ICT security testing

Organization has a process for regulalry conducting threat-led penetration testing (TLPT).

TLPT process fills the following requirements:

1. Frequency: Financial entities are required to conduct advanced TLPT by default every three years.
2. Scope: Each TLPT must cover several or all critical or important functions of the entity and must be conducted on live production systems that support these functions.
3. Inclusion of third-party ICT providers: If critical functions are outsourced to third-party ICT service providers, these providers must be included in the TLPT.
4. Vulnerability mitigation: Entities must (in collaboration with third-party providers and testers) apply effective risk management controls to mitigate potential impacts on data, assets, and operations.
5. Test reporting: Upon completing the testing, entities must provide a summary of findings and remediation plans to the designated authority.
6. Tester requirements: Entities must engage testers as specified in the regulations, using external testers periodically (every three tests) unless classified as significant, in which case only external testers must be used.

The organization conducts internal audits in accordance with its internal audit procedure. The aim is to check:

• whether the information security management system complies with the organisation's cyber security requirements
• whether the information security management system complies with other operational security requirements or standards complied with
• whether the information security management system is implemented effectively

Documented information on the execution and results of audits must be kept.

The organization has established a procedure for conducting internal audits. The procedure shall describe at least:

• how often audits are carried out
• who may carry out the audits (including audit criteria)
• how the actual audit is carried out
• how audit results are documented and to whom the results are reported
• results should be reported to a competent authority if it's law regulated

Test security functions that are affected by changes to ICT systems both before and after deployment in order to maintain secure state. It is important to ensure that security functions are tested because changes to ICT systems can often create new vulnerabilities.

The organization shall continuously strive to improve the performance of the information security management system. Ways to improve are being actively sought - not just through audits or clear non-conformities.

Task owner is responsible for documenting the improvements made to the management system and dividing them into tasks to be performed, monitoring task execution and assessing the reached effects.

Organization carries out threat intelligence by analyzing and utilizing collected information about relevant cyber security threats related and corresponding protections.

When analyzing and utilizing the collected threat intelligence information, the following points must be taken into account:

• analyzing how the threat intelligence information relates to to our own operations
• analyzing how relevant threat intelligence information is to our operations
• communicating and sharing information in an understandable form to relevant persons
• utilizing the findings of threat intelligence to determine the adequacy of technical protections, technologies used and information security testing methods for analysis