Response mechanism and governance

Roles & responsibilities for escalation

Automated risk dashboards

Thresholds for escalation

To provide qualitative assessments of risk

To serve as early warning metrics for material risks

To replace all manual risk reporting processes

To communicate risk only to regulators

Strengthen ‘risk based’ decision making

Enable integrated risk response mechanism

Continuous Monitoring & Review

Proactive Risk

To automate all risk escalation processes

To ensure only internal stakeholders receive risk information

To drive governance and quality standards for reporting frequency and content

To eliminate the need for external regulatory reporting

Transparency and Communication; Regular team meetings

Proactive Risk; Regular updates to cybersecurity protocols

Reporting Framework; Standardized templates

Continuous Monitoring & Review; Market trend analysis

ATM Maintenance Vendor

Payment Processor

KYC Verification Agency

Bank Customer

To reduce the cost of banking operations

To eliminate all external vendors

To increase the number of vendors

To analyze and control risks from outsourcing to third parties

Performing background checks on vendor staff

Ignoring vendor activities

Allowing vendors to bypass security checks

Not monitoring vendor access

They can autonomously scan networks, identify vulnerabilities, and execute attacks

They require large teams of human hackers

They are limited to phishing emails

They are only used for defensive purposes

Discretionary Access Control (DAC)

Mandatory Access Control (MAC)

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)