ICT risk management
Domain 2 - ICT risk management. This domain tests Chapter II: whether you can design and operate an ICT risk management framework that is governed, documented, tested and proportionate.
Framework requirements
The framework must be sound, comprehensive, well documented and proportionate to the entity's exposure. It covers governance and organisation, strategy, policies, procedures, protocols and tools; ICT asset management and dependency mapping; protection and prevention; detection; response and recovery; learning and evolving; and communication. It must be reviewed at least annually, except for microenterprises, which may review less often. The management body approves it and is accountable for it.
Control themes
Expect questions on access control, encryption, patching, network segmentation, logging and monitoring, and the mapping of ICT assets and business functions. Detection mechanisms must identify anomalous activity, including network performance issues and unauthorised access. Business continuity and disaster recovery must be tested; backups must be segregated and restoration tested. Post-incident reviews feed corrective action.
Worked example
A bank's board delegates ICT risk to the CIO and approves the framework once at launch. An examiner finds no annual review and no board-approved risk appetite. The breach is governance, not technology: accountability remains with the management body, and the framework must be reviewed at least annually. A vendor's ISO 27001 certificate does not cure the absence of the bank's own framework.
Traps
Confusing RTO (time to restore) with RPO (acceptable data loss); assuming cloud-hosted systems fall outside the framework; treating microenterprise relief as a full exemption; and producing policies without evidence of testing or board review.