The AMF cybersecurity guideline: where to start

The Autorité des marchés financiers (AMF) published its Guideline on Information and Communications Technology Risk Management (ICT) in February 2020. According to the AMF, it aims to ensure that financial institutions put in place hygiene and security measures to prevent major incidents from occurring and to limit their impacts (AMF page). The AMF presents it to deposit institutions and trust companies as well as to insurers (Insurers page). Here is how Groupe Conseil GRD suggests approaching it.

What the AMF means by ICT risk

The guideline defines ICT risk as the business risk related to the use, ownership, operation and adoption of ICT. It includes availability and continuity, security (including cybersecurity), change, data integrity and outsourcing risks (AMF PDF). The AMF expected implementation by February 27, 2021.

Step 1: an ICT risk taxonomy

The first expectation is an institution-specific taxonomy listing all types of ICT risk. Categories to consider include information security, crisis management, outsourcing and cloud, business continuity, change management and ICT operations. Risks should be aggregated at the institution level (AMF PDF).

Step 2: governance and roles

The AMF expects ICT governance based on recognized sources, citing the OECD, G7, NIST, ISACA-Cobit and ISO as examples. The board should ensure that a person is assigned responsibility for IT and that an information security lead sits in the second line of defence. Senior management should issue an information security policy, deploy controls proportionate to asset criticality and provide security training (AMF PDF).

Step 3: preparation, treatment and follow-up

ICT risk management is organized in three parts (AMF PDF):

• Preparation: periodic inventory of information assets and their vulnerabilities, a classification framework based on availability, integrity and confidentiality, business impact analyses and backup testing.
• Treatment: continuous detection of abnormal activity, response to disclosed vulnerabilities, replacement plans for hardware and software before end of support, and an ICT risk register.
• Follow-up: mechanisms to promptly notify internal and external stakeholders, including the AMF, of an operational incident, followed by analysis and lessons learned after a major incident.

Step 4: the appendix of practices

The appendix lists complementary practices: identity and access management, logging (firewalls, applications, systems, authentication), the "need to know", "least privilege" and "segregation of duties" principles, limits on generic or shared accounts, and penetration tests and Red Team exercises. For cloud, the AMF mentions a contractual right to audit, data encryption and exit strategies (AMF PDF).

Our advice to get started

We suggest starting with a baseline: an asset inventory, an ICT risk register and a review of access controls. These three items touch all three parts of the guideline and support the rest. The guideline states that each institution applies it according to its nature, size, complexity and risk profile.

Demander une soumission / Request a quote: info@grdinc.ca