Featured Product

    BNM Proposes Guideline on Cloud Technology Risk Assessment

    June 03, 2022

    The Bank Negara Malaysia (BNM) is seeking feedback, until July 15, 2022, on the guideline to assess common key risks and considerations of control measures when financial institutions adopting cloud services. The proposed guideline will be applicable to Islamic as well as non-Islamic banks and insurers, operators of a designated payment system, and across various cloud service models, among others.

    The proposed guideline, which complements the Risk Management in Technology (RMiT) policy document to strengthen cloud risk management capabilities of financial institutions, consists of two parts:

    • Cloud Governance, which describes the considerations governing the cloud usage policy and technology skills capacity to implement cloud services securely and effectively. This part covers areas related to cloud risk management, cloud usage policy, due diligence, access to third-party certifications, contract management, and oversight over cloud service providers and skilled persons with knowledge on cloud services.
    • Cloud Design and Control, which describes the considerations related to designing robust cloud infrastructure and in operationalizing the cloud environment. This part covers aspects on cloud architecture, cloud application delivery model, high velocity software development, cloud backup and recovery, business continuity management, cryptographic key management, user access management, data protection, and cyber-security management.

    With a heightened focus on the aforementioned areas, the proposed guideline states that the financial institutions should:

    • develop and implement a cloud risk management framework, for the Board’s approval, proportionate to the materiality of cloud adoption in its business strategy, to assist in the identification, monitoring and mitigating of risks arising from cloud adoption.
    • regularly review and update the cloud usage policy at least once every three years.
    • review their cloud service providers’ certifications prior to cloud adoption.
    • set out clearly and where relevant, measurable, contractually agreed terms and parameters on the information security and operational standards expected of the cloud service provider.
    • ensure effective oversight over cloud service providers and the cloud service providers’ sub-contractor(s).
    • design a robust cloud architecture and ensure such design is in accordance with the relevant international standards for the intended application.
    • review its risk management policies and practices to ensure effective oversight over the cloud application delivery model.
    • ensure its existing change management process is extended to cover cloud services to promote effective and secure system development.
    • ensure existing backup and recovery procedures are extended to cover cloud services.
    • establish a robust cloud exit strategy as part of its cloud risk management framework to prepare for extreme adverse events such as the unplanned failure or termination of cloud service providers.
    • implement appropriate and relevant encryption techniques to protect the confidentiality and integrity of sensitive data stored on the cloud.
    • ensure the governance and management of cybersecurity operations is extended to cover cloud services, with appropriate control measures to prevent, detect and respond to cyber incidents in the cloud environment to maintain the overall security posture of the institution.
    • ensure the data loss prevention strategy and processes are extended to protect data hosted in cloud services.
    • enhance existing cyber crisis management policies and procedures to remain in a state of readiness to respond to cyber threats in a cloud environment.


    Related Links


    Keywords: Asia Pacific, Malaysia, Banking, Cloud Service Providers, Operational Risk, Cyber Risk, Insurance, Regtech, Cloud Computing, BNM

    Related Articles

    ESAs Issue Multiple Regulatory Updates for Financial Sector Entities

    The three European Supervisory Authorities (ESAs) issued a letter to inform about delay in the Sustainable Finance Disclosure Regulation (SFDR) mandate, along with a Call for Evidence on greenwashing practices.

    November 15, 2022 WebPage Regulatory News

    FSB and NGFS Publish Initial Findings from Climate Scenario Analyses

    The Financial Stability Board (FSB) and the Network for Greening the Financial System (NGFS) published a joint report that outlines the initial findings from climate scenario analyses undertaken by financial authorities to assess climate-related financial risks.

    November 15, 2022 WebPage Regulatory News

    FSB Issues Reports on NBFI and Liquidity in Government Bonds

    The Financial Stability Board (FSB) published a letter intended for the G20 leaders, highlighting the work that it will undertake under the Indian G20 Presidency in 2023 to strengthen resilience of the financial system.

    November 14, 2022 WebPage Regulatory News

    ISSB Makes Announcements at COP27; IASB to Propose IFRS 9 Amendments

    The International Sustainability Standards Board (ISSB) of the IFRS Foundations made several announcements at COP27 and with respect to its work on the sustainability standards.

    November 10, 2022 WebPage Regulatory News

    IOSCO Prioritizes Green Disclosures, Greenwashing, and Carbon Markets

    The International Organization for Securities Commissions (IOSCO), at COP27, outlined the regulatory priorities for sustainability disclosures, mitigation of greenwashing, and promotion of integrity in carbon markets.

    November 09, 2022 WebPage Regulatory News

    EBA Finalizes Methodology for Stress Tests, Issues Other Updates

    The European Banking Authority (EBA) issued a statement in the context of COP27, clarified the operationalization of intermediate EU parent undertakings (IPUs) of third-country groups

    November 09, 2022 WebPage Regulatory News

    EU Finalizes Rules Under Crowdfunding Service Providers Regulation

    The European Union has finalized and published, in the Official Journal of the European Union, a set of 13 Delegated and Implementing Regulations applicable to the European crowdfunding service providers.

    November 08, 2022 WebPage Regulatory News

    OSFI Sets Out Work Priorities and Reporting Updates for Banks

    The Office of the Superintendent of Financial Institutions (OSFI) published an annual report on its activities, a report on forward-looking work.

    November 07, 2022 WebPage Regulatory News

    APRA Finalizes Changes to Capital Framework, Issues Other Updates

    The Australian Prudential Regulation Authority (APRA) finalized amendments to the capital framework, announced a review of the prudential framework for groups.

    November 03, 2022 WebPage Regulatory News

    BIS Hub and Central Banks Conduct CBDC and DeFI Pilots

    The Bank for International Settlements (BIS) Innovation Hubs and several central banks are working together on various central bank digital currency (CBDC) pilots.

    November 03, 2022 WebPage Regulatory News
    RESULTS 1 - 10 OF 8596