Back

Include any consequences to organizational reputation and confidence due to the incident in the incident response report.


CONTROL ID
12728
CONTROL TYPE
Establish/Maintain Documentation
CLASSIFICATION
Preventive

SUPPORTING AND SUPPORTED CONTROLS



This Control directly supports the implied Control(s):
  • Create an incident response report following an incident response., CC ID: 12700

There are no implementation support Controls.


SELECTED AUTHORITY DOCUMENTS COMPLIED WITH



  • Magnitude of the incident including foregone revenue, losses, costs, investments, number of customers affected, implications, consequences to reputation and confidence; and (ยง 7.3.12.b.ii., Monetary Authority of Singapore: Technology Risk Management Guidelines)
  • The potential reputational impact on the institution based on the criticality of the banking service or operational activity affected (e.g. theft of customer data); the external profile/visibility of the ICT systems and services affected (e.g. mobile or on-line banking systems, point of sale, ATMs o… (Title 3 3.2.3 43.c, Final Report Guidelines on ICT Risk Assessment under the Supervisory Review and Evaluation process (SREP))
  • the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact; (Art. 18.1.(a), Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance))
  • Actionable and effective mitigation techniques are taken and communicated appropriately to restore and improve the organization's reputation after an incident. (RC.CO-2.1, CRI Profile, v1.2)
  • Actionable and effective mitigation techniques are taken and communicated appropriately to restore and improve the organization's reputation after an incident. (RC.CO-2.1, Financial Services Sector Cybersecurity Profile, Version 1.0.0)
  • Employ measures to repair the reputation of the organization. (IR-4(15)(b), Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5)
  • Employ measures to repair the reputation of the organization. (IR-4(15)(b), Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5.1.1)