ADGM Information Technology Risk Management Guidance (VER01.201124)

TABLE OF CONTENTS

Introduction... 1 Background... 1 Structure of the Guidance... 2 Applicability... 7 Building Effective Control Environments... 8 Section A: Establishing a Culture of Effective IT Risk Management ... 10 Chapter 1 – Governance and Oversight... 10 Desired Outcome 1.1 – Strategy Alignment ... 10 Desired Outcome 1.2 – Competence ... 10 Desired Outcome 1.3 – Accountability... 11 Chapter 2 – Risk Management... 13 Desired Outcome 2.1 – Risk Awareness ... 13 Desired Outcome 2.2 – Risk Awareness Training ... 14 Desired Outcome 2.3 –Risk Assessment Framework ... 15 Desired Outcome 2.4 – Risk Monitoring ... 18 Desired Outcome 2.5 – Incident Management... 19 Desired Outcome 2.6 – Problem Management... 22 Desired Outcome 2.7 – Insider Risk ... 22 Chapter 3 – Third Party Management ... 23 Desired Outcome 3.1 – Third Party Risk Governance... 23 Desired Outcome 3.2 – IT Third Party Lifecycle Management... 25 Desired Outcome 3.3 – Supply Chain Resilience ... 28 Chapter 4 – Compliance and Audit ... 30 Desired Outcome 4.1 – Comply... 30 Desired Outcome 4.2 – Audit ... 30 Section B: Managing an IT Environment... 32 Ch...