Upravljanje rizicima informacijske tehnologije u uslugama osiguranja

professional thesis

• Title (english): Information technology risk management in insurance services
• Author: Tina Mazalin
• Mentor: Marin Vuković (mentor)
• Committee member: Miljenko Mikuc (predsjednik povjerenstva)
• Committee member: Marin Vuković (član povjerenstva)
• Committee member: Krešimir Grgić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Telecommunications); Zagreb
• Defense date and country: 2023-02-06, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing
• Scientific / art field, discipline and subdiscipline: SOCIAL SCIENCES; Economics

Abstract

Povodom novih pravnih zahtjeva u području mrežnih i informacijskih sustava u svrhu osiguravanja visoke razine digitalne operativne otpornosti za financijski sektor na razini Europske unije, cilj rada je analiza regulatornog okvira za postizanje kibersigurnosti u financijskom sektoru. Posebno se analiziraju sigurnosni zahtjevi za uspostavu okvira upravljanja rizicima informacijsko komunikacijskih tehnologija, mjera za zaštitu, sprječavanje, otkrivanje i upravljanje incidentima, posebne obveze u svezi testiranja digitalne operativne otpornosti, izrada planova za odgovor i oporavak nakon incidenta, mjere za upravljanje rizicima informacijsko komunikacijskih tehnologija trećih strana i obveze financijskih subjekata u odnosu na razmjenu informacija o incidentima s nadležnim tijelima sukladno novom regulatornom okviru. Budući da nadzorna tijela sektorskim zakonodavnim aktima već propisuju određene nužne zahtjeve za upravljanje u području informacijskih i komunikacijskih tehnologija, novi regulatorni okvir trebao bi se temeljiti na već uspostavljenim okvirima kibersigurnosti financijskih institucija i dodatno pridonijeti harmonizaciji pravila o digitalnoj operativnoj otpornosti država članica.

Abstract (english)

Given the new regulatory requirements for the security of network and information systems, the aim of which is to ensure a high level of digital operational resilience for the financial sector at the level of the European Union, this paper is to analyze the regulatory framework on cybersecurity applicable in the financial sector. This analysis includes the security requirements in regard with risk management framework for information and communication technologies, measures for protection, prevention, detection and management of incidents, specific obligations regarding digital operational resilience testing, response and recovery plans after an incident, oversight framework of critical ICT third-party service providers, and obligations on reporting of ICT incidents in accordance with new regulatory framework. Since some financial entities already do have respective sector specific legislation on information and communication technology security and governance, further improvements within financial entities should be based on the already established security frameworks and additionally contribute to the harmonization of rules on digital operational resilience among different member states.

• Keywords: informacijska sigurnost; NIS2; DORA; rizik; kiberincident; regulatorno; osiguranje; informacijske tehnologije
• Keywords (english): information security; NIS2; DORA; risk; cyberincident; regulatory; insurance; information technology
• Language: croatian
• URN:NBN: urn:nbn:hr:168:876387
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2023-03-31 08:17:30