Consultation Paper No 3 of 2025 - Cyber Risk Management Framework

Confidential
CONSULTATION PAPER
NO. 3 OF 2025
PROPOSED ENHANCEMENTS TO
CYBER RISK MANAGEMENT
30 April 2025

Consultation Paper No. 3 of 2025
Confidential
TABLE OF CONTENTS
Introduction ............................................................................................................................3
Background ............................................................................................................................5
Proposed Cyber Risk Rules...................................................................................................6
Conclusion..............................................................................................................................9
Annexes, appendices and attachments................................................................................9

Consultation Paper No. 3 of 2025
Confidential
Introduction
Why we are issuing this paper

1. The Financial Services Regulatory Authority ("FSRA") of the Abu Dhabi Global Market
   ("ADGM") has issued this consultation paper to invite public feedback on its proposal to introduce specific cyber risk management requirements for regulated firms (“Cyber Risk Rules”).
2. The financial services industry is a primary target for cybercriminals. As financial
   institutions rely more heavily on technology, they face growing vulnerabilities to cyber risks, including those associated with financial crime. The varying levels of cyber resilience across firms have resulted in incomplete protection for the sector as a whole, due to its interconnected nature and reliance on outsourced services. To enhance overall cyber resilience, it is essential for all industry participants to establish a consistent baseline of security measures.
3. At a national level, the UAE is placing ever-increasing importance on combatting cyber
   threats. In January 2022, the UAE introduced federal cybercrime legislation, and measures to prevent cybercrime remain a key focus in the UAE’s preparation for its Mutual Evaluation by the Financial Action Task Force in 2026.
4. The FSRA will continue to play a key role in contributing to the coordinated national
   efforts to combat financial crime, including preventative measures against the growing risk of cybercrime. Financial crime prevention is a strategic priority for the FSRA, in line with its objectives of ensuring that financial markets in the ADGM are supported by secure and efficient infrastructure, promoting and enhancing the integrity of the ADGM Financial System, and providing adequate protection for users of the system 1 .
5. Capitalised terms contained in this consultation paper have the meanings attributed to
   them in GLO, unless otherwise defined in this paper.
   Who should read this paper
6. This paper will be of interest to Authorised Persons and Recognised Bodies, potential
   applicants for a Financial Services Permission, and their respective professional advisors.
   Section 1(3) of the Financial Services and Markets Regulations 2015

Consultation Paper No. 3 of 2025
Confidential
How to provide comments
7. All comments should be made in writing and sent to the mail address or email address
specified below. If sending your comments by email, please use the consultation paper number in the subject line. If relevant, please identify the organisation you represent in providing your comments. The FSRA reserves the right to publish, including on its website, any comments you provide, unless you expressly request otherwise at the time of making any comments. Comments supported by reasoning and evidence will be given more weight by the FSRA. What happens next
8. The deadline for providing comments on this proposal is 11 June 2025. When we receive
your comments, we will consider whether any modifications are required to the proposed amendments described in this paper. The FSRA will then proceed to enact the proposed amendments. You should not act on the proposed amendments until the relevant regulations and rules are issued and we will publish a notice on our website when that happens. Comments to be addressed to:
Consultation Paper No. 3 of 2025
Abu Dhabi Global Market
ADGM Square
Al Maryah Island
PO Box 111999
Abu Dhabi, UAE
Email: fsra.consultation@adgm.com

Consultation Paper No. 3 of 2025
Confidential
Background

1. Technology and data are essential drivers for today’s financial institutions. Advanced
   technology is relied upon to streamline operations, achieve business goals, and deliver superior services to customers and clients. Data plays a pivotal role in supporting decision-making, operations and service delivery. By harnessing the power of technology and data, modern financial institutions can offer more efficient, effective, and customer-focused service.
2. As technology continues to transform financial services, robust IT and cyber risk
   management becomes increasingly critical. The FSRA is committed to ensuring that the ADGM financial markets are supported by secure infrastructure that safeguards the integrity of the ADGM Financial System. The ecosystem of innovative firms that choose to operate from our international financial centre demonstrates the FSRA’s progressive approach to financial services regulation and support for technological advances in the financial services industry.
3. In November 2020 the FSRA issued guidelines on the mitigation of cyber threats and
   crimes (“Guidelines”) 2 and in 2023 published a Discussion Paper on Information Technology Risk Management (“Discussion Paper”) 3 . In the Discussion Paper the FSRA was clear that it considers IT risk management to be a key part of a firm’s management of its overall risk profile. More recently, the FSRA released its Information Technology Risk Management Guidance to provide firms with a set of desired outcomes and best practices on the sound management of information technology risks (“Guidance”) 4 . The Guidance identifies what the FSRA considers to be best practices for identifying and managing information technology risks and serves to support Authorised Persons and Recognised Bodies in their compliance with the existing, related binding legislative requirements.
4. These proposals for cyber risks in this consultation paper should also be seen as a
   component of the work that the FSRA is currently undertaking more generally in relation to operational resilience. The proposed amendments form part of the FSRA’s phased approach to enhancing the operational resilience of Authorised Persons and Recognised Bodies. 2 FSRA/FCPU/15/2020: Governance Principles and Practices to Mitigate Cyber Threats and Crime 3 Discussion Paper No. 1 of 2023: Information Technology Risk Management, November 2023 Information Technology Risk Management Guidance, November 2024

Consultation Paper No. 3 of 2025
Confidential
Proposed Cyber Risk Rules
5. The proposed Cyber Risk Rules build upon the recently issued Guidance by providing
specific Rules for the management of cyber risks, as a natural step in the evolution of the FSRA’s regulatory framework in this area.
6. The proposed Cyber Risk Rules would primarily be captured by adding a new cyber risk
management section to Chapter 3 (Management, Systems and Controls) of the General Rulebook (“GEN”). An amendment would be made to the Market Infrastructure Rulebook (“MIR”) to bring Recognised Bodies within scope alongside Authorised Persons. Other consequential changes would be made to the Conduct of Business Rulebook (“COBS”), the Prudential – Insurance Business Rulebook (“PIN”), the Captive Insurance Business Rulebook (“CIB”), the Prudential – Investment, Insurance Intermediation and Baking Rulebook (“PRU”) and the Glossary Rulebook (“GLO”). Proposed Rulebook amendments
7. The proposed Cyber Risk Rules comprise the following.
a. New Rules added to Chapter 3 of GEN (Management, Systems and Controls) under the heading of Cyber Risk Management. The Rules would require firms to:
i. identify and assess their cyber risks;
ii. establish and maintain a Cyber Risk Management Framework (“CRMF”)
that appropriately addresses those risks;
iii. put in place appropriate governance and systems and controls as part of
the CRMF;
iv. undertake ongoing monitoring and reporting on the effectiveness of the
CRMF; and
v. manage and control cyber incidents, and notify material incidents to the
FSRA, covered in more detail in paragraph 8). b. An amendment to MIR, to bring Recognised Bodies within scope.
c. Minor amendments to COBS, PIN, CIB and PRU to align existing Rules or Guidance
with the proposed Cyber Risk Rules. d. New definitions being added to GLO.
8. The proposed Cyber Risk Rules require that a firm’s CRMF be integrated within its overall
risk management framework as established pursuant to GEN 3.3.4-3.3.6. Additionally, the proposed CRMF applies a risk-based approach that is commensurate to the nature,

Consultation Paper No. 3 of 2025
Confidential scale and complexity of the activities conducted by Authorised Persons and Recognised Bodies. Transitional arrangements
9. The proposed Cyber Risk Rules do not require more than the expectations set out in the
Guidelines issued in 2020. They do not extend to the adequacy of technology resources or operational resilience more generally and, as a result, the existing Rules and Guidance in that regard remain unaffected. Accordingly, the FSRA believes that it is appropriate to expect implementation by firms within three months of the Cyber Risk Rules coming into force. Question 1 Are there any specific aspects of the Cyber Risk Rules that are likely to present material challenges for firms? Question 2 Do you agree with the requirement for firms to establish and maintain a CRMF? Question 3 Do you agree with the CRMF being integrated within a firm’s overall risk management framework? Question 4 Do firms need three months to effect compliance with the Cyber Risk Rules, or is an implementation period unnecessary? Do firms need longer than three months, and if so, why? Notification of cyber incidents
10. The proposed Cyber Risk Rules include a requirement to notify material cyber incidents
to the FSRA immediately, and in any event no later than 24 hours after the firm becomes aware of an incident, notwithstanding weekends or public holidays. Guidance in the Cyber Risk Management Rules sets out what the FSRA will consider to be ‘material’. As GEN 8.10.6 already requires immediate reporting to the FSRA of material issues of this kind, an immediate notification requirement for significant cyber incidents will not create additional regulatory burden. Initial reporting will only need to cover preliminary information known at the time by the relevant firm. The FSRA considers that the 24-hour backstop to the immediate reporting requirement will:

Consultation Paper No. 3 of 2025
Confidential a. facilitate faster mitigation of the incident, in turn potentially reducing its scope and impact; b. support early coordination of resources by firms, potentially minimising potential contagion across systems and preventing (further) financial losses; and
c. enable reputational damage to be proactively addressed.
Question 5
Do you agree with the requirement to notify material cyber incidents to the FSRA immediately and in any event within 24 hours? Post-implementation steps
11. The FSRA plans to undertake a review of firms’ implementation of the Cyber Risk Rules.
This may take the form of a thematic review or similar, with a view to providing the FSRA with the necessary information to further enhance its supervisory approach in this area. In the longer term, and informed by the outcomes of that review, the FSRA is contemplating introducing an obligation on firms to file an annual return. This reflects the heightened national focus on cybersecurity referred to earlier in this paper and the FSRA’s preferred approach to cyber risk management prioritising risk mitigation, accountability, and transparency.
12. Publication of the Cyber Risk Rules will be followed by a program of awareness and
outreach led by the FSRA.
Question 6
Do you agree with the introduction of an annual Cyber Risk Management Return in due course? Question 7 Do you have any other comments on the proposals relating to cyber risk management as set out in this paper? Miscellaneous amendments
13. In addition to our proposals in relation to the Cyber Risk Rules, we are taking the
opportunity to correct some minor errors, omissions and typos in COBS, GEN and MIR. These have been integrated into the relevant Appendices to this paper. Question 8 Do you have any comments on the proposed miscellaneous amendments included in Appendices 2, 3 and 5?

Consultation Paper No. 3 of 2025
Confidential
Conclusion
14. The detailed, proposed legislative amendments to the relevant Rulebooks are included
in Appendices 1 to 7 to this paper. We believe that the proposed Cyber Risk Management Rules will align the FSRA with international best practices and ensure that we are clear that the management of cyber risk is a fundamental aspect of combatting financial crime. Annexes, appendices and attachments
15. The draft, proposed legislative amendments to the relevant FSRA Rulebooks are set out
as follows.

• Appendix 1 - Proposed amendments to the Captive insurance Business Rulebook
  (CIB);
• Appendix 2 - Proposed amendments to the Conduct of Business Rulebook
  (COBS);
• Appendix 3 - Proposed amendments to the General Rulebook (GEN);
• Appendix 4 - Proposed amendments to the Glossary Rulebook (GLO);
• Appendix 5 - Proposed amendments to the Market Infrastructure Rulebook (MIR);
• Appendix 6 - Proposed amendments to the Prudential - Insurance Business
  Rulebook (PIN); and
• Appendix 7 - Proposed amendments to the Prudential - Investment, Insurance
  Intermediation and Banking Rulebook (PRU).

---

Appendix 1 - Proposed Amendments to CIB

Appendix 1
Captive Insurance Business Rulebook (CIB)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 1
…
2.4.2 Management of particular risks
Without prejudice to the generality of Rule 2.4.(1, a Captive Insurer must develop, implement and maintain a risk management system to identify and address risks, including but not limited to:
(a) reserving risk;
(b) investment risk (including risks associated with the use of Derivatives); (c) underwriting risk; (d) market risk; (e) liquidity management risk; (f) credit quality risk; (g) fraud and other fiduciary risks; (h) compliance risk; (i) outsourcing risk; (j) Cyber Risk; and (k) reinsurance risk. Reinsurance risk refers to risks associated with the Captive Insurer's use of reinsurance arrangements as Cedant. Guidance GEN 3.5 contains additional requirements that apply to Authorised Persons in relation to Cyber Risk management. …

---

Appendix 2 - Proposed Amendments to COBS

Appendix 2
CONDUCT OF BUSINESS RULEBOOK (COBS)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 2
14. CLIENT MONEY AND RELEVANT MONEY PROVISIONS
…
14.13.4 A pooling event under Rule 14.13.3(c) does not occur when the Authorised Person has
notified the Regulator in accordance with Rule 14.11.8 and, in the Authorised Person is taking steps, in consultation with the Regulator, to rectify those records and there are reasonable grounds to conclude that the records will be capable of reconciliation within a reasonable period. …
17.5 Technology Governance and Controls
…
Risk management
(e) A risk management plan containing a detailed analysis of likely risks with both high and low impact, as well as mitigation strategies. The risk management plan must cover, but is not limited to:
(i) operational risks;
(ii) technology risks, including ‘hacking’ related risks; (iii) market risk for each Accepted Virtual Asset; and (iv) risk of Financial Crime. Guidance GEN 3.5 contains additional requirements that apply to Authorised Persons in relation to Cyber Risk management. …
19.23 Risk mitigation and Reporting
Management of operational and security risks
19.23.1 (1) A Payment Service Provider must establish a framework with appropriate
mitigation measures and control mechanisms to manage the operational and security risks relating to the Payment Services it provides. (2) As part of that framework, the Payment Service Provider must establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.

Appendix 2
(3) A comprehensive assessment of operational and security risks must be undertaken by the Payment Service Provider relating to the Payment Services it provides, at least annually or more frequently if requested by the Regulator, and provided to the Regulator on request. (4) The assessment must address the adequacy of the mitigation measures and control mechanisms implemented in response to those risks in such form and manner, and contain such information, as the Regulator may direct. Guidance

1. The FSRA may require a Payment Service Provider to engage technical experts to
   generate an audit report addressed to the FSRA, in order to provide independent assurance that the systems and controls employed by the Payment Service Provider comply with the requirements imposed by this Chapter.
2. Payment Service Providers are expected to provide a summary of the information
   required by Rule 19.23.1 as part of the periodic IRAP assessments undertaken in accordance with PRU 10.3.
3. GEN 3.5 contains additional requirements that apply to Authorised Persons in
   relation to Cyber Risk management.
   Incident reporting
   19.23.2 (1) If a Payment Service Provider becomes aware of a major operational or security
   incident, the Payment Service Provider must, without undue delay, notify the Regulator. (2) A notification under (1) must be in such form and manner, and contain such information, as the Regulator may direct. (3) If the incident has or may have an impact on the financial interests of its Payment Service Users, the Payment Service Provider must, without undue delay, inform its Payment Service Users of the incident and of all measures that they can take to mitigate the adverse effects of the incident. Guidance
4. Upon receipt of the notification referred to in 19.23.2(1), the Regulator may notify
   any other relevant authorities in the U.A.E.
5. If the Regulator receives notification of an incident from any relevant regulator in
   the U.A.E. or internationally, it may direct the Payment Service Provider to take appropriate measures to protect the immediate safety of their Payment Service Users and the financial system.
6. GEN 3.5.18 and 8.10.6 also require Authorised Persons to notify the Regulator in
   certain circumstances.

Appendix 2
…
20.14 Reporting and Risk mitigation
Management of operational and security risks
20.14.1 (1) A Third Party Provider must establish a framework with appropriate mitigation
measures and control mechanisms to manage the operational and security risks relating to the Third Party Services it provides. (2) As part of that framework, the Third Party Provider must establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents. (3) A comprehensive assessment of operational and security risks must be undertaken by the Third Party Provider relating to the Third Party Services it provides, at least annually or more frequently if requested by the Regulator, and provided to the Regulator on request. (4) The assessment must address the adequacy of the mitigation measures and control mechanisms implemented in response to those risks in such form and manner, and contain such information, as the Regulator may direct. Guidance

1. The Regulator may provide further guidance to Third Party Providers on their
   management of technology and data risks that sets out the Regulator’s expectations on how Third Party Providers should meet their obligations under this section and other applicable Rules. A Third Party Provider’s use of such guidance will be taken into account as part of the ongoing supervisory process of assessing Third Party Providers’ risk profile.
2. GEN 3.5 contains additional requirements that apply to Authorised Persons in
   relation to Cyber Risk management.
   Incident reporting
   20.14.2 (1) A Third Party Provider must notify the Regulator without undue delay if it becomes
   aware of a major operational or security incident.
   (2) A notification under (1) must be in such form and manner, and contain such information, as the Regulator may direct. (3) The Third Party Provider must inform its Customers without undue delay of the incident and the measures that it will take to mitigate the incident if the incident has or may have an impact on the financial interests of its Customers.

Appendix 2
Guidance

1. Upon receipt of the notification referred to in 20.14.2(1), the Regulator may notify
   any other relevant authorities in the U.A.E.
2. If the Regulator receives notification of an incident from any relevant regulator in
   the U.A.E. or internationally, it may direct the Third Party Provider to take appropriate measures to protect the immediate safety of their Customers and the financial system.
3. GEN 3.5.18 and 8.10.6 also require Authorised Persons to notify the Regulator in
   certain circumstances.
   …

---

Appendix 3 - Proposed Amendments to GEN

Appendix 3
GENERAL RULEBOOK (GEN)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 3
…
3.3.32 (1) An Authorised Person must inform the Regulator about any material outsourcing
arrangements.
…
Guidance

1. An Authorised Person's outsourcing arrangements should include consideration
   of:
   a. applicable guiding principles for outsourcing in financial services issued by the Basel Committee on Banking Supervision, IOSCO or any other international body promulgating applicable standards for outsourcing by Financial Institutions; or b. any equivalent principles or regulations the Authorised Person is subject to in its home country jurisdiction.
2. An outsourcing arrangement would be considered to be material if it is a service
   of such importance that weakness or failure of that service would cast serious doubt on the Authorised Person's continuing ability to remain fit and proper or to comply with the Regulator's administered Regulations and Rules.
3. Rule 3.5 contains additional requirements that apply to an Authorised Person that
   receives services directly from a third party or a subcontractor of a third party which involve accessing the Authorised Person’s IT Systems or Networks or accessing or processing its data. … 3.3.341A (1) This Rule applies to:
   (a) Banks
   …
   3.5 Cyber Risk Management
   This Rule 3.5 takes effect on [6 months from the date of publication]. Cyber Risk Management Framework
   3.5.1 (1) An Authorised Person must establish and maintain a Cyber Risk Management
   Framework to identify, assess and manage Cyber Risk effectively. (2) An Authorised Person must ensure the Cyber Risk Management Framework is in writing and is approved by its Governing Body. (3) The Cyber Risk Management Framework must:

Appendix 3
(a) include systems and controls which are appropriate to the nature, scale and complexity of the activities conducted by the Authorised Person; and (b) have clearly defined roles and responsibilities, including accountability for decision making during business-as-usual operations and stressed situations. (4) The systems and controls in Rule 3.5.1(3)(a) must include one or more systems for the purposes of:
(a) identifying and assessing Cyber Risk which enables the Authorised Person to implement the requirements in Rule 3.5.4; (b) protecting ICT Assets in accordance with Rules 3.5.5 to 3.5.13; (c) monitoring and testing the effectiveness of such systems and controls in accordance with Rule 3.5.14; and (d) managing Cyber Incidents which enables the Authorised Person to comply with the requirements in Rules 3.5.15 to 3.5.17. (5) An Authorised Person must review its Cyber Risk Management Framework to ensure that it remains appropriate, effective and up-to-date . (6) An Authorised Person must carry out the review required under (5) regularly, and at least annually. (7) An Authorised Person must integrate its Cyber Risk Management Framework within its overall risk management framework established under Rules 3.3.4 to 3.3.6. Guidance

1. An Authorised Person’s Cyber Risk Management Framework may be based on, or
   informed by, other relevant guidance and regulations published by the Regulator and other competent UAE federal authorities, as well as standards prepared by international organisations or recognised professional institutions, including the following:
   a. The UAE Telecommunications and Digital Government Regulatory Authority: UAE Information Assurance (IA) Regulation (2020); b. International Organisation for Standardisation: Information technology – Security techniques – Information security management systems – Overview and vocabulary (ISO standard no. 27000:2018);
   c. National Institute of Standards and Technology (NIST): Framework for
   Improving Critical Infrastructure Cybersecurity (2018);

Appendix 3
d. Center for Internet Security: Critical Security Controls (2024); e. Committee on Payments and Market Infrastructures and the International Organisation of Securities Commissions: Guidance on cyber resilience for financial market infrastructures (2016); f. Cloud Security Alliance: Cloud Controls Matrix and CAIQ (2024); g. Risk assessment methodology: NIST SP800-30: Guide for Conducting Risk Assessments (2012); and subsequent versions thereof.
2. The systems and controls referred to in Rule 3.5.1(4)(b) should enable an
Authorised Person to protect its ICT Assets in accordance with the requirements in Rules 3.5.5 to 3.5.14 in a way that minimises the likelihood and impact of a successful Cyber Incident on ICT Assets as identified under Rule 3.5.4(1). They should be commensurate with the outcome of the Cyber Risk assessment under Rule 3.5.4(2) and the Authorised Person’s Cyber Risk tolerance determined under Rule 3.5.3(2)(c).
3. An Authorised Person may need to apply additional controls, depending on its
nature, scale or complexity.
4. An Authorised Person may also rely on Group-wide policies on Cyber Risk when
developing its policies, procedures or controls.
5. An Authorised Person should tailor any standards or policies it chooses to adopt to
its needs. Not all elements of the standards or policies may be applicable. Additional policies, procedures and controls may be required to address idiosyncratic risks.
6. Systems and controls put in place pursuant to Rule 3.5.1 may include supporting
policies and procedures.
3.5.2 (1) An Authorised Person must manage Third-Party Cyber Risk as part of its Cyber Risk
Management Framework established under Rule 3.5.1. This must include:
(a) undertaking due diligence to ensure that where it chooses suitable third￾party providers of ICT Services they comply with appropriate Cyber Risk standards; (b) ensuring that the terms of the contractual arrangements with a third-party provider of ICT Services require the third party to:
(i) comply with the Authorised Person’s Cyber Risk requirements;

Appendix 3
(ii) notify the Authorised Person about all Cyber Incidents that may affect the Authorised Person; (iii) work with the Authorised Person in remediating the impact of a Cyber Incident on the Authorised Person; (iv) allow the Authorised Person to verify that the third party continues to meet the Authorised Person’s Cyber Risk requirements; and (c) supervising effectively the provision of ICT Services by third parties. (2) An Authorised Person that relies on the provision of ICT Services by a third party remains fully responsible for compliance with, and the discharge of, all obligations under this Rule 3.5.2. Guidance

1. This Rule supplements the overarching requirements that govern the outsourcing
   of functions and activities under Rules 3.3.31 and 3.3.32 by an Authorised Person. The scope of this Rule is wider than the scope of those outsourcing requirements as it applies to the provision of all ICT Services that may affect the provision of Regulated Activities by an Authorised Person, including the provision of cloud services and the maintenance of the servers of an Authorised Person.
2. The supervision of the provision of ICT Services by a third party under Rule
   3.5.2(1)(c) should include regular and appropriate verification that the third party complies with the Authorised Person’s security requirements. Verification may be achieved, for example, through a review of the third party’s control environment or using independent audit reports. The frequency, scope and independence of the verification or other review(s) should be determined based on the criticality of systems and the sensitivity of information contained in them. In certain circumstances, it may not be appropriate to allow the third party to undertake such review or verification itself.
3. The Regulator expects an Authorised Person to apply adequate controls on the use
   of subcontractors by a third party. An Authorised Person should be aware of the scope of services that are carried out by subcontractors and what actions were undertaken to mitigate Cyber Risk by both the third party and all of its subcontractors.
4. A contract with a third-party provider of ICT Services should set out appropriate
   requirements for the deletion or return of an Authorised Person’s information at the end of the contract.

Appendix 3
Governance
3.5.3 (1) An Authorised Person must ensure that its Governing Body and senior management
are ultimately responsible for ensuring that its Cyber Risk Management Framework is implemented and followed and that Cyber Risk is managed effectively. (2) Without limiting the operation of (1), the responsibilities of an Authorised Person’s Governing Body and senior management in respect of Cyber Risk include:
(a) ensuring that Cyber Risk is adequately identified, assessed and managed in accordance with the Authorised Person’s Cyber Risk Management Framework; (b) establishing and maintaining a senior management structure for the management of Cyber Risk and for ensuring compliance with the Authorised Person’s Cyber Risk Management Framework; (c) defining the Authorised Person’s Cyber Risk tolerance, which must be in line with its business objectives, strategy and overall risk tolerance; and (d) ensuring that relevant personnel have the necessary expertise to manage Cyber Risk. Guidance

1. The Regulator expects the Governing Body of an Authorised Person to demonstrate
   a thorough understanding of all Cyber Risk to which it is or might be exposed. The Governing Body should be regularly updated on current global cyber trends and be included in Cyber Risk training, cyber awareness campaigns and similar activities conducted by the Authorised Person.
2. Management information on Cyber Risk and mitigation measures should be
   presented to the Governing Body in a way that can be easily understood and analysed. It should include information on current and emerging Cyber Risks and the efficacy of existing mitigation measures. For example, the Regulator expects the Governing Body to be informed where a performance indicator signals that a Cyber Risk control may be underperforming or failing, leading to the Cyber Risk exposure approaching the Authorised Person’s risk tolerance. Identification and assessment of Cyber Risk
   3.5.4 (1) An Authorised Person must identify and maintain a current inventory of its ICT
   Assets and classify them in terms of their confidentiality and how critical they are to the support of its business functions and processes.

Appendix 3
(2) An Authorised Person must carry out an assessment of Cyber Risk associated with the assets identified in (1) regularly and no less than annually. (3) When carrying out the assessment in (2) an Authorised Person must:
(a) identify threats from Cyber Incidents, including cybercrimes; (b) assess the Cyber Risk resulting from those threats and the effectiveness of relevant controls, including the outcomes of ongoing monitoring and testing undertaken in accordance with Rule 3.5.14, to arrive at the residual Cyber Risk; (c) analyse and quantify the potential impact and consequences of the residual Cyber Risk on its overall business and operations. Guidance

1. The purpose of this Rule is to ensure that an Authorised Person understands which
   of its ICT Assets, critical operations and supporting information should be protected against Cyber Incidents, in order of priority.
2. An Authorised Person’s assessment of the Cyber Risk it faces or may potentially
   face should be accurate, up-to-date and reviewed regularly and no less than annually.
3. The assessment should include, at a minimum:
   a. an assessment of the interconnections and dependencies between the Authorised Person’s ICT Assets and its business functions and processes; b. consideration of the results of the Authorised Person’s most recent risk self￾assessment, where applicable, and testing of its business continuity arrangements under Rule 3.3.33;
   c. consideration of Cyber Risk that third parties pose to the Authorised Person;
   and d. a review of the inventory of ICT Assets.
4. The Regulator expects an Authorised Person to have well-defined processes and
   clearly assigned responsibilities for maintaining its ICT Asset inventory and assessing Cyber Risk. The ICT Asset inventory should record where each asset is stored and what it is used for. It should also include ICT Assets belonging to third parties upon which Authorised Person depends, including software as a service and cloud-hosted applications.

Appendix 3
5. An Authorised Person should consider participating in industry forums relating to
Cyber Risk that provide an opportunity for intelligence sharing. Protection of ICT Assets against Cyber Incidents
3.5.5 An Authorised Person must use and maintain up-to-date anti-malware software and
ensure that regular updates are applied to its anti-malware signature files. Guidance The Regulator expects an Authorised Person to use anti-malware software to conduct regular automatic scanning of its ICT Assets, in particular servers and workstations, and to scan all files received over networks (including email attachments and files downloaded from websites) and files kept on storage media before use. The anti-malware software should be used to detect and block malware, potentially malicious links in emails and malicious websites.
3.5.6 (1) An Authorised Person must implement network security controls, including
appropriate network architectures, protocols and network security devices, to protect the perimeters of its Networks. (2) An Authorised Person must implement network security monitoring procedures to facilitate prompt detection of unauthorised or malicious activities. Guidance An Authorised Person should consider installing security devices at critical junctures in its Networks (e.g., firewalls, web application firewalls, intrusion detection and prevention systems, virtual private network gateways) to protect the perimeters of its Networks. The rules and configurations of the network security devices should be backed up and reviewed regularly to ensure they remain appropriate and relevant.
3.5.7 (1) An Authorised Person must ensure that access rights and permissions to its IT
Systems and Networks are properly managed.
(2) For the purposes of (1), an Authorised Person must:
(a) establish a user access management process for the approval of a user’s request for access or permission which ensures that:
(i) the user is only granted the minimum access or permissions needed to perform that user’s tasks or functions; and (ii) the user’s access and permissions are immediately revoked if the conditions for granting approval are no longer met.

Appendix 3
(b) perform regular reviews of users’ access rights and permissions to verify that they remain appropriate. Guidance

1. The principle set out at Rule 3.5.7(2)(a)(i) is known as the “least privilege principle”.
   This is a recognised information security concept that provides that only the minimum access necessary to perform an operation or task should be granted and that the access should be granted only for the minimum amount of time necessary. Its purpose is to reduce risk by limiting the number of individuals with access rights or privileges. In line with this principle, the Regulator expects an Authorised Person to base access rights and privileges, including access rights and privileges of Employees, Customers and third-party service providers, on a user’s requirements and responsibilities and to revoke those rights and privileges as soon as they are no longer required, in particular when an employment, customer or contractual relationship comes to an end, or there is a change in a user’s requirements or tasks.
2. Privileged access rights or permissions (i.e. rights and permissions to perform
   security related functions that ordinary users are not authorised to perform, including rights and permissions to administrator accounts) should be limited to the extent possible and assigned to user credentials different from those used for regular business activities. Regular business activities should not be performed using privileged user credentials.
3. Robust Identity and Access Management Practices should be adopted. These
   policies, procedures and systems outline which users have access to specific systems, data or functionality and the circumstances under which access is granted, reviewed and revoked.
4. The process of performing regular reviews of access and permissions should
   facilitate the identification of dormant and redundant accounts as well as the detection of unauthorised access rights or permissions.
5. Access rights and permissions for users may also include those for applications and
   programmes that are automated.
   3.5.8 An Authorised Person must ensure that access to its IT Systems and Networks is properly
   secured, including by implementing:
   (a) strong password authentication requirements; (b) multi-factor authentication or equivalent protection for its IT Systems and Networks that may be accessed from the internet; (c) multi-factor authentication or equivalent protection for privileged access rights or permissions; and

Appendix 3
(d) encryption techniques to secure communication between a user and the Authorised Person’s IT System and Network. Guidance

1. The Regulator expects that an Authorised Person’s strong password controls
   require, at a minimum, a change of password upon initial logon, minimum password length and history requirements, password complexity, maximum validity periods and lockout thresholds after a number of unsuccessful logon attempts.
2. For mobile devices, access controls and encryption techniques should address
   threats raised by their use away from the Authorised Person’s premises.
3. Users with administrative or privileged access should use a designated device that
   is dedicated to carrying out approved privileged tasks and activities on sensitive systems.
   3.5.9 (1) An Authorised Person must have a comprehensive change management process
   that considers Cyber Risk before and during a change to its IT Systems and Networks and any new Cyber Risk created after the change. (2) The process in (1) must include systems and controls that ensure changes to its IT Systems and Networks are:
   (a) adequately tested;
   (b) approved before their implementation; and (c) implemented promptly if needed to resolve material Cyber Incidents or security vulnerabilities. Guidance
4. The purpose of the change management process is to ensure that changes and
   patches to production systems and hardware devices are adequately assessed, tested, approved and implemented.
5. The Regulator expects an Authorised Person to establish a separate physical or
   logical environment for the development, testing and production of systems or patches. The Regulator expects an Authorised Person to ensure a clear segregation of tasks so that no single individual develops, tests and implements any change.
6. While emergency changes should be implemented in a controlled manner, the
   Regulator recognises that the process requires swift actions and decisions. In such cases, where necessary and justifiable and on an exceptional basis, some aspects of an Authorised Person’s change management process such as change

Appendix 3
documentation or testing may be completed after a change has been implemented.
3.5.10 (1) An Authorised Person must establish a process for the management of software
updates that addresses security vulnerabilities in the Authorised Person’s ICT Assets. (2) The process in (1) must ensure that:
(a) software updates are identified and classified by how critical they are to mitigate Cyber Risk; (b) software updates are applied in a timely manner; and (c) the implementation of critical software updates is prioritised. (3) An Authorised Person must implement software updates in accordance with the process required under Rule 3.5.9. Guidance

1. As part of its Cyber Risk Management Framework, an Authorised Person should
   establish a vulnerability management process for an up-to-date understanding of security vulnerabilities.
2. An Authorised Person may wish to consider using automated vulnerability scanning
   systems to assist in effectively identifying and assessing vulnerabilities resulting from new and evolving threats.
   3.5.11 (1) An Authorised Person must implement appropriate encryption techniques to
   protect the confidentiality and integrity of information in transit, at rest, and at end of life. (2) The encryption techniques implemented for the handling of information must be commensurate with the sensitivity of that information. Guidance
3. The Regulator expects encryption techniques to be used to protect the
   confidentiality and integrity of sensitive information. In particular, encryption techniques should be used where such information is stored on workstation memory drives, external drives such as USB pen drives, external hard discs, mobile phones, tablets and other electronic equipment used to store or process critical and sensitive information.
4. Appropriate measures should also be taken when exchanging sensitive
   information. These encryption measures could include sending information

Appendix 3
through encrypted channels or encrypting the information using strong encryption with an adequate key length.
3.5.12 (1) An Authorised Person must limit physical access to its data centres and server
rooms, if any, to individuals who have a legitimate business need. (2) For the purposes of (1), the Authorised Person must establish a process for:
(a) the approval of an individual’s request for physical access; and (b) the immediate revocation of such access if the conditions for granting approval are no longer met. (3) An Authorised Person must implement appropriate security measures to prevent unauthorised physical access to its data centres and server rooms. Guidance The Regulator expects that:
a. where physical access is granted to individuals who are not members of an Authorised Person’s staff, they will be accompanied by a staff member at all times during such access; and b. an Authorised Person will monitor and record the activities that take place inside its data centres and server rooms.
3.5.13 (1) An Authorised Person must establish and maintain a comprehensive Cyber Risk
management training programme and adequate awareness arrangements. (2) The programme and arrangements in (1) must ensure that all relevant Employees:
(a) receive training, at least annually, on the Authorised Person’s Cyber Risk policies and standards; (b) develop and maintain appropriate awareness of, and competencies for, detecting and reporting Cyber Incidents; and (c) understand their individual responsibilities. Guidance

1. An Authorised Person should regularly review and, where necessary, update its
   training programme to ensure that it remains current and relevant. The review should take into consideration the evolving nature of technology as well as emerging Cyber Risks.

Appendix 3
2. A relevant Employee would include any member of staff with access to an
Authorised Person’s IT System or Network or any other Employee who might otherwise be exposed to, or targeted by, a Cyber Incident.
3. New Employees should receive training within a reasonable period of joining the
Authorised Person.
4. The Regulator expects Employees with privileged access rights to receive targeted
security training that reflects their rights and responsibilities. Monitoring and Testing
3.5.14 (1) An Authorised Person must implement a system to conduct ongoing monitoring of
the effectiveness of the systems and controls that form part of its Cyber Risk Management Framework. (2) An Authorised Person must ensure that:
(a) it has in place a comprehensive programme to test the resilience of its IT Systems and Networks and its processes and controls implemented to comply with Rules 3.5.5 to 3.5.13; (b) testing under the programme is carried out regularly, and in the case of internet-facing systems, at least annually; and (c) it has in place a process to prioritise and remedy adverse testing outcomes. (3) An Authorised Person should ensure there is regular reporting to senior management on the results of the monitoring and testing it undertakes to satisfy its obligations under (1) and (2). Guidance

1. An Authorised Person should use a range of methods to test its IT Systems and
   Networks and processes and controls, such as:
   a. vulnerability assessments; b. scenario-based testing;
   c. penetration tests;
   d. bug bounty programs; e. red team exercises;

Appendix 3
taking into account the Authorised Person’s Cyber Risk assessment under Rule 3.5.4(2).
2. The frequency with which an Authorised Person should carry out testing will
depend on the nature, scale and complexity of its business. It may be adequate to test annually for some Authorised Persons, for others more frequent testing may be required. The Regulator expects additional tests to be carried out whenever systems are updated or new systems are implemented, including when systems are changed to address any vulnerabilities that have been identified during testing. Detection, response and recovery
3.5.15 (1) An Authorised Person must continuously monitor its IT Systems and Networks with
a view to detecting:
(a) Cyber Incidents; and
(b) the occurrence of anomalies and events indicating a potential Cyber Incident. (2) An Authorised Person must have a process for escalating actual or potential Cyber Incidents. Guidance

1. An Authorised Person’s ability to detect an actual or potential Cyber Incident is
   essential for strong cyber resilience. Early detection provides an Authorised Person with useful lead time to take appropriate measures to minimise any impact.
2. As part of its monitoring, the Regulator expects an Authorised Person to regularly
   review system logs, warnings, errors and security events to identify suspicious activities and system errors indicating a potential Cyber Incident.
3. The process for escalating actual or potential Cyber Incidents should define a point
   of contact for reporting incidents. All Employees should be made aware of their responsibility to report actual or potential Cyber Incidents as quickly as possible.
   3.5.16 (1) An Authorised Person must establish and maintain a robust Cyber Incident
   Response Plan providing for measures to be taken by the Authorised Person to respond to and limit the consequences of a Cyber Incident. (2) The Cyber Incident Response Plan must include appropriate conditions and procedures to ensure the timely implementation of response and recovery actions, including the actions required by Rule 3.5.17. (3) The conditions and procedures in (2) must be regularly tested to ensure their effectiveness.

Appendix 3
(4) An Authorised Person must ensure its Cyber Incident Response Plan is in writing and that it is reviewed regularly and no less than annually, and after the occurrence of a material Cyber Incident that is reportable pursuant to Rule 3.5.18, to ensure that it remains appropriate, effective and up-to-date. Guidance

1. Rule 3.3.33 provides overarching requirements for an Authorised Person’s
   business continuity arrangements. The Regulator expects the Cyber Incident Response Plan to be integrated into the Authorised Person’s overall crisis management and disaster recovery plans, where applicable.
2. The Regulator expects an Authorised Person’s Cyber Incident Response Plan to
   include a plan for communication with internal and external stakeholders using pre-approved communication templates relating to identified scenarios that may easily be adjusted, if necessary, and promptly sent to the relevant intended recipients if there is a Cyber Incident. The communication plans may be developed to address a range of possible scenarios taking into consideration experience gained from previous incidents.
3. An Authorised Person’s test of its conditions and procedures under Rule 3.5.16(3)
   may be conducted in a variety of ways (for example by using table-top exercises or simulations) and the appropriate scope of testing should be determined each time a test is planned. While an Authorised Person may decide to test only selected procedures at one time, it should ensure that all aspects of the Cyber Incident Response Plan are tested regularly. Testing requirements should be specified in the Cyber Incident Response Plan.
4. The regular review required by Rule 3.5.16(4) should take into account current
   cyber threat intelligence as well as lessons learnt from previous events and be adjusted to account for new processes and services. Where the review is triggered by a material Cyber Incident (see Guidance item 1 under Rule 3.5.18), the Regulator expects an Authorised Person to assess whether established procedures were followed and whether actions taken were effective. It should also identify key lessons learnt with a view to improving future Cyber Incident response and recovery processes.
   3.5.17 (1) If a potential or actual Cyber Incident is detected, an Authorised Person must carry
   out an investigation to determine its nature and extent.
   (2) While the investigation in (1) is ongoing, the Authorised Person must, where applicable, take immediate action to contain the situation to prevent further damage and commence recovery processes based on its Cyber Incident Response Plan.

Appendix 3
(3) An Authorised Person must take reasonable care to resume its operations responsibly, including taking the following steps, where applicable:
(a) eliminating all remaining harmful effects of the Cyber Incident; (b) restoring the affected elements of its IT System and Network; (c) recovering data affected by the Cyber Incident; (d) identifying and mitigating all vulnerabilities that were exploited by the Cyber Incident; (e) remediating vulnerabilities to prevent similar Cyber Incidents in the future; and (f) communicating appropriately internally and externally. Notification
3.5.18 An Authorised Person must notify the Regulator immediately, and in any event no later
than 24 hours including weekends and public holidays, after it becomes aware, or has information which reasonably suggests, that a material Cyber Incident has occurred, using the prescribed incident reporting form available on the electronic portal. Guidance

1. The Regulator considers any Cyber Incident that:
   a. affects customer information or poses a risk to Client Assets; b. may lead to material financial loss to the Authorised Person;
   c. may have a material reputational impact on the Authorised Person;
   d. disrupts critical business functions or information systems; e. involves the disruption or downgrading of IT System functionality or Network space such as malware and Denial of Service (DOS) or Distributed Denial of Service (DDOS) attacks; f. involves unauthorised intrusion into an Authorised Person’s IT Systems or Networks, such as hacking; or g. involves insider threats; to be material.
2. In further determining whether a Cyber Incident is material, an Authorised Person
   should also take into account the extent to which the Cyber Incident:

Appendix 3
a. is a crime under Federal legislation, including Federal Decree-law No. (34) of 2021 “On Countering Rumours and Cybercrimes”; b. results in leakage or corruption of sensitive or confidential information; or
c. affects external stakeholders.
3. The Regulator expects an Authorised Person to consider the need to report Cyber
Incidents to other appropriate authorities, such as law enforcement agencies, the FIU or the ADGM Data Protection Commissioner.
4. Rule 8.10.6 also sets out circumstances that require immediate notification to the
Regulator.
…

---

Appendix 4 - Proposed Amendments to GLO

Appendix 4
Glossary (GLO)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 4
…

1. INTRODUCTION
   1.1 Application
   1.1.1 This Rulebook ("GLO") applies to every Person to whom any of the Rulebooks apply.
   1.2 Defined Terms
   1.2.1 In the Rulebooks:
   (1) a word or phrase which is defined in GLO is a defined term and has the meaning given in GLO; and (2) a word or phrase which relates to a defined term must be interpreted accordingly. … Defined Terms Definitions Cyber Incident Means an incident arising from the use of information or communication technology that adversely affects an Authorised Person’s ICT Assets or the information it processes, stores or transmits. Cyber Incident Response Plan Means a plan for dealing with Cyber Incidents, as required by GEN 3.5.16. Cyber Risk Means the combination of the probability of Cyber Incidents occurring and their impact. Cyber Risk Management Framework Means a framework to identify, assess and manage Cyber Risk as required by GEN 3.5.1. ICT Asset Means any data, any device or any other component of information technology infrastructure, such as application software, firmware, databases, hardware, or end-user computing tools being used for information and communication technology (ICT) activity. ICT Service Means an information and communication technology (ICT) related service, such as the hosting, maintenance or provision of repair services of ICT Assets or any other service that involves accessing an Authorised Person’s IT Systems or Networks or accessing or processing an Authorised Person’s data. Identity and Access Management Practices Means the people, processes, procedures and technology that identify and manage the information used in an IT System to authenticate users and grant or deny access rights to information and IT system resources.

Appendix 4
IT System Means, collectively, ICT Assets, related methods and procedures that have been organised to provide information processing functions. Network Means a group of ICT Assets that are interconnected to exchange data, together with the communication channels between those ICT Assets. Third-Party Cyber Risk Means Cyber Risk that may arise from the use of ICT Services provided by a third party or a subcontractor of that third party. …

---

Appendix 5 - Proposed Amendments to MIR

Appendix 5
Market Infrastructure Rulebook (MIR)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 5
…
1.1.4 Table 1.1.4 below sets out further requirements that may be applicable to
Recognised Bodies contained in other FSRA Rulebooks.
No. Rule title Rule Reference All ADGM Recognised Bodies 22 Cyber Risk Management GEN Rule 3.5 √ …
3.2 Capital requirements
3.2.1 A Recognised Investment Exchange shall hold the following capital:
(a) an amount equal to 6 months' operating expenses; plus (b) unless the Regulator directs otherwise, an additional buffer amount of up to a further 6 months' operational operating expenses.
3.2.2 For the purposes of Rule 3.2.1, operational operating expenses shall be considered in
accordance with the International Financial Reporting Standards (IFRS). …
4.2 Capital requirements
4.2.1 A Recognised Clearing House shall hold capital more than or equal to the sum of
capital calculated in respect of the following risks.
(a) Winding down or restructuring activities. Six months' gross operational operating expenses. … (d) Business risk. A Recognised Clearing House shall submit to the Regulator for approval its own estimate of the capital necessary to cover losses resulting from business risk based on reasonably foreseeable adverse scenarios relevant to its business model. The capital requirement for business risk shall be equal to the approved estimate and shall be subject to a minimum amount of 25% of its annual gross operational operating expenses.
4.2.2 for the purposes of Rule 4.2.1, Recognised Clearing Houses shall use the most
recent audited information from their annual financial statement and operational

Appendix 5
operating expenses shall be considered in accordance with International Financial Reporting Standards (IFRS). …
5.1 Application and purpose
Application
5.1.1 The notification Rules in this chapter apply to Recognised Bodies.
5.1.1A For the purposes of this chapter, any reference to the rules of a Recognised Body, is made to its:
(a) Business Rules, in the case of a Recognised Investment Exchange; (b) Clearing Rules, in the case of a Recognised Clearing House; and (c) Default Rules, as applicable. Guidance Remote Body notification requirements are set out in Rule 7.54.2. …
5.4 Notification requirements
5.4.1 A Recognised Body must, in the circumstances noted, notify the Regulator of the
following information:
…
Event Timing Information Requirement
GEN Notifications
63. As set out in GEN
3.5.18, a Recognised
Body becomes aware of a material Cyber
Incident
Immediately and in any event no later than 24 hours.
(a) Notice of that event.
(b) Particulars of the event.
Position Limit Notifications
63.
64.
As set out in MIR
3.3.7(e), a Recognised
Body becomes aware that a position limit threshold is exceeded.
As soon as practicable.
(a) The reason why such a large position is being held.
(b) How the holding of said position furthers the participant’s or Member’s trading strategy. (c) How the position is being used for hedging and the relevant contracts being hedged against (where applicable). …

---

Appendix 6 - Proposed Amendments to PIN

Appendix 6
Prudential – Insurance Business (PIN)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 6
…
2.3.3 An Insurer must develop, implement and maintain a risk management system to identify
the operational risks faced by the Insurer, including but not limited to:
(a) technology risk (including processing risks); (b) reputational risk; (c) fraud and other fiduciary risks; (d) compliance risk; (e) outsourcing risk; (f) business continuity planning risk; (g) legal risk; and (h) key person risk; and (i) Cyber Risk. …
2.3.6 An Insurer must develop, implement and maintain a risk management system which
includes an explicit asset liability management ("ALM") policy, which must clearly specify the nature, role and extent of ALM activities and their relationship with any other relevant function or activity of the insurer including, but not limited to, product development, pricing functions and investment management. Guidance

1. An Insurer's ALM policy should be appropriate taking into account the nature,
   scale and complexity of its ALM risks.
2. The ALM policy should include details as to how:
   (a) the investment and liability strategies adopted by the Insurer allow for the interaction between assets and liabilities; (b) any correlations between assets and liabilities are taken into account; (c) the liability cash flows will be met by cash inflows; and (d) the valuations of assets and liabilities will change under an appropriate range of different scenarios.
3. GEN 3.5 contains additional requirements that apply to Authorised Persons in
   relation to Cyber Risk management.
   …

---

Appendix 7 - Proposed Amendments to PRU

Appendix 7
Prudential – Investment, Insurance Intermediation and Banking Rules (PRU) *In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 7
…
6.6 Information Technology (IT) systems
6.6.1 An Authorised Person must establish and maintain:
(a) appropriate information technology policies and processes to identify, assess, monitor and manage technology risks; and (b) appropriate and sound information technology infrastructure to meet its current and projected business requirements, under normal circumstances and in periods of stress, which ensures data and system integrity, security and availability and supports integrated and comprehensive risk management. Guidance

1. IT systems include the computer systems and information technology
   infrastructure required for the automation of processes and systems, such as application software, operating system software, network infrastructure, and desktop, server and mainframe hardware.
2. An Authorised Person should consider the following in establishing its systems
   and controls for the management of IT system risks:
   a. governance and oversight controls that ensure technology, including outsourcing arrangements, is aligned with and supportive of the Authorised Person's business objectives; b. an Authorised Person's organisation and reporting structure for technology operations, including adequacy of senior management oversight; and
   c. the appropriateness of the systems acquisition, development and
   maintenance activities, including the allocation of responsibilities between IT development and operational areas.
3. GEN 3.5 contains additional requirements that apply to Authorised Persons in
   relation to Cyber Risk management.
   6.7 Information security
   6.7.1 An Authorised Person must establish and maintain appropriate systems and controls to
   manage its information security risk.

Appendix 7
Guidance

1. In establishing its systems and controls to address information security risks, an
   Authorised Person should have regard to:
   a. confidentiality: information should be accessible only to Persons or systems with appropriate authority, which may require firewalls within a system, as well as entry restrictions; b. the risk of loss or theft of customer data;
   c. integrity: safeguarding the accuracy and completeness of information
   and its processing; d. non-repudiation and accountability: ensuring that the Person or system that processed the information cannot deny their actions; and e. internal security: including premises security, staff vetting; access rights and portable media, staff internet and email access, encryption, safe disposal of customer data, and training and awareness.
2. GEN 3.5 contains additional requirements that apply to Authorised Persons in
   relation to Cyber Risk management.
   …