IT Risk Management for Banks: DORA-Compliant & Future-Proof

IT risks manifest as a product of threats, vulnerabilities, and potential impacts on a company's information technology. They can be classified along various dimensions:

🔍 Classification according to BSI:

📊 Classification by risk type:

⚠ ️ Classification by impact:

🌐 Current threat landscape:

IT risk assessment uses a combination of qualitative and quantitative methods, applied differently depending on company size and industry:

📋 Qualitative methods:

🔢 Quantitative methods:

🔄 Hybrid approaches:

📊 Industry-specific benchmarks:

Regulatory requirements for IT risk management have increased significantly in recent years and encompass both national and international provisions:

🇪

🇺 EU regulations: **NIS 2 Directive**: Extends the scope to more sectors and sets higher cybersecurity requirements - Obligates approximately 29,

500 companies in Germany from

2025

32 requires appropriate technical and organisational measures

🇩

🇪 German regulations: **IT Security Act 2.0**: - Extended requirements for KRITIS operators - Registration obligation for KRITIS operators with the BSI - Reporting obligations for IT security incidents **KRITIS Regulation (BSI-KritisV)**: - Defines sector-specific security levels for

9 KRITIS sectors -.

Developing an effective IT risk management framework requires a structured approach that integrates technical, organisational, and process-related aspects: Core components: **Governance structure**:

**

**

**

IT security standards and frameworks provide structured approaches for managing IT risks and implementing security measures: International standards: **ISO/IEC 27001**:

114 controls across

14 control domains (Annex A)

🇺

🇸 NIST Cybersecurity Framework: **Five core functions**: - Identify: Identification of assets, risks, and requirements - Protect: Implementation of protective measures - Detect: Detection of security incidents - Respond: Response to security incidents - Recover: Recovery after security incidents **Implementation tiers**: Tier

1 (Partial) to Tier

4 (Adaptive) **Flexible adaptation

** to various organisational sizes and types COBIT (Control Objectives for Information and Related Technologies): **Governance framework

** for.

The Zero Trust security model is based on the principle of "Never trust, always verify" and requires a comprehensive redesign of the IT security architecture: Core principles of the Zero Trust model: **No implicit trust**: No trust in devices or users, regardless of location **Continuous verification**: Constant checking of identity and permissions **Least privilege access**: Minimal access rights for task fulfilment **Micro-segmentation**: Fine-grained network segmentation **Comprehensive monitoring**: Continuous monitoring of all activities Implementation steps: **Phase 1: Inventory and planning

**

**

**

AI and machine learning are transforming IT risk management through effective applications that improve efficiency, precision, and responsiveness: Application areas: **Threat detection**:

Cyber resilience tests are essential for assessing and improving an organisation's resistance to cyberattacks: Types of cyber resilience tests: **Penetration tests**:

A Security Operations Center (SOC) is the nerve centre of IT security monitoring and response within an organisation: Core components of a SOC: **People**:

Vulnerability management is a systematic process for identifying, assessing, prioritising, and remediating security vulnerabilities in IT systems: Vulnerability management lifecycle: **Asset discovery and inventory**:

Effective incident response management enables organisations to detect, contain, and remediate security incidents quickly: Incident response lifecycle: **Preparation**:

Germany has a complex regulatory environment for IT risk management that encompasses both national and EU-wide requirements:

🇩

🇪 German regulations: **IT Security Act 2.0**: - Extended requirements for KRITIS operators (critical infrastructures) - Registration obligation for KRITIS operators with the BSI - Reporting obligations for IT security incidents within defined time windows - Sanctions for non-compliance of up to €

2 million **KRITIS Regulation (BSI-KritisV)**:

9 KRITIS sectors

** (German Implementation Act for NIS2):

🇪

🇺 EU regulations with impact on Germany: **NIS 2 Directive**: - Extends the scope to more sectors (approx. 29,

500 companies in Germany)

The sector-specific security standards (B3S) are a central element of the IT Security Act for operators of critical infrastructures (KRITIS) in Germany: Foundations and legal framework: **Definition**: B3S are security standards developed by industry associations and recognised by the BSI **Legal basis**: IT Security Act and BSI-KritisV (KRITIS Regulation) **Objective**: Concretisation of the abstract statutory requirements for IT security **Scope**:

9 KRITIS sectors, each with their own B3S

A modern technical reference architecture for IT risk management integrates various technologies and processes into a comprehensive system: Architecture components: **Threat intelligence integration**:

Effective IT risk management requires measurable metrics that cover both operational and strategic aspects: Risk exposure metrics: **Vulnerability exposure**:

* Benchmark: Median value of

23 days in DACH vs.

17 days globally

* Target: <

14 days for critical vulnerabilities

* Benchmark: 0.8 critical vulnerabilities per server (average)

* Target: <0.5 critical vulnerabilities per server

* Benchmark:

45 days for medium-severity vulnerabilities

* Target: <

30 days for medium-severity, <

7 days for critical vulnerabilities **Risk assessment**:

* Benchmark: Median value of €1.2 million p.a. for German mid-sized companies

* Calculation: Single Loss Expectancy × Annual Rate of Occurrence

* Benchmark: 3.5:

1 for preventive measures

* Calculation: (Avoided costs

Successful IT risk management implementations can be analysed using concrete case studies from various industries: Manufacturing company (IoT/OT security): **Initial situation**: -

58 unsecured IIoT devices in production networks

142 19 within

6 months

3 years through avoided production outages Klinikverbund Oberbayern (ransomware resilience): **Incident**: Ransomware attack led to a 72-hour outage of the patient database **Post-incident measures**: -.

External Attack Surface Management (EASM) is a systematic approach to identifying, analysing, and securing all externally accessible digital assets of an organisation: Core concept and significance: **Definition**: EASM encompasses the continuous discovery, inventory, classification, and monitoring of all external digital assets and attack surfaces **Relevance**: 73% of successful cyberattacks exploit external vulnerabilities that are often unknown to the organisations **Distinction**: Unlike traditional vulnerability scans, EASM also captures unknown or forgotten assets (shadow IT) **Scope**: Websites, APIs, cloud resources, IoT devices, domains, IP ranges, external services, and third-party components Components of an EASM programme: **Asset discovery**:

Future-proof IT risk management requires strategic measures that integrate technological, organisational, and regulatory aspects: Regulatory alignment: **NIS 2 compliance strategy**:

Successfully integrating IT risk management into corporate culture requires a comprehensive approach that goes beyond technical measures: Leadership and governance: **Tone from the top**: