SAMA Publishes Financial Entities Ethical Red Teaming Framework

By Regulatory News

June 07, 2019

SAMA published the Financial Entities Ethical Red Teaming Framework, in an effort to address the increasing cyber risks. The framework is intended as a guide to prepare and execute controlled cyber attacks against the production environment, without exposing sensitive information, with the help of certified and experienced Red Teaming Providers. The framework aims to share intelligence and information obtained during testing to further improve cyber resilience in the financial sector in Saudi Arabia. The framework applies to all member organizations in the financial sector regulated by SAMA.

The information to be provided by a third party seeking authorization to assess the compliance of securitizations with the STS criteria provided for in Securitization Regulation should enable a competent authority to evaluate whether and, to what extent, the applicant meets the conditions of Article 28(1) of the Securitization Regulation. An authorized third party will be able to provide STS assessment services across EU. The application for authorization should, therefore, comprehensively identify that third party, any group to which this third party belongs, and the scope of its activities. With regard to the STS assessment services to be provided, the application should include the envisaged scope of the services to be provided as well as their geographical scope, particularly the following:

To facilitate effective use of the authorization resources of a competent authority, each application for authorization should include a table clearly identifying each submitted document and its relevance to the conditions that must be met for authorization.
To enable the competent authority to assess whether the fees charged by the third party are non-discriminatory and are sufficient and appropriate to cover the costs for the provision of the STS assessment services, as required by Article 28(1)(a) of Securitization Regulation, the third party should provide comprehensive information on pricing policies, pricing criteria, fee structures, and fee schedules.
To enable the competent authority to assess whether the third party is able to ensure the integrity and independence of the STS assessment process, that third party should provide information on the structure of those internal controls. Furthermore, the third party should provide comprehensive information on the composition of the management body and on the qualifications and repute of each of its members.
To enable the competent authority to assess whether the third party has sufficient operational safeguards and internal processes to assess STS compliance, the third party should provide information on its procedures relating to the required qualification of its staff. The third party should also demonstrate that its STS assessment methodology is sensitive to the type of securitization and that specifies separate procedures and safeguards for asset-backed commercial paper (ABCP) transactions/programs and non-ABCP securitizations.

The use of outsourcing arrangements and a reliance on the use of external experts can raise concerns about the robustness of operational safeguards and internal processes. The application should, therefore, contain specific information about the nature and scope of any such outsourcing arrangements or use of external experts as well as the third party's governance over those arrangements. Regulation (EU) 2019/885 is based on the draft regulatory technical standards submitted by ESMA to EC.

Related Links

Effective Date: June 18, 2019

Press Release

Proposed Rule 1

Proposed Rule 2

Proposed Rule 3

Presentation on Regulatory Framework (PDF)

Presentation on Resolution Plan Rules (PDF)

The principal objective of the framework is to provide guidance on how to conduct the red teaming activities and how to test the detection and response capabilities of a member organization against real sophisticated and advanced attacks and enhance the knowledge of the involved stakeholders. The framework consists of four phases—preparation phase, scenario phase, execution phase, and lessons learned phase. Red Teaming should not be regarded as an audit but as a simulation test that seeks to provide insight into the level of resilience and effectiveness of the implemented cyber-security controls and relevant processes. Red Teaming is not a penetration test; rather, in contrast to a penetration test (in which one or more specific information assets are tested and assessed), it focuses on replicating a targeted and realistic attack against the entire member organization and is performed in a controlled manner.

SAMA has the authority to select any member organization to perform a red teaming exercise considering its criticality and the emerging threat landscape. In addition, a member organization can rightfully conduct red teaming exercise to ensure security resilience. However, as a minimum, domestic systemically important entities will be subject to testing once every three years, in line with this framework. SAMA will maintain the framework and conduct periodic reviews to determine its effectiveness, including the extent to which it addresses the emerging cyber-security threats and risks. If applicable, SAMA will update the framework based on the outcome of the review and lessons learned.

Related Links

Keywords: Middle East and Africa, Saudi Arabia, Banking, Red Teaming Framework, Cyber Risk, Cyber Testing, Operational Risk, Cyber Resilience, SAMA

ISDA Publishes Master Regulatory Disclosure Letter and Guidance Note

BIS Paper on Effect of Loan-Loss Provisions on Chilean Mortgage Market


News US Agencies Consult on Capital Treatment of Land Development Loans US Agencies (FDIC, FED, and OCC) issued a proposed rule on the treatment of loans that finance the development of land for purposes of the one- to four-family residential properties exclusion in the definition of high volatility commercial real estate (HVCRE) exposure in the regulatory capital rule. July 12, 2019 WebPage Regulatory News
News EBA Single Rulebook Q&A: Second Update for July 2019 Under the Single Rulebook question and answer (Q&A) updates for this week, EBA published answers to five questions related to supervisory reporting. July 12, 2019 WebPage Regulatory News
News ESMA Updates Manual for European Single Electronic Format in EU ESMA updated the reporting manual for European Single Electronic Format (ESEF). July 12, 2019 WebPage Regulatory News
News FED Updates Supplemental Instructions for Reporting Form FR Y-9C FED updated the supplemental instructions for FR Y-9C reporting. July 12, 2019 WebPage Regulatory News
News EBA Publishes Report on Monitoring Implementation of LCR in EU EBA published its first report on the monitoring of the implementation of liquidity coverage ratio (LCR) in EU. July 12, 2019 WebPage Regulatory News
News EIOPA Consults on Reporting and Disclosures Under Solvency II Review EIOPA launched a consultation package on supervisory reporting and public disclosure in the context of its work linked with the 2020 Solvency II review. July 12, 2019 WebPage Regulatory News
News APRA Applies Additional Capital Requirements to Three Australian Banks APRA is applying additional capital requirements to three major banks in Australia to reflect higher operational risk identified in their risk governance self-assessments. July 11, 2019 WebPage Regulatory News
News IMF Report on 2019 Article IV Consultation on Euro Area Policies IMF published its staff report in context of the 2019 Article IV consultation on euro area policies with member countries. July 11, 2019 WebPage Regulatory News
News FSB to Survey Practices on Cyber Incident Response and Recovery FSB launched a survey on the industry practices on cyber incident response and recovery. July 11, 2019 WebPage Regulatory News
News ECB Appoints New Members of Supervisory Board The Governing Council of ECB appointed Edouard Fernandez-Bollo, Kerstin af Jochnick, and Elizabeth McCaul as representatives to the Supervisory Board of ECB Banking Supervision, for a five-year non-renewable term. July 11, 2019 WebPage Regulatory News

RESULTS 1 - 10 OF 3444

Solutions

Industries

Moody's Analytics Brands

A-Z Product List

Access Online Products

Moody's Analytics Product Training

Insights

Regulatory News

Webinars-on-Demand

Moody's Analytics Risk Perspectives

Meet Our Experts

Connect With Us

Events Calendar

Training

Inquire About Upcoming Events

Meet Our Experts

About Us

Regions

Office Locations

Partner With Us

Connect With Us

Join Us

SAMA Publishes Financial Entities Ethical Red Teaming Framework

By Regulatory News

Related Articles

US Agencies Consult on Capital Treatment of Land Development Loans

EBA Single Rulebook Q&A: Second Update for July 2019

ESMA Updates Manual for European Single Electronic Format in EU

FED Updates Supplemental Instructions for Reporting Form FR Y-9C

EBA Publishes Report on Monitoring Implementation of LCR in EU

EIOPA Consults on Reporting and Disclosures Under Solvency II Review

APRA Applies Additional Capital Requirements to Three Australian Banks

IMF Report on 2019 Article IV Consultation on Euro Area Policies

FSB to Survey Practices on Cyber Incident Response and Recovery

ECB Appoints New Members of Supervisory Board

By Regulatory News

Previous Article

Next Article