amendments) (EU Exit) Regulations 2022,” along with the related explanatory memorandum and impact assessment.