Penetration testing
Penetration tests allow us to demonstrate the client's state of vulnerability to IT threats by simulating cyber attacks against an organisation's IT environment.
MFSA: Guidance on IT related arrangements
On 11 December 2020, The MFSA issued a guidance document to all licensed entities entitled ‘Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements'. The Guidance covers the implementation of Technology Arrangements and ICT and emphasises the fact that technology has become a fundamental asset to the financial services industry, as a result of which Licence Holders are increasingly reliant on technology to perform business and operational functions
Whereas technological arrangements deliver cutting-edge benefits to both financial services firms and their customers, it is also true that these introduce new risks to licence holders, ranging from ICT governance risks to cybersecurity risks and IT outsourcing risks.
The Guidance establishes a number of risk mitigation factors emanating from increased reliance on technological arrangements, that need to be adequately mitigated. This includes the establishment of a comprehensive ICT governance framework. The MFSA Guidance also includes extensive guidance on the outsourcing of IT to third parties.
Pillars of information assurance
The Guidance is principled-based and does not favour one type of technology or service model over another, as long as the compliance obligations can be met. The principle-based approach also applies to ICT risk, security governance, and control frameworks. Significantly, the Guidance allows for the principle of proportionality. As a result, mitigating controls and governance arrangements should take into consideration the nature, scale, and complexity of the technology arrangements, the risks arising thereof, as well as the level of dependence on such technology arrangements for the implementation of critical or important functions. All licensed entities are mandated to ensure compliance with the principles.
What do you need to know?
- Familiarize yourself with the MFSA guidance document and how this may impact your firm
- Consider setting up a team/task force, including your IT team, to take a systematic approach to ensure compliance with the Guidance. Engage external expertise if required
- Understand the categories of data your firm processes, the medium through which they are processed, and where and how they are stored
- Perform an ICT risk assessment that is commensurate to the nature, scale, and complexity of the firm. When defining the frequency, depth, detail, and intensity of ICT risk assessment, these should proportionate to the size, structure, and operational environment of the firm
- Draw up a gap analysis between the current ICT practices within your firm and the MFSA guidelines requirements
- Establish what remedial actions required in order to ensure compliance with the MFSA Guidance
- Establish a framework to ensure that IT risk is effectively and efficiently managed in an on-going manner
- Take reasonable measures to be in a position to demonstrate that your entity complies with the MFSA guidance document
How can Mazars assist?
Mazars in Malta can guide and assist you through the different phases of this journey by working closely with you and your team. Our areas of assistance include the following:
- Provide assurance on your firm’s compliance with the MFSA Guidance document.
- Identification of risks through an IT risk assessment, taking into consideration the size and complexity of your entity, including data sensitivity.
- Draw up and/or assist in the implementation of a scalable remediation plan tailor-made for your firm.
- Assist in the setting up and/or review of an ICT governance framework.
- Assist with IT business continuity planning.
- Assistance in setting up Security Incident and Event Management platforms.
- Vulnerability assessments and penetration testing.
- Provide cyber security training tailor-made to Board level members, Management level (including c-level management), executive members, and support staff.
- Assist established internal audit functions to conduct IT Audit and cyber security services.
- Assistance in setting up Computer Incident Response Teams and incident handling procedures.
We are offering interested persons a free consultation session (approx. 1 hr) in order to facilitate an understanding of the main principles set out in the Guidance document and how these may be related to your firm.
In order to obtain more information or to book a free consultation session, do not hesitate to contact us.
IT Risk Assessment
The IT Risk Assessment will cut across all significant areas of the IT environment and will include a full Internal Procedures Review.
Cyber Security Officer (CSO)
Outsourcing your cyber security compliance is the ideal starting point for small to medium organisation in their journey to effectively manage both cyber security risks and compliance risks, as it allows the business to continue focusing on the business' core competencies.
Vulnerability assessment
Vulnerability assessments are in-depth, technical review of a client's IT environment using industry-developed best practices, methodologies and technical tools.
Training
Often cited as the weakest link and the easiest way through the back door, organisations are up of people - the human firewall.
Want to know more?
Alan Craig Advisory Partner - Birkirkara
Ramon Cutajar Advisory Director - Birkirkara
Cyber security
Our cyber security service offering is based on industry-developed best practices to provide an up-to-date assessment of your organization’s cyber security status, ensuring that risks and threats to the IT environment are routinely mitigated. Build technological resilience so you can operate with confidence.