Technology Assurance Programme
- Ensure that scheduled and ad-hoc control assurance activities are undertaken to determine design and operating effectiveness of technology key controls and to identify any control deficiencies.
Compliance with Policies and Standards
- Ensure that regular internal and external reviews to assess levels of compliance are performed.
Framework Alignment with Regulation and Legislation
- Ensure that all regulations and legislations required by the Prudential Authority and other regulatory institutions are aligned on regular basis.
Technology Policy Framework
- Ensure that an information security management system (ISMS) that provides a standard, formal and continuous approach to security and privacy management for information is established.
Information Risk Assessment
- Ensure that RCSA is performed on a semi-annual basis.
Risk Management Metrics
- Ensure that monitoring of key goals and metrics of risk governance and management processes are in place.
Security Governance Framework
- Ensure that security governance framework is operating effectively.
Control Deficiencies
- Ensure that there's a systematic approach to identify and understand Control Deficiencies.
Control Templates
- Ensure that Control Templates are reviewed annually following ownership changes, process changes, and/or control failures or incidents
Recertification & Transfers
- Ensure that authorized users are reviewed on a semi-annually basis.