Regulatory Alerts2024-05-09
Added · Updated
Notice on Technology Risk Management for Licensed Trust Companies
Licensed trust companies must establish a framework to identify critical systems and maintain high availability, ensuring maximum unscheduled downtime does not exceed 4 hours in any 12-month period. These entities are required to set a recovery time objective of no more than 4 hours for each critical system and validate this through annual testing. Upon discovering a relevant incident, trust companies must notify the Authority within one hour and submit a root cause and impact analysis report within 14 days. Additionally, they must implement IT controls to protect protected party information from unauthorized access or disclosure.
Topics
Share