Cyber Risk Self-Assessment form in fillable PDF format

SELF-ASSESSMENT: Best Practices on Cybersecurity A. GOVERNANCE – The Board, senior management and all ‘internal lines of defense’ - Business, Risk, and Internal Audit Departments must be involved in the implementation of a defined cybersecurity plan. Roles, responsibilities and reporting lines for all functional areas or person involved in the cybersecurity strategy should be clearly defined. • A formal risk-based cybersecurity strategy should be developed-- covering issues of identification, protection, detection, response and recovery--accompanied by consistent policies, procedures and standards that allow for appropriate tracking and monitoring. • The Board should approve the cybersecurity strategy and be kept informed of developments at least annually or more frequently if material issues arise. • Senior Management is responsible for implementing the strategy as well as the accompanying policies, procedures, and standards. • The Internal Audit Department should perform regular independent reviews of compliance with the cybersecurity strategy and policies and make relevant recommendations. Companies may also outsource the conduct of the independent review to a third party. B. RISK MANAGEMENT – A clear risk management framework should be established that assesses the company’s potential cybersecurity vulnerabilities and incorporates identification, monitoring, analysis, and reporting of cybersecurity incidents. • The risk management framework should identify the cyber security threats and vulnerabilities applicable to the IT environment, including internal and external networks, hardware, software applications, systems interfaces, data, operations procedures, and people. • The company should assure that adequate attention is placed to outsourcing risks, notably the possibility of risks related to third-party providers of IT services. • The company should ensure that policies and procedures for information security are implemented and regularly reviewed and updated. • An explicit incident management framework should be developed, encouraging reporting by staff and incorporating regular, systematic reviews of incidents and measures for improvement. C. AWARENESS AND TRAINING – Regular and appropriate cybersecurity training must be provided to employees and customers in an understandable way. • Security awareness training should be provided to all employees and Board members at least annually along with measures to assure participation and compliance with the training recommendations. Staff training should at least cover identification of malicious dangers, key safety practices, and the company’s cybersecurity policies. • Tailored security awareness training should be provided to Managers and IT Staff, reflecting their varying levels of responsibility. • Customers should receive adequate communication to allow them to utilize the company’s customer facing and accessible applications and tools relevant to their needs, understand their privacy and other rights, how to report suspicious activities, and the avenues for redress in case of problems.

D. BUSINESS CONTINUITY AND DISASTER RECOVERY – The company should have business continuity and recovery plans which incorporate dealing with cyber-related occurrences, including information technology system failures and unavailability. • The company should establish IT systems’ recovery time objectives and recovery point objectives aligned to its business resumption and system recovery priorities. • The company should establish a system and data backup strategy, and perform regular backups so that systems and data can be recovered in the event of a system disruption or when data is corrupted or deleted. • Where information assets are managed by third party service providers, companies should assess the service provider’s disaster recovery capability. • Business continuity and disaster recovery plans should be reviewed and tested regularly to validate their effectiveness. E. TESTING – Regular testing of IT systems that simulate potential threats and failures should be carried out at a frequency commensurate with the complexity and risk profile of the company. • The company should establish processes to conduct regular vulnerability assessments of its IT assets, including IT systems, network devices and applications, to identify security vulnerabilities and ensure risks arising from these gaps are addressed in a timely manner. • The company should carry out penetration testing (including threat-led penetration testing where necessary and appropriate) commensurate to the level of risk identified with the business processes and systems. F. INCIDENT MANAGEMENT AND REPORTING – Information on material system changes and cybersecurity incidents that affect customers should be transparently communicated to them and to the relevant regulator. • The company should establish an incident management framework with the objective of restoring an affected IT service or system to a secure and stable state as quickly as possible. The goal is to minimise impact to the company’s business and customers. • The company should report all incidents considered to have a material impact on its business operations and consumers to the Central Bank or relevant regulator. • In the case of a material incident, affected consumers and the Central Bank should be informed promptly of the incident, its implications and remedial measures taken. Communication to the public should be in plain language. Name of Institution: Period of Assessment: Name of Chief Executive Officer / Designate: Designation: Signature: Date: ALL ASSESSMENTS MUST BE SUBMITTED VIA EMAIL TO cyberguides@central-bank.org.tt