Asset Managers Must Further Strengthen IT Recovery
Financial institutions are becoming increasingly dependent on digital systems. At the same time, the risks of disruptions are rising due to cyberattacks, geopolitical tensions, and the growing complexity of IT landscapes. A rapid and effective recovery of IT systems is essential to maintaining service availability for clients. The Netherlands Authority for the Financial Markets has examined the extent to which asset managers are prepared for a major IT outage. The study shows that the fundamentals are in place, but also that further improvements are possible.
Short
• Growing digital risks call for effective IT recovery
• The basics are in place, but further improvement is needed
• Four key areas help institutions further strengthen their IT recovery
Growing digital risks call for effective IT Recovery
Financial institutions rely heavily on IT to provide their services. At the same time, risks are increasing due to cyberattacks, geopolitical developments, and new applications of artificial intelligence. The ability to quickly restore systems, data, and processes following a disruption is therefore a key component of digital resilience.DORA sets requirements for financial institutions, including asset managers, to strengthen their digital resilience. This includes the ability to restore critical services in a timely manner following a disruption. Against this backdrop, the AFM has examined how large institutional asset managers have structured their IT recovery plans.
Basics in place, further improvement needed
The study shows that, in general, the asset managers surveyed are well prepared for IT outages. The key processes, plans, and testing programs are in place.At the same time, the AFM sees room for further improvement. There is not always a clear connection between critical functions, recovery objectives, dependencies on IT service providers, and the way in which recovery is tested. It is precisely this connection that is important for ensuring that services can be restored quickly, even in the event of serious disruptions.
Four key areas to further strengthen IT Recovery
The study identifies four key areas through which asset managers can further strengthen their IT recovery.1. Consistent classification of critical functions
A clear and consistent classification of critical functions forms the foundation for effective IT recovery. Different definitions or classifications within an organization can
result in recovery measures that do not always align with the functions that are most important for service delivery.
2. Establishing recovery objectives for critical functions
Recovery objectives are often established for systems or applications. Establishing them for critical functions as well provides a clearer picture of what is needed to restore service in a timely manner following a disruption.
3. Include recovery requirements in agreements with IT service providers
Many asset managers rely on external IT service providers. Therefore, it is important that agreements with suppliers align with the institution’s recovery objectives. This better ensures that external parties can contribute to the desired level of recovery.
4. Testing with various extreme scenarios
Regular testing helps determine whether recovery measures work in practice. It is important to use a variety of scenarios, including severe disruptions such as cyberattacks, prolonged system outages, or issues with an external IT service provider.
Contact for this article
Would you like to receive the latest news from AFM?
Subscribe to our newsletter, we will keep you up-to-date.