无码中字出轨中文人妻中文中,少妇夜夜春夜夜爽试看视频,久欠精品国国产99国产精2021

第一篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

第一章總則

第一條為加強(qiáng)商業(yè)銀行信息科技風(fēng)險(xiǎn)管理，根據(jù)《中華人民共和國(guó)銀行業(yè)監(jiān)督管理法》、《中華人民共和國(guó)商業(yè)銀行法》、《中華人民共和國(guó)外資銀行管理?xiàng)l例》，以及國(guó)家信息安全相關(guān)要求和有關(guān)法律法規(guī)，制定本指引。

第二條本指引適用于在中華人民共和國(guó)境內(nèi)依法設(shè)立的法人商業(yè)銀行。

政策性銀行、農(nóng)村合作銀行、城市信用社、農(nóng)村信用社、村鎮(zhèn)銀行、貸款公司、金融資產(chǎn)管理公司、信托公司、財(cái)務(wù)公司、金融租賃公司、汽車(chē)金融公司、貨幣經(jīng)紀(jì)公司等其他銀行業(yè)金融機(jī)構(gòu)參照?qǐng)?zhí)行。

第四條本指引所稱(chēng)信息科技風(fēng)險(xiǎn)，是指信息科技在商業(yè)銀行運(yùn)用過(guò)程中，由于自然因素、人為因素、技術(shù)漏洞和管理缺陷產(chǎn)生的操作、法律和聲譽(yù)等風(fēng)險(xiǎn)。

第五條信息科技風(fēng)險(xiǎn)管理的目標(biāo)是通過(guò)建立有效的機(jī)制，實(shí)現(xiàn)對(duì)商業(yè)銀行信息科技風(fēng)險(xiǎn)的識(shí)別、計(jì)量、監(jiān)測(cè)和控制，促進(jìn)商業(yè)銀行安全、持續(xù)、穩(wěn)健運(yùn)行，推動(dòng)業(yè)務(wù)創(chuàng)新，提高信息技術(shù)使用水平，增強(qiáng)核心競(jìng)爭(zhēng)力和可持續(xù)發(fā)展能力。

第二章信息科技治理

第六條商業(yè)銀行法定代表人是本機(jī)構(gòu)信息科技風(fēng)險(xiǎn)管理的第一責(zé)任人，負(fù)責(zé)組織本指引的貫徹落實(shí)。

第七條商業(yè)銀行的董事會(huì)應(yīng)履行以下信息科技管理職責(zé)：

（一）遵守并貫徹執(zhí)行國(guó)家有關(guān)信息科技管理的法律、法規(guī)和技術(shù)標(biāo)準(zhǔn)，落實(shí)中國(guó)銀行業(yè)監(jiān)督管理委員會(huì)（以下簡(jiǎn)稱(chēng)銀監(jiān)會(huì)）相關(guān)監(jiān)管要求。

（二）審查批準(zhǔn)信息科技戰(zhàn)略，確保其與銀行的總體業(yè)務(wù)戰(zhàn)略和重大策略相一致。評(píng)估信息科技及其風(fēng)險(xiǎn)管理工作的總體效果和效率。

（三）掌握主要的信息科技風(fēng)險(xiǎn)，確定可接受的風(fēng)險(xiǎn)級(jí)別，確保相關(guān)風(fēng)險(xiǎn)能夠被識(shí)別、計(jì)量、監(jiān)測(cè)和控制。

（四）規(guī)范職業(yè)道德行為和廉潔標(biāo)準(zhǔn)，增強(qiáng)內(nèi)部文化建設(shè)，提高全體人員對(duì)信息科技風(fēng)險(xiǎn)管理重要性的認(rèn)識(shí)。

（五）設(shè)立一個(gè)由來(lái)自高級(jí)管理層、信息科技部門(mén)和主要業(yè)務(wù)部門(mén)的代表組成的專(zhuān)門(mén)信息科技管理委員會(huì)，負(fù)責(zé)監(jiān)督各項(xiàng)職責(zé)的落實(shí)，定期向董事會(huì)和高級(jí)管理層匯報(bào)信息科技戰(zhàn)略規(guī)劃的執(zhí)行、信息科技預(yù)算和實(shí)際支出、信息科技的整體狀況。

（六）在建立良好的公司治理的基礎(chǔ)上進(jìn)行信息科技治理，形成分工合理、職責(zé)明確、相互制衡、報(bào)告關(guān)系清晰的信息科技治理組織結(jié)構(gòu)。加強(qiáng)信息科技專(zhuān)業(yè)隊(duì)伍的建設(shè)，建立人才激勵(lì)機(jī)制。

（七）確保內(nèi)部審計(jì)部門(mén)進(jìn)行獨(dú)立有效的信息科技風(fēng)險(xiǎn)管理審計(jì)，對(duì)審計(jì)報(bào)告進(jìn)行確認(rèn)并落實(shí)整改。

（八）每年審閱并向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)送信息科技風(fēng)險(xiǎn)管理的年度報(bào)告。

（九）確保信息科技風(fēng)險(xiǎn)管理工作所需資金。

（十）確保銀行所有員工充分理解和遵守經(jīng)其批準(zhǔn)的信息科技風(fēng)險(xiǎn)管理制度和流程，并安排相關(guān)培訓(xùn)。

（十一）確保本法人機(jī)構(gòu)涉及客戶信息、賬務(wù)信息以及產(chǎn)品信息等的核心系統(tǒng)在中國(guó)境內(nèi)獨(dú)立運(yùn)行，并保持最高的管理權(quán)限，符合銀監(jiān)會(huì)監(jiān)管和實(shí)施現(xiàn)場(chǎng)檢查的要求，防范跨境風(fēng)險(xiǎn)。

（十二）及時(shí)向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)告本機(jī)構(gòu)發(fā)生的重大信息科技事故或突發(fā)事件，按相關(guān)預(yù)案快速響應(yīng)。

（十三）配合銀監(jiān)會(huì)及其派出機(jī)構(gòu)做好信息科技風(fēng)險(xiǎn)監(jiān)督檢查工作，并按照監(jiān)管意見(jiàn)進(jìn)行整改。

（十四）履行信息科技風(fēng)險(xiǎn)管理其他相關(guān)工作。 第八條商業(yè)銀行應(yīng)設(shè)立首席信息官，直接向行長(zhǎng)匯報(bào)，并參與決策。首席信息官的職責(zé)包括：

（一）直接參與本銀行與信息科技運(yùn)用有關(guān)的業(yè)務(wù)發(fā)展決策。

（二）確保信息科技戰(zhàn)略，尤其是信息系統(tǒng)開(kāi)發(fā)戰(zhàn)略，符合本銀行的總體業(yè)務(wù)戰(zhàn)略和信息科技風(fēng)險(xiǎn)管理策略。

（三）負(fù)責(zé)建立一個(gè)切實(shí)有效的信息科技部門(mén)，承擔(dān)本銀行的信息科技職責(zé)。確保其履行：信息科技預(yù)算和支出、信息科技策略、標(biāo)準(zhǔn)和流程、信息科技內(nèi)部控制、專(zhuān)業(yè)化研發(fā)、信息科技項(xiàng)目發(fā)起和管理、信息系統(tǒng)和信息科技基礎(chǔ)設(shè)施的運(yùn)行、維護(hù)和升級(jí)、信息安全管理、災(zāi)難恢復(fù)計(jì)劃、信息科技外包和信息系統(tǒng)退出等職責(zé)。

（四）確保信息科技風(fēng)險(xiǎn)管理的有效性，并使有關(guān)管理措施落實(shí)到相關(guān)的每一個(gè)內(nèi)設(shè)機(jī)構(gòu)和分支機(jī)構(gòu)。

（五）組織專(zhuān)業(yè)培訓(xùn)，提高人才隊(duì)伍的專(zhuān)業(yè)技能。

（六）履行信息科技風(fēng)險(xiǎn)管理其他相關(guān)工作。

第九條商業(yè)銀行應(yīng)對(duì)信息科技部門(mén)內(nèi)部管理職責(zé)進(jìn)行明確的界定；各崗位的人員應(yīng)具有相應(yīng)的專(zhuān)業(yè)知識(shí)和技能，重要崗位應(yīng)制定詳細(xì)完整的工作手冊(cè)并適時(shí)更新。對(duì)相關(guān)人員應(yīng)采取下列風(fēng)險(xiǎn)防范措施：

（一）驗(yàn)證個(gè)人信息，包括核驗(yàn)有效身份證件、學(xué)歷證明、工作經(jīng)歷和專(zhuān)業(yè)資格證書(shū)等信息。

（二）審核信息科技員工的道德品行，確保其具備相應(yīng)的職業(yè)操守。

（三）確保員工了解、遵守信息科技策略、指導(dǎo)原則、信息保密、授權(quán)使用信息系統(tǒng)、信息科技管理制度和流程等要求，并同員工簽訂相關(guān)協(xié)議。

（四）評(píng)估關(guān)鍵崗位信息科技員工流失帶來(lái)的風(fēng)險(xiǎn)，做好安排候補(bǔ)員工和崗位接替計(jì)劃等防范措施；在員工崗位發(fā)生變化后及時(shí)變更相關(guān)信息。 第十條商業(yè)銀行應(yīng)設(shè)立或指派一個(gè)特定部門(mén)負(fù)責(zé)信息科技風(fēng)險(xiǎn)管理工作，并直接向首席信息官或首席風(fēng)險(xiǎn)官（風(fēng)險(xiǎn)管理委員會(huì)）報(bào)告工作。該部門(mén)應(yīng)為信息科技突發(fā)事件應(yīng)急響應(yīng)小組的成員之一，負(fù)責(zé)協(xié)調(diào)制定有關(guān)信息科技風(fēng)險(xiǎn)管理策略，尤其是在涉及信息安全、業(yè)務(wù)連續(xù)性計(jì)劃和合規(guī)性風(fēng)險(xiǎn)等方面，為業(yè)務(wù)部門(mén)和信息科技部門(mén)提供建議及相關(guān)合規(guī)性信息，實(shí)施持續(xù)信息科技風(fēng)險(xiǎn)評(píng)估，跟蹤整改意見(jiàn)的落實(shí)，監(jiān)控信息安全威脅和不合規(guī)事件的發(fā)生。

第十一條商業(yè)銀行應(yīng)在內(nèi)部審計(jì)部門(mén)設(shè)立專(zhuān)門(mén)的信息科技風(fēng)險(xiǎn)審計(jì)崗位，負(fù)責(zé)信息科技審計(jì)制度和流程的實(shí)施，制訂和執(zhí)行信息科技審計(jì)計(jì)劃，對(duì)信息科技整個(gè)生命周期和重大事件等進(jìn)行審計(jì)。

第十二條商業(yè)銀行應(yīng)按照知識(shí)產(chǎn)權(quán)相關(guān)法律法規(guī)，制定本機(jī)構(gòu)信息科技知識(shí)產(chǎn)權(quán)保護(hù)策略和制度，并使所有員工充分理解并遵照?qǐng)?zhí)行。確保購(gòu)買(mǎi)和使用合法的軟硬件產(chǎn)品，禁止侵權(quán)盜版；采取有效措施保護(hù)本機(jī)構(gòu)自主知識(shí)產(chǎn)權(quán)。

第十三條商業(yè)銀行應(yīng)依據(jù)有關(guān)法律法規(guī)的要求，規(guī)范和及時(shí)披露信息科技風(fēng)險(xiǎn)狀況。

第三章信息科技風(fēng)險(xiǎn)管理

第十四條商業(yè)銀行應(yīng)制定符合銀行總體業(yè)務(wù)規(guī)劃的信息科技戰(zhàn)略、信息科技運(yùn)行計(jì)劃和信息科技風(fēng)險(xiǎn)評(píng)估計(jì)劃，確保配臵足夠人力、財(cái)力資源，維持穩(wěn)定、安全的信息科技環(huán)境。

第十五條商業(yè)銀行應(yīng)制定全面的信息科技風(fēng)險(xiǎn)管理策略，包括但不限于下述領(lǐng)域：

（一）信息分級(jí)與保護(hù)。

（二）信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)。

（三）信息科技運(yùn)行和維護(hù)。

（四）訪問(wèn)控制。

（五）物理安全。

（六）人員安全。

（七）業(yè)務(wù)連續(xù)性計(jì)劃與應(yīng)急處臵。 第十六條商業(yè)銀行應(yīng)制定持續(xù)的風(fēng)險(xiǎn)識(shí)別和評(píng)估流程，確定信息科技中存在隱患的區(qū)域，評(píng)價(jià)風(fēng)險(xiǎn)對(duì)其業(yè)務(wù)的潛在影響，對(duì)風(fēng)險(xiǎn)進(jìn)行排序，并確定風(fēng)險(xiǎn)防范措施及所需資源的優(yōu)先級(jí)別（包括外包供應(yīng)商、產(chǎn)品供應(yīng)商和服務(wù)商）。

第十七條商業(yè)銀行應(yīng)依據(jù)信息科技風(fēng)險(xiǎn)管理策略和風(fēng)險(xiǎn)評(píng)估結(jié)果，實(shí)施全面的風(fēng)險(xiǎn)防范措施。防范措施應(yīng)包括：

（一）制定明確的信息科技風(fēng)險(xiǎn)管理制度、技術(shù)標(biāo)準(zhǔn)和操作規(guī)程等，定期進(jìn)行更新和公示。

（二）確定潛在風(fēng)險(xiǎn)區(qū)域，并對(duì)這些區(qū)域進(jìn)行詳細(xì)和獨(dú)立的監(jiān)控，實(shí)現(xiàn)風(fēng)險(xiǎn)最小化。建立適當(dāng)?shù)目刂瓶蚣埽员阌跈z查和平衡風(fēng)險(xiǎn)；定義每個(gè)業(yè)務(wù)級(jí)別的控制內(nèi)容，包括：

1.最高權(quán)限用戶的審查。

2.控制對(duì)數(shù)據(jù)和系統(tǒng)的物理和邏輯訪問(wèn)。

3.訪問(wèn)授權(quán)以“必需知道”和“最小授權(quán)”為原則。 4.審批和授權(quán)。 5.驗(yàn)證和調(diào)節(jié)。 第十八條商業(yè)銀行應(yīng)建立持續(xù)的信息科技風(fēng)險(xiǎn)計(jì)量和監(jiān)測(cè)機(jī)制，其中應(yīng)包括：

（一）建立信息科技項(xiàng)目實(shí)施前及實(shí)施后的評(píng)價(jià)機(jī)制。

（二）建立定期檢查系統(tǒng)性能的程序和標(biāo)準(zhǔn)。

（三）建立信息科技服務(wù)投訴和事故處理的報(bào)告機(jī)制。

（四）建立內(nèi)部審計(jì)、外部審計(jì)和監(jiān)管發(fā)現(xiàn)問(wèn)題的整改處理機(jī)制。

（五）安排供應(yīng)商和業(yè)務(wù)部門(mén)對(duì)服務(wù)水平協(xié)議的完成情況進(jìn)行定期審查。

（六）定期評(píng)估新技術(shù)發(fā)展可能造成的影響和已使用軟件面臨的新威脅。

（七）定期進(jìn)行運(yùn)行環(huán)境下操作風(fēng)險(xiǎn)和管理控制的檢查。

（八）定期進(jìn)行信息科技外包項(xiàng)目的風(fēng)險(xiǎn)狀況評(píng)價(jià)。 第十九條中資商業(yè)銀行在境外設(shè)立的機(jī)構(gòu)及境內(nèi)的外資商業(yè)銀行，應(yīng)當(dāng)遵守境內(nèi)外監(jiān)管機(jī)構(gòu)關(guān)于信息科技風(fēng)險(xiǎn)管理的要求，并防范因監(jiān)管差異所造成的風(fēng)險(xiǎn)。

第四章信息安全

第二十條商業(yè)銀行信息科技部門(mén)負(fù)責(zé)建立和實(shí)施信息分類(lèi)和保護(hù)體系，商業(yè)銀行應(yīng)使所有員工都了解信息安全的重要性，并組織提供必要的培訓(xùn)，讓員工充分了解其職責(zé)范圍內(nèi)的信息保護(hù)流程。

第二十一條商業(yè)銀行信息科技部門(mén)應(yīng)落實(shí)信息安全管理職能。該職能應(yīng)包括建立信息安全計(jì)劃和保持長(zhǎng)效的管理機(jī)制，提高全體員工信息安全意識(shí)，就安全問(wèn)題向其他部門(mén)提供建議，并定期向信息科技管理委員會(huì)提交本銀行信息安全評(píng)估報(bào)告。信息安全管理機(jī)制應(yīng)包括信息安全標(biāo)準(zhǔn)、策略、實(shí)施計(jì)劃和持續(xù)維護(hù)計(jì)劃。

信息安全策略應(yīng)涉及以下領(lǐng)域：

（一）安全制度管理。

（二）信息安全組織管理。

（三）資產(chǎn)管理。

（四）人員安全管理。

（五）物理與環(huán)境安全管理。

（六）通信與運(yùn)營(yíng)管理。

（七）訪問(wèn)控制管理。

（八）系統(tǒng)開(kāi)發(fā)與維護(hù)管理。

（九）信息安全事故管理。

（十）業(yè)務(wù)連續(xù)性管理。

（十一）合規(guī)性管理。

第二十二條商業(yè)銀行應(yīng)建立有效管理用戶認(rèn)證和訪問(wèn)控制的流程。用戶對(duì)數(shù)據(jù)和系統(tǒng)的訪問(wèn)必須選擇與信息訪問(wèn)級(jí)別相匹配的認(rèn)證機(jī)制，并且確保其在信息系統(tǒng)內(nèi)的活動(dòng)只限于相關(guān)業(yè)務(wù)能合法開(kāi)展所要求的最低限度。用戶調(diào)動(dòng)到新的工作崗位或離開(kāi)商業(yè)銀行時(shí)，應(yīng)在系統(tǒng)中及時(shí)檢查、更新或注銷(xiāo)用戶身份。

第二十三條商業(yè)銀行應(yīng)確保設(shè)立物理安全保護(hù)區(qū)域，包括計(jì)算機(jī)中心或數(shù)據(jù)中心、存儲(chǔ)機(jī)密信息或放臵網(wǎng)絡(luò)設(shè)備等重要信息科技設(shè)備的區(qū)域，明確相應(yīng)的職責(zé)，采取必要的預(yù)防、檢測(cè)和恢復(fù)控制措施。

第二十四條商業(yè)銀行應(yīng)根據(jù)信息安全級(jí)別，將網(wǎng)絡(luò)劃分為不同的邏輯安全域（以下簡(jiǎn)稱(chēng)為域）。應(yīng)該對(duì)下列安全因素進(jìn)行評(píng)估，并根據(jù)安全級(jí)別定義和評(píng)估結(jié)果實(shí)施有效的安全控制，如對(duì)每個(gè)域和整個(gè)網(wǎng)絡(luò)進(jìn)行物理或邏輯分區(qū)、實(shí)現(xiàn)網(wǎng)絡(luò)內(nèi)容過(guò)濾、邏輯訪問(wèn)控制、傳輸加密、網(wǎng)絡(luò)監(jiān)控、記錄活動(dòng)日志等。

（一）域內(nèi)應(yīng)用程序和用戶組的重要程度。

（二）各種通訊渠道進(jìn)入域的訪問(wèn)點(diǎn)。

（三）域內(nèi)配臵的網(wǎng)絡(luò)設(shè)備和應(yīng)用程序使用的網(wǎng)絡(luò)協(xié)議和端口。

（四）性能要求或標(biāo)準(zhǔn)。

（五）域的性質(zhì)，如生產(chǎn)域或測(cè)試域、內(nèi)部域或外部域。

（六）不同域之間的連通性。

（七）域的可信程度。

第二十五條商業(yè)銀行應(yīng)通過(guò)以下措施，確保所有計(jì)算機(jī)操作系統(tǒng)和系統(tǒng)軟件的安全：

（一）制定每種類(lèi)型操作系統(tǒng)的基本安全要求，確保所有系統(tǒng)滿足基本安全要求。

（二）明確定義包括終端用戶、系統(tǒng)開(kāi)發(fā)人員、系統(tǒng)測(cè)試人員、計(jì)算機(jī)操作人員、系統(tǒng)管理員和用戶管理員等不同用戶組的訪問(wèn)權(quán)限。

（三）制定最高權(quán)限系統(tǒng)賬戶的審批、驗(yàn)證和監(jiān)控流程，并確保最高權(quán)限用戶的操作日志被記錄和監(jiān)察。

（四）要求技術(shù)人員定期檢查可用的安全補(bǔ)丁，并報(bào)告補(bǔ)丁管理狀態(tài)。

（五）在系統(tǒng)日志中記錄不成功的登錄、重要系統(tǒng)文件的訪問(wèn)、對(duì)用戶賬戶的修改等有關(guān)重要事項(xiàng)，手動(dòng)或自動(dòng)監(jiān)控系統(tǒng)出現(xiàn)的任何異常事件，定期匯報(bào)監(jiān)控情況。

第二十六條商業(yè)銀行應(yīng)通過(guò)以下措施，確保所有信息系統(tǒng)的安全：

（一）明確定義終端用戶和信息科技技術(shù)人員在信息系統(tǒng)安全中的角色和職責(zé)。

（二）針對(duì)信息系統(tǒng)的重要性和敏感程度，采取有效的身份驗(yàn)證方法。

（三）加強(qiáng)職責(zé)劃分，對(duì)關(guān)鍵或敏感崗位進(jìn)行雙重控制。

（四）在關(guān)鍵的接合點(diǎn)進(jìn)行輸入驗(yàn)證或輸出核對(duì)。

（五）采取安全的方式處理保密信息的輸入和輸出，防止信息泄露或被盜取、篡改。

（六）確保系統(tǒng)按預(yù)先定義的方式處理例外情況，當(dāng)系統(tǒng)被迫終止時(shí)向用戶提供必要信息。

（七）以書(shū)面或電子格式保存審計(jì)痕跡。

（八）要求用戶管理員監(jiān)控和審查未成功的登錄和用戶賬戶的修改。

第二十七條商業(yè)銀行應(yīng)制定相關(guān)策略和流程，管理所有生產(chǎn)系統(tǒng)的活動(dòng)日志，以支持有效的審核、安全取證分析和預(yù)防欺詐。日志可以在軟件的不同層次、不同的計(jì)算機(jī)和網(wǎng)絡(luò)設(shè)備上完成，日志劃分為兩大類(lèi)：

（一）交易日志。交易日志由應(yīng)用軟件和數(shù)據(jù)庫(kù)管理系統(tǒng)產(chǎn)生，內(nèi)容包括用戶登錄嘗試、數(shù)據(jù)修改、錯(cuò)誤信息等。交易日志應(yīng)按照國(guó)家會(huì)計(jì)準(zhǔn)則要求予以保存。

商業(yè)銀行應(yīng)保證交易日志和系統(tǒng)日志中包含足夠的內(nèi)容，以便完成有效的內(nèi)部控制、解決系統(tǒng)故障和滿足審計(jì)需要；應(yīng)采取適當(dāng)措施保證所有日志同步計(jì)時(shí)，并確保其完整性。在例外情況發(fā)生后應(yīng)及時(shí)復(fù)查系統(tǒng)日志。交易日志或系統(tǒng)日志的復(fù)查頻率和保存周期應(yīng)由信息科技部門(mén)和有關(guān)業(yè)務(wù)部門(mén)共同決定，并報(bào)信息科技管理委員會(huì)批準(zhǔn)。

第二十八條商業(yè)銀行應(yīng)采取加密技術(shù)，防范涉密信息在傳輸、處理、存儲(chǔ)過(guò)程中出現(xiàn)泄露或被篡改的風(fēng)險(xiǎn)，并建立密碼設(shè)備管理制度，以確保：

（一）使用符合國(guó)家要求的加密技術(shù)和加密設(shè)備。

（二）管理、使用密碼設(shè)備的員工經(jīng)過(guò)專(zhuān)業(yè)培訓(xùn)和嚴(yán)格審查。

（三）加密強(qiáng)度滿足信息機(jī)密性的要求。

（四）制定并落實(shí)有效的管理流程，尤其是密鑰和證書(shū)生命周期管理。

第二十九條商業(yè)銀行應(yīng)配備切實(shí)有效的系統(tǒng)，確保所有終端用戶設(shè)備的安全，并定期對(duì)所有設(shè)備進(jìn)行安全檢查，包括臺(tái)式個(gè)人計(jì)算機(jī)（PC）、便攜式計(jì)算機(jī)、柜員終端、自動(dòng)柜員機(jī)（ATM）、存折打印機(jī)、讀卡器、銷(xiāo)售終端（POS）和個(gè)人數(shù)字助理（PDA）等。 第三十條商業(yè)銀行應(yīng)制定相關(guān)制度和流程，嚴(yán)格管理客戶信息的采集、處理、存貯、傳輸、分發(fā)、備份、恢復(fù)、清理和銷(xiāo)毀。

第三十一條商業(yè)銀行應(yīng)對(duì)所有員工進(jìn)行必要的培訓(xùn)，使其充分掌握信息科技風(fēng)險(xiǎn)管理制度和流程，了解違反規(guī)定的后果，并對(duì)違反安全規(guī)定的行為采取零容忍政策。

第五章信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)

第三十二條商業(yè)銀行應(yīng)有能力對(duì)信息系統(tǒng)進(jìn)行需求分析、規(guī)劃、采購(gòu)、開(kāi)發(fā)、測(cè)試、部署、維護(hù)、升級(jí)和報(bào)廢，制定制度和流程，管理信息科技項(xiàng)目的優(yōu)先排序、立項(xiàng)、審批和控制。項(xiàng)目實(shí)施部門(mén)應(yīng)定期向信息科技管理委員會(huì)提交重大信息科技項(xiàng)目的進(jìn)度報(bào)告，由其進(jìn)行審核，進(jìn)度報(bào)告應(yīng)當(dāng)包括計(jì)劃的重大變更、關(guān)鍵人員或供應(yīng)商的變更以及主要費(fèi)用支出情況。應(yīng)在信息系統(tǒng)投產(chǎn)后一定時(shí)期內(nèi)，組織對(duì)系統(tǒng)的后評(píng)價(jià)，并根據(jù)評(píng)價(jià)結(jié)果及時(shí)對(duì)系統(tǒng)功能進(jìn)行調(diào)整和優(yōu)化。 第三十三條商業(yè)銀行應(yīng)認(rèn)識(shí)到信息科技項(xiàng)目相關(guān)的風(fēng)險(xiǎn)，包括潛在的各種操作風(fēng)險(xiǎn)、財(cái)務(wù)損失風(fēng)險(xiǎn)和因無(wú)效項(xiàng)目規(guī)劃或不適當(dāng)?shù)捻?xiàng)目管理控制產(chǎn)生的機(jī)會(huì)成本，并采取適當(dāng)?shù)捻?xiàng)目管理方法，控制信息科技項(xiàng)目相關(guān)的風(fēng)險(xiǎn)。

第三十四條商業(yè)銀行應(yīng)采取適當(dāng)?shù)南到y(tǒng)開(kāi)發(fā)方法，控制信息系統(tǒng)的生命周期。典型的系統(tǒng)生命周期包括系統(tǒng)分析、設(shè)計(jì)、開(kāi)發(fā)或外購(gòu)、測(cè)試、試運(yùn)行、部署、維護(hù)和退出。所采用的系統(tǒng)開(kāi)發(fā)方法應(yīng)符合信息科技項(xiàng)目的規(guī)模、性質(zhì)和復(fù)雜度。

第三十五條商業(yè)銀行應(yīng)制定相關(guān)控制信息系統(tǒng)變更的制度和流程，確保系統(tǒng)的可靠性、完整性和可維護(hù)性，其中應(yīng)包括以下要求：

（一）生產(chǎn)系統(tǒng)與開(kāi)發(fā)系統(tǒng)、測(cè)試系統(tǒng)有效隔離。

（二）生產(chǎn)系統(tǒng)與開(kāi)發(fā)系統(tǒng)、測(cè)試系統(tǒng)的管理職能相分離。

（三）除得到管理層批準(zhǔn)執(zhí)行緊急修復(fù)任務(wù)外，禁止應(yīng)用程序開(kāi)發(fā)和維護(hù)人員進(jìn)入生產(chǎn)系統(tǒng)，且所有的緊急修復(fù)活動(dòng)都應(yīng)立即進(jìn)行記錄和審核。

（四）將完成開(kāi)發(fā)和測(cè)試環(huán)境的程序或系統(tǒng)配臵變更應(yīng)用到生產(chǎn)系統(tǒng)時(shí)，應(yīng)得到信息科技部門(mén)和業(yè)務(wù)部門(mén)的聯(lián)合批準(zhǔn)，并對(duì)變更進(jìn)行及時(shí)記錄和定期復(fù)查。

第三十六條商業(yè)銀行應(yīng)制定并落實(shí)相關(guān)制度、標(biāo)準(zhǔn)和流程，確保信息系統(tǒng)開(kāi)發(fā)、測(cè)試、維護(hù)過(guò)程中數(shù)據(jù)的完整性、保密性和可用性。

第三十七條商業(yè)銀行應(yīng)建立并完善有效的問(wèn)題管理流程，以確保全面地追蹤、分析和解決信息系統(tǒng)問(wèn)題，并對(duì)問(wèn)題進(jìn)行記錄、分類(lèi)和索引；如需供應(yīng)商提供支持服務(wù)或技術(shù)援助，應(yīng)向相關(guān)人員提供所需的合同和相關(guān)信息，并將過(guò)程記錄在案；對(duì)完成緊急恢復(fù)起至關(guān)重要作用的任務(wù)和指令集，應(yīng)有清晰的描述和說(shuō)明，并通知相關(guān)人員。

第三十八條商業(yè)銀行應(yīng)制定相關(guān)制度和流程，控制系統(tǒng)升級(jí)過(guò)程。當(dāng)設(shè)備達(dá)到預(yù)期使用壽命或性能不能滿足業(yè)務(wù)需求，基礎(chǔ)軟件（操作系統(tǒng)、數(shù)據(jù)庫(kù)管理系統(tǒng)、中間件）或應(yīng)用軟件必須升級(jí)時(shí)，應(yīng)及時(shí)進(jìn)行系統(tǒng)升級(jí)，并將該類(lèi)升級(jí)活動(dòng)納入信息科技項(xiàng)目，接受相關(guān)的管理和控制，包括用戶驗(yàn)收測(cè)試。

第六章信息科技運(yùn)行

第三十九條商業(yè)銀行在選擇數(shù)據(jù)中心的地理位臵時(shí)，應(yīng)充分考慮環(huán)境威脅（如是否接近自然災(zāi)害多發(fā)區(qū)、危險(xiǎn)或有害設(shè)施、繁忙或主要公路），采取物理控制措施，監(jiān)控對(duì)信息處理設(shè)備運(yùn)行構(gòu)成威脅的環(huán)境狀況，并防止因意外斷電或供電干擾影響數(shù)據(jù)中心的正常運(yùn)行。

第四十條商業(yè)銀行應(yīng)嚴(yán)格控制第三方人員（如服務(wù)供應(yīng)商）進(jìn)入安全區(qū)域，如確需進(jìn)入應(yīng)得到適當(dāng)?shù)呐鷾?zhǔn)，其活動(dòng)也應(yīng)受到監(jiān)控；針對(duì)長(zhǎng)期或臨時(shí)聘用的技術(shù)人員和承包商，尤其是從事敏感性技術(shù)相關(guān)工作的人員，應(yīng)制定嚴(yán)格的審查程序，包括身份驗(yàn)證和背景調(diào)查。

第四十一條商業(yè)銀行應(yīng)將信息科技運(yùn)行與系統(tǒng)開(kāi)發(fā)和維護(hù)分離，確保信息科技部門(mén)內(nèi)部的崗位制約；對(duì)數(shù)據(jù)中心的崗位和職責(zé)做出明確規(guī)定。 第四十二條商業(yè)銀行應(yīng)按照有關(guān)法律法規(guī)要求保存交易記錄，采取必要的程序和技術(shù)，確保存檔數(shù)據(jù)的完整性，滿足安全保存和可恢復(fù)要求。

第四十三條商業(yè)銀行應(yīng)制定詳盡的信息科技運(yùn)行操作說(shuō)明。如在信息科技運(yùn)行手冊(cè)中說(shuō)明計(jì)算機(jī)操作人員的任務(wù)、工作日程、執(zhí)行步驟，以及生產(chǎn)與開(kāi)發(fā)環(huán)境中數(shù)據(jù)、軟件的現(xiàn)場(chǎng)及非現(xiàn)場(chǎng)備份流程和要求（即備份的頻率、范圍和保留周期）。

第四十四條商業(yè)銀行應(yīng)建立事故管理及處臵機(jī)制，及時(shí)響應(yīng)信息系統(tǒng)運(yùn)行事故，逐級(jí)向相關(guān)的信息科技管理人員報(bào)告事故的發(fā)生，并進(jìn)行記錄、分析和跟蹤，直到完成徹底的處臵和根本原因分析。商業(yè)銀行應(yīng)建立服務(wù)臺(tái)，為用戶提供相關(guān)技術(shù)問(wèn)題的在線支持，并將問(wèn)題提交給相關(guān)信息科技部門(mén)進(jìn)行調(diào)查和解決。

第四十五條商業(yè)銀行應(yīng)建立服務(wù)水平管理相關(guān)的制度和流程，對(duì)信息科技運(yùn)行服務(wù)水平進(jìn)行考核。

第四十六條商業(yè)銀行應(yīng)建立連續(xù)監(jiān)控信息系統(tǒng)性能的相關(guān)程序，及時(shí)、完整地報(bào)告例外情況；該程序應(yīng)提供預(yù)警功能，在例外情況對(duì)系統(tǒng)性能造成影響前對(duì)其進(jìn)行識(shí)別和修正。 第四十七條商業(yè)銀行應(yīng)制定容量規(guī)劃，以適應(yīng)由于外部環(huán)境變化產(chǎn)生的業(yè)務(wù)發(fā)展和交易量增長(zhǎng)。容量規(guī)劃應(yīng)涵蓋生產(chǎn)系統(tǒng)、備份系統(tǒng)及相關(guān)設(shè)備。

第四十八條商業(yè)銀行應(yīng)及時(shí)進(jìn)行維護(hù)和適當(dāng)?shù)南到y(tǒng)升級(jí)，以確保與技術(shù)相關(guān)服務(wù)的連續(xù)可用性，并完整保存記錄（包括疑似和實(shí)際的故障、預(yù)防性和補(bǔ)救性維護(hù)記錄），以確保有效維護(hù)設(shè)備和設(shè)施。

第四十九條商業(yè)銀行應(yīng)制定有效的變更管理流程，以確保生產(chǎn)環(huán)境的完整性和可靠性。包括緊急變更在內(nèi)的所有變更都應(yīng)記入日志，由信息科技部門(mén)和業(yè)務(wù)部門(mén)共同審核簽字，并事先進(jìn)行備份,以便必要時(shí)可以恢復(fù)原來(lái)的系統(tǒng)版本和數(shù)據(jù)文件。緊急變更成功后,應(yīng)通過(guò)正常的驗(yàn)收測(cè)試和變更管理流程,采用恰當(dāng)?shù)男拚匀〈o急變更。

第七章業(yè)務(wù)連續(xù)性管理

第五十條商業(yè)銀行應(yīng)根據(jù)自身業(yè)務(wù)的性質(zhì)、規(guī)模和復(fù)雜程度制定適當(dāng)?shù)臉I(yè)務(wù)連續(xù)性規(guī)劃，以確保在出現(xiàn)無(wú)法預(yù)見(jiàn)的中斷時(shí)，系統(tǒng)仍能持續(xù)運(yùn)行并提供服務(wù)；定期對(duì)規(guī)劃進(jìn)行更新和演練，以保證其有效性。

第五十一條商業(yè)銀行應(yīng)評(píng)估因意外事件導(dǎo)致其業(yè)務(wù)運(yùn)行中斷的可能性及其影響，包括評(píng)估可能由下述原因?qū)е碌钠茐模邯?/p>

（一）內(nèi)外部資源的故障或缺失（如人員、系統(tǒng)或其他資產(chǎn)）。

（二）信息丟失或受損。

（三）外部事件（如戰(zhàn)爭(zhēng)、地震或臺(tái)風(fēng)等）。

第五十二條商業(yè)銀行應(yīng)采取系統(tǒng)恢復(fù)和雙機(jī)熱備處理等措施降低業(yè)務(wù)中斷的可能性，并通過(guò)應(yīng)急安排和保險(xiǎn)等方式降低影響。

第五十三條商業(yè)銀行應(yīng)建立維持其運(yùn)營(yíng)連續(xù)性策略的文檔，并制定對(duì)策略的充分性和有效性進(jìn)行檢查和溝通的計(jì)劃。其中包括：

（一）規(guī)范的業(yè)務(wù)連續(xù)性計(jì)劃,明確降低短期、中期和長(zhǎng)期中斷所造成影響的措施，包括但不限于:

1．資源需求（如人員、系統(tǒng)和其他資產(chǎn)）以及獲取資源的方式。

2．運(yùn)行恢復(fù)的優(yōu)先順序。

3．與內(nèi)部各部門(mén)及外部相關(guān)各方（尤其是監(jiān)管機(jī)構(gòu)、客戶和媒體等）的溝通安排。

（二）更新實(shí)施業(yè)務(wù)連續(xù)性計(jì)劃的流程及相關(guān)聯(lián)系信息。

（三）驗(yàn)證受中斷影響的信息完整性的步驟。

（四）當(dāng)商業(yè)銀行的業(yè)務(wù)或風(fēng)險(xiǎn)狀況發(fā)生變化時(shí)，對(duì)本條

（一）到

（三）進(jìn)行審核并升級(jí)。

第五十四條商業(yè)銀行的業(yè)務(wù)連續(xù)性計(jì)劃和年度應(yīng)急演練結(jié)果應(yīng)由信息科技風(fēng)險(xiǎn)管理部門(mén)或信息科技管理委員會(huì)確認(rèn)。

第八章外包

第五十五條商業(yè)銀行不得將其信息科技管理責(zé)任外包，應(yīng)合理謹(jǐn)慎監(jiān)督外包職能的履行。

第五十六條商業(yè)銀行實(shí)施重要外包（如數(shù)據(jù)中心和信息科技基礎(chǔ)設(shè)施等)應(yīng)格外謹(jǐn)慎，在準(zhǔn)備實(shí)施重要外包時(shí)應(yīng)以書(shū)面材料正式報(bào)告銀監(jiān)會(huì)或其派出機(jī)構(gòu)。

第五十七條商業(yè)銀行在簽署外包協(xié)議或?qū)ν獍鼌f(xié)議進(jìn)行重大變更前，應(yīng)做好相關(guān)準(zhǔn)備，其中包括：

（一）分析外包是否適合商業(yè)銀行的組織結(jié)構(gòu)和報(bào)告路線、業(yè)務(wù)戰(zhàn)略、總體風(fēng)險(xiǎn)控制，是否滿足商業(yè)銀行履行對(duì)外包服務(wù)商的監(jiān)督義務(wù)。

（二）考慮外包協(xié)議是否允許商業(yè)銀行監(jiān)測(cè)和控制與外包相關(guān)的操作風(fēng)險(xiǎn)。

（三）充分審查、評(píng)估外包服務(wù)商的財(cái)務(wù)穩(wěn)定性和專(zhuān)業(yè)經(jīng)驗(yàn)，對(duì)外包服務(wù)商進(jìn)行風(fēng)險(xiǎn)評(píng)估，考查其設(shè)施和能力是否足以承擔(dān)相應(yīng)的責(zé)任。

（四）考慮外包協(xié)議變更前后實(shí)施的平穩(wěn)過(guò)渡（包括終止合同可能發(fā)生的情況）。

（五）關(guān)注可能存在的集中風(fēng)險(xiǎn)，如多家商業(yè)銀行共用同一外包服務(wù)商帶來(lái)的潛在業(yè)務(wù)連續(xù)性風(fēng)險(xiǎn)。

第五十八條商業(yè)銀行在與外包服務(wù)商合同談判過(guò)程中，應(yīng)考慮的因素包括但不限于：

（一）對(duì)外包服務(wù)商的報(bào)告要求和談判必要條件。

（二）銀行業(yè)監(jiān)管機(jī)構(gòu)和內(nèi)部審計(jì)、外部審計(jì)能執(zhí)行足夠的監(jiān)督。

（三）通過(guò)界定信息所有權(quán)、簽署保密協(xié)議和采取技術(shù)防護(hù)措施保護(hù)客戶信息和其他信息。

（四）擔(dān)保和損失賠償是否充足。

（五）外包服務(wù)商遵守商業(yè)銀行有關(guān)信息科技風(fēng)險(xiǎn)制度和流程的意愿及相關(guān)措施。

（六）外包服務(wù)商提供的業(yè)務(wù)連續(xù)性保障水平，以及提供相關(guān)專(zhuān)屬資源的承諾。

（七）第三方供應(yīng)商出現(xiàn)問(wèn)題時(shí)，保證軟件持續(xù)可用的相關(guān)措施。

（八）變更外包協(xié)議的流程，以及商業(yè)銀行或外包服務(wù)商選擇變更或終止外包協(xié)議的條件，例如：

1.商業(yè)銀行或外包服務(wù)商的所有權(quán)或控制權(quán)發(fā)生變化。 2.商業(yè)銀行或外包服務(wù)商的業(yè)務(wù)經(jīng)營(yíng)發(fā)生重大變化。 3.外包服務(wù)商提供的服務(wù)不充分，造成商業(yè)銀行不能履行監(jiān)督義務(wù)。

第五十九條商業(yè)銀行在實(shí)施雙方關(guān)系管理，以及起草服務(wù)水平協(xié)議時(shí)，應(yīng)考慮的因素包括但不限于：

（一）提出定性和定量的績(jī)效指標(biāo)，評(píng)估外包服務(wù)商為商業(yè)銀行及其相關(guān)客戶提供服務(wù)的充分性。

（二）通過(guò)服務(wù)水平報(bào)告、定期自我評(píng)估、內(nèi)部或外部獨(dú)立審計(jì)進(jìn)行績(jī)效考核。

（三）針對(duì)績(jī)效不達(dá)標(biāo)的情況調(diào)整流程，采取整改措施。 第六十條商業(yè)銀行應(yīng)加強(qiáng)信息科技相關(guān)外包管理工作，確保商業(yè)銀行的客戶資料等敏感信息的安全，包括但不限于采取以下措施：

（一）實(shí)現(xiàn)本銀行客戶資料與外包服務(wù)商其他客戶資料的有效隔離。

（二）按照“必需知道”和“最小授權(quán)”原則對(duì)外包服務(wù)商相關(guān)人員授權(quán)。

（三）要求外包服務(wù)商保證其相關(guān)人員遵守保密規(guī)定。

（四）應(yīng)將涉及本銀行客戶資料的外包作為重要外包，并告知相關(guān)客戶。

（五）嚴(yán)格控制外包服務(wù)商再次對(duì)外轉(zhuǎn)包，采取足夠措施確保商業(yè)銀行相關(guān)信息的安全。

（六）確保在中止外包協(xié)議時(shí)收回或銷(xiāo)毀外包服務(wù)商保存的所有客戶資料。

第六十一條商業(yè)銀行應(yīng)建立恰當(dāng)?shù)膽?yīng)急措施，應(yīng)對(duì)外包服務(wù)商在服務(wù)中可能出現(xiàn)的重大缺失。尤其需要考慮外包服務(wù)商的重大資源損失，重大財(cái)務(wù)損失和重要人員的變動(dòng)，以及外包協(xié)議的意外終止。

第六十二條商業(yè)銀行所有信息科技外包合同應(yīng)由信息科技風(fēng)險(xiǎn)管理部門(mén)、法律部門(mén)和信息科技管理委員會(huì)審核通過(guò)。商業(yè)銀行應(yīng)設(shè)立流程定期審閱和修訂服務(wù)水平協(xié)議。



第九章內(nèi)部審計(jì)

第六十三條商業(yè)銀行內(nèi)部審計(jì)部門(mén)應(yīng)根據(jù)業(yè)務(wù)的性質(zhì)、規(guī)模和復(fù)雜程度，對(duì)相關(guān)系統(tǒng)及其控制的適當(dāng)性和有效性進(jìn)行監(jiān)測(cè)。內(nèi)部審計(jì)部門(mén)應(yīng)配備足夠的資源和具有專(zhuān)業(yè)能力的信息科技審計(jì)人員，獨(dú)立于本銀行的日常活動(dòng)，具有適當(dāng)?shù)氖跈?quán)訪問(wèn)本銀行的記錄。

第六十四條商業(yè)銀行內(nèi)部信息科技審計(jì)的責(zé)任包括：

（一）制定、實(shí)施和調(diào)整審計(jì)計(jì)劃，檢查和評(píng)估商業(yè)銀行信息科技系統(tǒng)和內(nèi)控機(jī)制的充分性和有效性。

（二）按照第（一）款規(guī)定完成審計(jì)工作，在此基礎(chǔ)上提出整改意見(jiàn)。

（三）檢查整改意見(jiàn)是否得到落實(shí)。

（四）執(zhí)行信息科技專(zhuān)項(xiàng)審計(jì)。信息科技專(zhuān)項(xiàng)審計(jì)，是指對(duì)信息科技安全事故進(jìn)行的調(diào)查、分析和評(píng)估，或?qū)徲?jì)部門(mén)根據(jù)風(fēng)險(xiǎn)評(píng)估結(jié)果對(duì)認(rèn)為必要的特殊事項(xiàng)進(jìn)行的審計(jì)。

第六十五條商業(yè)銀行應(yīng)根據(jù)業(yè)務(wù)性質(zhì)、規(guī)模和復(fù)雜程度，信息科技應(yīng)用情況，以及信息科技風(fēng)險(xiǎn)評(píng)估結(jié)果，決定信息科技內(nèi)部審計(jì)范圍和頻率。但至少應(yīng)每三年進(jìn)行一次全面審計(jì)。

第六十六條商業(yè)銀行在進(jìn)行大規(guī)模系統(tǒng)開(kāi)發(fā)時(shí)，應(yīng)要求信息科技風(fēng)險(xiǎn)管理部門(mén)和內(nèi)部審計(jì)部門(mén)參與，保證系統(tǒng)開(kāi)發(fā)符合本銀行信息科技風(fēng)險(xiǎn)管理標(biāo)準(zhǔn)。

第十章外部審計(jì)

第六十七條商業(yè)銀行可以在符合法律、法規(guī)和監(jiān)管要求的情況下，委托具備相應(yīng)資質(zhì)的外部審計(jì)機(jī)構(gòu)進(jìn)行信息科技外部審計(jì)。

第六十八條在委托審計(jì)過(guò)程中，商業(yè)銀行應(yīng)確保外部審計(jì)機(jī)構(gòu)能夠?qū)Ρ俱y行的硬件、軟件、文檔和數(shù)據(jù)進(jìn)行檢查，以發(fā)現(xiàn)信息科技存在的風(fēng)險(xiǎn)，國(guó)家法律、法規(guī)及監(jiān)管部門(mén)規(guī)章、規(guī)范性文件規(guī)定的重要商業(yè)、技術(shù)保密信息除外。

第六十九條商業(yè)銀行在實(shí)施外部審計(jì)前應(yīng)與外部審計(jì)機(jī)構(gòu)進(jìn)行充分溝通，詳細(xì)確定審計(jì)范圍，不應(yīng)故意隱瞞事實(shí)或阻撓審計(jì)檢查。

第七十條銀監(jiān)會(huì)及其派出機(jī)構(gòu)必要時(shí)可指定具備相應(yīng)資質(zhì)的外部審計(jì)機(jī)構(gòu)對(duì)商業(yè)銀行執(zhí)行信息科技審計(jì)或相關(guān)檢查。外部審計(jì)機(jī)構(gòu)根據(jù)銀監(jiān)會(huì)或其派出機(jī)構(gòu)的委托或授權(quán)對(duì)商業(yè)銀行進(jìn)行審計(jì)時(shí)，應(yīng)出示委托授權(quán)書(shū)，并依照委托授權(quán)書(shū)上規(guī)定的范圍進(jìn)行審計(jì)。

第七十一條外部審計(jì)機(jī)構(gòu)根據(jù)授權(quán)出具的審計(jì)報(bào)告，經(jīng)銀監(jiān)會(huì)及其派出機(jī)構(gòu)審閱批準(zhǔn)后具有與銀監(jiān)會(huì)及其派出機(jī)構(gòu)出具的檢查報(bào)告同等的效力，被審計(jì)的商業(yè)銀行應(yīng)根據(jù)該審計(jì)報(bào)告提出整改計(jì)劃，并在規(guī)定的時(shí)間內(nèi)實(shí)施整改。

第七十二條商業(yè)銀行在委托外部審計(jì)機(jī)構(gòu)進(jìn)行外部審計(jì)時(shí)，應(yīng)與其簽訂保密協(xié)議，并督促其嚴(yán)格遵守法律法規(guī)，保守本銀行的商業(yè)秘密和信息科技風(fēng)險(xiǎn)信息，防止其擅自對(duì)本銀行提供的任何文件進(jìn)行修改、復(fù)制或帶離現(xiàn)場(chǎng)。

第十一章附則

第七十三條未設(shè)董事會(huì)的商業(yè)銀行，應(yīng)當(dāng)由其經(jīng)營(yíng)決策機(jī)構(gòu)履行本指引中董事會(huì)的有關(guān)信息科技風(fēng)險(xiǎn)管理職責(zé)。

第七十四條銀監(jiān)會(huì)依法對(duì)商業(yè)銀行的信息科技風(fēng)險(xiǎn)管理實(shí)施監(jiān)督檢查。

第七十五條本指引由銀監(jiān)會(huì)負(fù)責(zé)解釋、修訂。

第七十六條本指引自頒布之日起施行，《銀行業(yè)金融機(jī)構(gòu)信息系統(tǒng)風(fēng)險(xiǎn)管理指引》（銀監(jiān)發(fā)?2006?63號(hào)）同時(shí)廢止。

第二篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

第一章總則

第二條本指引適用于在中華人民共和國(guó)境內(nèi)依法設(shè)立的法人商業(yè)銀行。政策性銀行、農(nóng)村合作銀行、城市信用社、農(nóng)村信用社、村鎮(zhèn)銀行、貸款公司、金融資產(chǎn)管理公司、信托公司、財(cái)務(wù)公司、金融租賃公司、汽車(chē)金融公司、貨幣經(jīng)紀(jì)公司等其他銀行業(yè)金融機(jī)構(gòu)參照?qǐng)?zhí)行。

第三條本指引所稱(chēng)信息科技是指計(jì)算機(jī)、通信、微電子和軟件工程等現(xiàn)代信息技術(shù)，在商業(yè)銀行業(yè)務(wù)交易處理、經(jīng)營(yíng)管理和內(nèi)部控制等方面的應(yīng)用，并包括進(jìn)行信息科技治理，建立完整的管理組織架構(gòu)，制訂完善的管理制度和流程。第四條本指引所稱(chēng)信息科技風(fēng)險(xiǎn)，是指信息科技在商業(yè)銀行運(yùn)用過(guò)程中，由于自然因素、人為因素、技術(shù)漏洞和管理缺陷產(chǎn)生的操作、法律和聲譽(yù)等風(fēng)險(xiǎn)。第五條信息科技風(fēng)險(xiǎn)管理的目標(biāo)是通過(guò)建立有效的機(jī)制，實(shí)現(xiàn)對(duì)商業(yè)銀行信息科技風(fēng)險(xiǎn)的識(shí)別、計(jì)量、監(jiān)測(cè)和控制，促進(jìn)商業(yè)銀行安全、持續(xù)、穩(wěn)健運(yùn)行，推動(dòng)業(yè)務(wù)創(chuàng)新，提高信息技術(shù)使用水平，增強(qiáng)核心競(jìng)爭(zhēng)力和可持續(xù)發(fā)展能力。第二章

第六條商業(yè)銀行法定代表人是本機(jī)構(gòu)信息科技風(fēng)險(xiǎn)管理的第一責(zé)任人，負(fù)責(zé)組

第七條商業(yè)銀行的董事會(huì)應(yīng)履行以下信息科技管理職責(zé)：

（一）遵守并貫徹執(zhí)行國(guó)家有關(guān)信息科技管理的法律、法規(guī)和技術(shù)標(biāo)準(zhǔn)，落實(shí)

（二）審查批準(zhǔn)信息科技戰(zhàn)略，確保其與銀行的總體業(yè)務(wù)戰(zhàn)略和重大策略相一致。評(píng)估信息科技及其風(fēng)險(xiǎn)管理工作的總體效果和效率。

（三）掌握主要的信息科技風(fēng)險(xiǎn)，確定可接受的風(fēng)險(xiǎn)級(jí)別，確保相關(guān)風(fēng)險(xiǎn)能夠被識(shí)別、計(jì)量、監(jiān)測(cè)和控制。

（四）規(guī)范職業(yè)道德行為和廉潔標(biāo)準(zhǔn)，增強(qiáng)內(nèi)部文化建設(shè)，提高全體人員對(duì)信息科技風(fēng)險(xiǎn)管理重要性的認(rèn)識(shí)。

（六）在建立良好的公司治理的基礎(chǔ)上進(jìn)行信息科技治理，形成分工合理、職責(zé)明確、相互制衡、報(bào)告關(guān)系清晰的信息科技治理組織結(jié)構(gòu)。加強(qiáng)信息科技專(zhuān)業(yè)隊(duì)伍的建設(shè)，建立人

（七）確保內(nèi)部審計(jì)部門(mén)進(jìn)行獨(dú)立有效的信息科技風(fēng)險(xiǎn)管理審計(jì)，對(duì)審計(jì)報(bào)告

（八）每年審閱并向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)送信息科技風(fēng)險(xiǎn)管理的報(bào)告。

（九）確保信息科技風(fēng)險(xiǎn)管理工作所需資金。

（十）確保銀行所有員工充分理解和遵守經(jīng)其批準(zhǔn)的信息科技風(fēng)險(xiǎn)管理制度和流程，并安排相關(guān)培訓(xùn)。

（十二）及時(shí)向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)告本機(jī)構(gòu)發(fā)生的重大信息科技事故或突發(fā)事件，按相關(guān)預(yù)案快速響應(yīng)。

（十三）配合銀監(jiān)會(huì)及其派出機(jī)構(gòu)做好信息科技風(fēng)險(xiǎn)監(jiān)督檢查工作，并按照監(jiān)管意見(jiàn)進(jìn)行整改。

（十四）履行信息科技風(fēng)險(xiǎn)管理其他相關(guān)工作。

第八條商業(yè)銀行應(yīng)設(shè)立首席信息官，直接向行長(zhǎng)匯報(bào)，并參與決策。首席信息

（一）（二）確保信息科技戰(zhàn)略，尤其是信息系統(tǒng)開(kāi)發(fā)戰(zhàn)略，符合本銀行的總體業(yè)務(wù)

（四）確保信息科技風(fēng)險(xiǎn)管理的有效性，并使有關(guān)管理措施落實(shí)到相關(guān)的每一

（五）組織專(zhuān)業(yè)培訓(xùn)，提高人才隊(duì)伍的專(zhuān)業(yè)技能。

（六）履行信息科技風(fēng)險(xiǎn)管理其他相關(guān)工作。

（一）驗(yàn)證個(gè)人信息，包括核驗(yàn)有效身份證件、學(xué)歷證明、工作經(jīng)歷和專(zhuān)業(yè)資

（二）（三）確保員工了解、遵守信息科技策略、指導(dǎo)原則、信息保密、授權(quán)使用信息系統(tǒng)、信息科技管理制度和流程等要求，并同員工簽訂相關(guān)協(xié)議。

（四）評(píng)估關(guān)鍵崗位信息科技員工流失帶來(lái)的風(fēng)險(xiǎn)，做好安排候補(bǔ)員工和崗位

第十條商業(yè)銀行應(yīng)設(shè)立或指派一個(gè)特定部門(mén)負(fù)責(zé)信息科技風(fēng)險(xiǎn)管理工作，并直接向首席信息官或首席風(fēng)險(xiǎn)官（風(fēng)險(xiǎn)管理委員會(huì)）報(bào)告工作。該部門(mén)應(yīng)為信息科技突發(fā)事件應(yīng)急響應(yīng)小組的成員之一，負(fù)責(zé)協(xié)調(diào)制定有關(guān)信息科技風(fēng)險(xiǎn)管理策略，尤其是在涉及信息安全、業(yè)務(wù)連續(xù)性計(jì)劃和合規(guī)性風(fēng)險(xiǎn)等方面，為業(yè)務(wù)部門(mén)和信息科技部門(mén)提供建議及相關(guān)合規(guī)性信息，實(shí)施持續(xù)信息科技風(fēng)險(xiǎn)評(píng)估，跟蹤整改意見(jiàn)的落實(shí)，監(jiān)控信息安全威脅和不合規(guī)事件的發(fā)生。

第三章

（一）信息分級(jí)與保護(hù)。

（二）信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)。

（三）信息科技運(yùn)行和維護(hù)。

（四）訪問(wèn)控制。

（五）物理安全。

（六）人員安全。

（七）業(yè)務(wù)連續(xù)性計(jì)劃與應(yīng)急處臵。

第十六條商業(yè)銀行應(yīng)制定持續(xù)的風(fēng)險(xiǎn)識(shí)別和評(píng)估流程，確定信息科技中存在隱患的區(qū)域，評(píng)價(jià)風(fēng)險(xiǎn)對(duì)其業(yè)務(wù)的潛在影響，對(duì)風(fēng)險(xiǎn)進(jìn)行排序，并確定風(fēng)險(xiǎn)防范措施及所需資源的優(yōu)先級(jí)別（包括外包供應(yīng)商、產(chǎn)品供應(yīng)商和服務(wù)商）。第十七條商業(yè)銀行應(yīng)依據(jù)信息科技風(fēng)險(xiǎn)管理策略和風(fēng)險(xiǎn)評(píng)估結(jié)果，實(shí)施全面的風(fēng)險(xiǎn)防范措施。防范措施應(yīng)包括：

（一）制定明確的信息科技風(fēng)險(xiǎn)管理制度、技術(shù)標(biāo)準(zhǔn)和操作規(guī)程等，定期進(jìn)行

1.最高權(quán)限用戶的審查。

2.控制對(duì)數(shù)據(jù)和系統(tǒng)的物理和邏輯訪問(wèn)。

3.訪問(wèn)授權(quán)以“必需知道”和“最小授權(quán)”為原則。4.5.第十八條商業(yè)銀行應(yīng)建立持續(xù)的信息科技風(fēng)險(xiǎn)計(jì)量和監(jiān)測(cè)機(jī)制，其中應(yīng)包括：

（一）建立信息科技項(xiàng)目實(shí)施前及實(shí)施后的評(píng)價(jià)機(jī)制。

（二）建立定期檢查系統(tǒng)性能的程序和標(biāo)準(zhǔn)。

（三）建立信息科技服務(wù)投訴和事故處理的報(bào)告機(jī)制。

（四）建立內(nèi)部審計(jì)、外部審計(jì)和監(jiān)管發(fā)現(xiàn)問(wèn)題的整改處理機(jī)制。

（五）（六）定期評(píng)估新技術(shù)發(fā)展可能造成的影響和已使用軟件面臨的新威脅。

（七）定期進(jìn)行運(yùn)行環(huán)境下操作風(fēng)險(xiǎn)和管理控制的檢查。

（八）定期進(jìn)行信息科技外包項(xiàng)目的風(fēng)險(xiǎn)狀況評(píng)價(jià)。

第十九條中資商業(yè)銀行在境外設(shè)立的機(jī)構(gòu)及境內(nèi)的外資商業(yè)銀行，應(yīng)當(dāng)遵守境內(nèi)外監(jiān)管機(jī)構(gòu)關(guān)于信息科技風(fēng)險(xiǎn)管理的要求，并防范因監(jiān)管差異所造成的風(fēng)險(xiǎn)。第四章信息安全

第二十條商業(yè)銀行信息科技部門(mén)負(fù)責(zé) 建立和實(shí)施信息分類(lèi)和保護(hù)體系，商業(yè)銀行應(yīng)使所有員工都了解信息安全的重要性，并組織提供必要的培訓(xùn)，讓員工充分了解其職責(zé)范圍內(nèi)的信息保護(hù)流程。

（一）（二）

（三）（四）

（五）（六）

（七）（八）

（九）（十）

（十一）第二十二條商業(yè)銀行應(yīng)建立有效管理用戶認(rèn)證和訪問(wèn)控制的流程。用戶對(duì)數(shù)據(jù)和系統(tǒng)的訪問(wèn)必須選擇與信息訪問(wèn)級(jí)別相匹配的認(rèn)證機(jī)制，并且確保其在信息系統(tǒng)內(nèi)的活動(dòng)只限于相關(guān)業(yè)務(wù)能合法開(kāi)展所要求的最低限度。用戶調(diào)動(dòng)到新的第二十三條商業(yè)銀行應(yīng)確保設(shè)立物理安全保護(hù)區(qū)域，包括計(jì)算機(jī)中心或數(shù)據(jù)中心、存儲(chǔ)機(jī)密信息或放臵網(wǎng)絡(luò)設(shè)備等重要信息科技設(shè)備的區(qū)域，明確相應(yīng)的職

（一）（二）

（三）（四）

（五）域的性質(zhì)，如生產(chǎn)域或測(cè)試域、內(nèi)部域或外部域。

（六）（七）

第二十五條商業(yè)銀行應(yīng)通過(guò)以下措施，確保所有計(jì)算機(jī)操作系統(tǒng)和系統(tǒng)軟件的安全：

（一）制定每種類(lèi)型操作系統(tǒng)的基本安全要求，確保所有系統(tǒng)滿足基本安全要

（二）明確定義包括終端用戶、系統(tǒng)開(kāi)發(fā)人員、系統(tǒng)測(cè)試人員、計(jì)算機(jī)操作人

（三）制定最高權(quán)限系統(tǒng)賬戶的審批、驗(yàn)證和監(jiān)控流程，并確保最高權(quán)限用戶

（四）（五）在系統(tǒng)日志中記錄不成功的登錄、重要系統(tǒng)文件的訪問(wèn)、對(duì)用戶賬戶的修改等有關(guān)重要事項(xiàng)，手動(dòng)或自動(dòng)監(jiān)控系統(tǒng)出現(xiàn)的任何異常事件，定期匯報(bào)監(jiān)控

第二十六條

（一）明確定義終端用戶和信息科技技術(shù)人員在信息系統(tǒng)安全中的角色和職

（二）（三）加強(qiáng)職責(zé)劃分，對(duì)關(guān)鍵或敏感崗位進(jìn)行雙重控制。

（四）（五）采取安全的方式處理保密信息的輸入和輸出，防止信息泄露或被盜取、（六）確保系統(tǒng)按預(yù)先定義的方式處理例外情況，當(dāng)系統(tǒng)被迫終止時(shí)向用戶提

（七）以書(shū)面或電子格式

（八）第二十七條商業(yè)銀行應(yīng)制定相關(guān)策略和流程，管理所有生產(chǎn)系統(tǒng)的活動(dòng)日志，以支持有效的審核、安全取證分析和預(yù)防欺詐。日志可以在軟件的不同層次、（一）交易日志。交易日志由應(yīng)用軟件和數(shù)據(jù)庫(kù)管理系統(tǒng)產(chǎn)生，內(nèi)容包括用戶登錄嘗試、數(shù)據(jù)修改、錯(cuò)誤信息等。交易日志應(yīng)按照國(guó)家會(huì)計(jì)準(zhǔn)則要求予以保

（二）系統(tǒng)日志。系統(tǒng)日志由操作系統(tǒng)、數(shù)據(jù)庫(kù)管理系統(tǒng)、防火墻、入侵檢測(cè)系統(tǒng)和路由器等生成，內(nèi)容包括管理登錄嘗試、系統(tǒng)事件、網(wǎng)絡(luò)事件、錯(cuò)誤信息等。系統(tǒng)日志保存期限按系統(tǒng)的風(fēng)險(xiǎn)等級(jí)確定，但不能少于一年。商業(yè)銀行應(yīng)保證交易日志和系統(tǒng)日志中包含足夠的內(nèi)容，以便完成有效的內(nèi)部控制、解決系統(tǒng)故障和滿足審計(jì)需要；應(yīng)采取適當(dāng)措施保證所有日志同步計(jì)時(shí)，并確保其完整性。在例外情況發(fā)生后應(yīng)及時(shí)復(fù)查系統(tǒng)日志。交易日志或系統(tǒng)日志的復(fù)查頻率和保存周期應(yīng)由信息科技部門(mén)和有關(guān)業(yè)務(wù)部門(mén)共同決定，并報(bào)信

第二十八條商業(yè)銀行應(yīng)采取加密技術(shù)，防范涉密信息在傳輸、處理、存儲(chǔ)過(guò)程中出現(xiàn)泄露或被篡改的風(fēng)險(xiǎn)，并建立密

（一）（二）管理、使用密碼設(shè)備的員工經(jīng)過(guò)專(zhuān)業(yè)培訓(xùn)和嚴(yán)格審查。

（三）（四）

第三十條商業(yè)銀行應(yīng)制定相關(guān)制度和流程，嚴(yán)格管理客戶信息的采集、處理、存貯、傳輸、分發(fā)、備份、恢復(fù)、清理和銷(xiāo)毀。

第三十一條商業(yè)銀行應(yīng)對(duì)所有員工進(jìn)行必要的培訓(xùn)，使其充分掌握信息科技風(fēng)險(xiǎn)管理制度和流程，了解違反規(guī)定的后果，并對(duì)違反安全規(guī)定的行為采取零容忍政策。第五章

第三十三條商業(yè)銀行應(yīng)認(rèn)識(shí)到信息科技項(xiàng)目相關(guān)的風(fēng)險(xiǎn)，包括潛在的各種操作風(fēng)險(xiǎn)、財(cái)務(wù)損失風(fēng)險(xiǎn)和因無(wú)效項(xiàng)目規(guī)劃或不適當(dāng)?shù)捻?xiàng)目管理控制產(chǎn)生的機(jī)會(huì)成第三十四條商業(yè)銀行應(yīng)采取適當(dāng)?shù)南到y(tǒng)開(kāi)發(fā)方法，控制信息系統(tǒng)的生命周期。典型的系統(tǒng)生命周期包括系統(tǒng)分析、設(shè)計(jì)、開(kāi)發(fā)或外購(gòu)、測(cè)試、試運(yùn)行、部署、維護(hù)和退出。所采用的系統(tǒng)開(kāi)發(fā)方法應(yīng)符合信息科技項(xiàng)目的規(guī)模、性質(zhì)和復(fù)雜

第三十五條商業(yè)銀行應(yīng)制定相關(guān)控制信息系統(tǒng)變更的制度和流程，確保系統(tǒng)的（一）

（二）生產(chǎn)系統(tǒng)與開(kāi)發(fā)系統(tǒng)、測(cè)試系統(tǒng)的管理職能相分離。

（三）除得到管理層批準(zhǔn)執(zhí)行緊急修復(fù)任務(wù)外，禁止應(yīng)用程序開(kāi)發(fā)和維護(hù)人員

第三十六條商業(yè)銀行應(yīng)制定并落實(shí)相關(guān)制度、標(biāo)準(zhǔn)和流程，確保信息系統(tǒng)開(kāi)發(fā)、第三十七條商業(yè)銀行應(yīng)建立并完善有效的問(wèn)題管理流程，以確保全面地追蹤、分析和解決信息系統(tǒng)問(wèn)題，并對(duì)問(wèn)題進(jìn)行記錄、分類(lèi)和索引；如需供應(yīng)商提供支持服務(wù)或技術(shù)援助，應(yīng)向相關(guān)人員提供所需的合同和相關(guān)信息，并將過(guò)程記錄在案；對(duì)完成緊急恢復(fù)起至關(guān)重要作用的任務(wù)和指令集，應(yīng)有清晰的描述和

第六章

第四十一條商業(yè)銀行應(yīng)將信息科技運(yùn)行與系統(tǒng)開(kāi)發(fā)和維護(hù)分離，確保信息科技

第四十二條商業(yè)銀行應(yīng)按照有關(guān)法律法規(guī)要求保存交易記錄，采取必要的程序和技術(shù)，確保存檔數(shù)據(jù)的完整性，滿足安全保存和可恢復(fù)要求

第四十五條商業(yè)銀行應(yīng)建立服務(wù)水平管理相關(guān)的制度和流程，對(duì)信息科技運(yùn)行

第四十六條商業(yè)銀行應(yīng)建立連續(xù)監(jiān)控信息系統(tǒng)性能的相關(guān)程序，及時(shí)、完整地報(bào)告例外情況；該程序應(yīng)提供預(yù)警功能，在例外情況對(duì)系統(tǒng)性能造成影響前對(duì)

第四十七條商業(yè)銀行應(yīng)制定容量規(guī)劃，以適應(yīng)由于外部環(huán)境變化產(chǎn)生的業(yè)務(wù)發(fā)

第四十八條商業(yè)銀行應(yīng)及時(shí)進(jìn)行維護(hù)和適當(dāng)?shù)南到y(tǒng)升級(jí)，以確保與技術(shù)相關(guān)服務(wù)的連續(xù)可用性，并完整保存記錄（包括疑似和實(shí)際的故障、預(yù)防性和補(bǔ)救性

第五十一條商業(yè)銀行應(yīng)評(píng)估因意外事件導(dǎo)致其業(yè)務(wù)運(yùn)行中斷的可能性及其影

（一）內(nèi)外部資源的故障或缺失（如人員、系統(tǒng)或其他資產(chǎn)）。

（二）（三）

第五十二條商業(yè)銀行應(yīng)采取系統(tǒng)恢復(fù)和雙機(jī)熱備處理等措施降低業(yè)務(wù)中斷的第五十三條商業(yè)銀行應(yīng)建立維持其運(yùn)營(yíng)連續(xù)性策略的文檔，并制定對(duì)策略的充分性和有效性進(jìn)行檢查和溝通的計(jì)劃。其中包括：

（一）規(guī)范的業(yè)務(wù)連續(xù)性計(jì)劃,明確降低短期、中期和長(zhǎng)期中斷所造成影響的措施，包括但不限于:

1．資源需求（如人員、系統(tǒng)和其他資產(chǎn)）以及獲取資源的方式。

23．與內(nèi)部各部門(mén)及外部相關(guān)各方（尤其是監(jiān)管機(jī)構(gòu)、客戶和媒體等）的溝通安

（四）當(dāng)商業(yè)銀行的業(yè)務(wù)或風(fēng)險(xiǎn)狀況發(fā)生變化時(shí)，對(duì)本條

（一）到

（三）進(jìn)行

第五十四條商業(yè)銀行的業(yè)務(wù)連續(xù)性計(jì)劃和應(yīng)急演練結(jié)果應(yīng)由信息科技風(fēng)險(xiǎn)管理部門(mén)或信息科技管理委員會(huì)確認(rèn)。第八章外

第五十五條商業(yè)銀行不得將其信息科技管理責(zé)任外包，應(yīng)合理謹(jǐn)慎監(jiān)督外包職

第五十七條商業(yè)銀行在簽署外包協(xié)議或?qū)ν獍鼌f(xié)議進(jìn)行重大變更前，應(yīng)做好相

（一）分析外包是否適合商業(yè)銀行的組織結(jié)構(gòu)和報(bào)告路線、業(yè)務(wù)戰(zhàn)略、總體風(fēng)

（二）（三）充分審查、評(píng)估外包服務(wù)商的財(cái)務(wù)穩(wěn)定性和專(zhuān)業(yè)經(jīng)驗(yàn)，對(duì)外包服務(wù)商進(jìn)

（四）考慮外包協(xié)議變更前后實(shí)施的平穩(wěn)過(guò)渡（包括終止合同可能發(fā)生的情

（五）關(guān)注可能存在的集中風(fēng)險(xiǎn)，如多家商業(yè)銀行共用同一外包服務(wù)商帶來(lái)的第五十八條商業(yè)銀行在與外包服務(wù)商合同談判過(guò)程中，應(yīng)考慮的因素包括但不

（一）（二）銀行業(yè)

（三）通過(guò)界定信息所有權(quán)、簽署保密協(xié)議和采取技術(shù)防護(hù)措施保護(hù)客戶信息

（四）（五）外包服務(wù)商遵守商業(yè)銀行有關(guān)信息科技風(fēng)險(xiǎn)制度和流程的意愿及相關(guān)措

（六）外包服務(wù)商提供的業(yè)務(wù)連續(xù)性保障水平，以及提供相關(guān)專(zhuān)屬資源的承諾。

（七）（八）變更外包協(xié)議的流程，以及商業(yè)銀行或外包服務(wù)商選擇變更或終止外包

1.商業(yè)銀行或外包服務(wù)商的所2.3.第五十九條商業(yè)銀行在實(shí)施雙方關(guān)系管理，以及起草服務(wù)水平協(xié)議時(shí)，應(yīng)考慮

（一）提出定性和定量的績(jī)效指標(biāo)，評(píng)估外包服務(wù)商為商業(yè)銀行及其相關(guān)客戶

（二）通過(guò)服務(wù)水平報(bào)告、定期自我評(píng)估、內(nèi)部或外部獨(dú)立審計(jì)進(jìn)行績(jī)效考核。

（三）針對(duì)績(jī)效不達(dá)標(biāo)的情況調(diào)整流程，采取整改措施。

第六十條商業(yè)銀行應(yīng)加強(qiáng)信息科技相關(guān)外包管理工作，確保商業(yè)銀行的客戶資

（一）（二）

（三）（四）

（五）嚴(yán)格控制外包服務(wù)商再次對(duì)外轉(zhuǎn)包，采取足夠措施確保商業(yè)銀行相關(guān)信

（六）第六十一條商業(yè)銀行應(yīng)建立恰當(dāng)?shù)膽?yīng)急措施，應(yīng)對(duì)外包服務(wù)商在服務(wù)中可能出現(xiàn)的重大缺失。尤其需要考慮外包服務(wù)商的重大資源損失，重大財(cái)務(wù)損失和重

第六十二條商業(yè)銀行所有信息科技外包合同應(yīng)由信息科技風(fēng)險(xiǎn)管理部門(mén)、法律部門(mén)和信息科技管理委員會(huì)審核通過(guò)。商業(yè)銀行應(yīng)設(shè)立流程定期審閱和修訂服

第九章內(nèi)部審計(jì)

（一）制定、實(shí)施和調(diào)整審計(jì)計(jì)劃，檢查和評(píng)估商業(yè)銀行信息科技系統(tǒng)和內(nèi)控

（二）（三）

第六十五條商業(yè)銀行應(yīng)根據(jù)業(yè)務(wù)性質(zhì)、規(guī)模和復(fù)雜程度，信息科技應(yīng)用情況，以及信息科技風(fēng)險(xiǎn)評(píng)估結(jié)果，決定信息科技內(nèi)部審計(jì)范圍和頻率。但至少應(yīng)每第六十六條商業(yè)銀行在進(jìn)行大規(guī)模系統(tǒng)開(kāi)發(fā)時(shí)，應(yīng)要求信息科技風(fēng)險(xiǎn)管理部門(mén)

第十章

第六十七條商業(yè)銀行可以在符合法律、法規(guī)和監(jiān)管要求的情況下，委托具備相

第六十八條在委托審計(jì)過(guò)程中，商業(yè)銀行應(yīng)確保外部審計(jì)機(jī)構(gòu)能夠?qū)Ρ俱y行的硬件、軟件、文檔和數(shù)據(jù)進(jìn)行檢查，以發(fā)現(xiàn)信息科技存在的風(fēng)險(xiǎn)，國(guó)家法律、第六十九條商業(yè)銀行在實(shí)施外部審計(jì)前應(yīng)與外部審計(jì)機(jī)構(gòu)進(jìn)行充分溝通，詳細(xì)

第七十二條商業(yè)銀行在委托外部審計(jì)機(jī)構(gòu)進(jìn)行外部審計(jì)時(shí)，應(yīng)與其簽訂保密協(xié)議，并督促其嚴(yán)格遵守法律法規(guī)，保守本銀行的商業(yè)秘密和信息科技風(fēng)險(xiǎn)信息，第十一章附

第七十三條未設(shè)董事會(huì)的商業(yè)銀行，應(yīng)當(dāng)由其經(jīng)營(yíng)決策機(jī)構(gòu)履行本指商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引第一章總則

第一條為加強(qiáng)商業(yè)銀行信息科技風(fēng)險(xiǎn)管理，根據(jù)《中華人民共和國(guó)銀行業(yè)監(jiān)督管理法》、《中華人民共和國(guó)商業(yè)銀行法》、《中華人民共和國(guó)外資銀行管理?xiàng)l例》，第二條

政策性銀行、農(nóng)村合作銀行、城市信用社、農(nóng)村信用社、村鎮(zhèn)銀行、貸款公司、金融資產(chǎn)管理公司、信托公司、財(cái)務(wù)公司、金融租賃公司、汽車(chē)金融公司、貨

第四條本指引所稱(chēng)信息科技風(fēng)險(xiǎn)，是指信息科技在商業(yè)銀行運(yùn)用過(guò)程中，由于自然因素、人為因素、技術(shù)漏洞和管理缺陷產(chǎn)生的操作、法律和聲譽(yù)等風(fēng)險(xiǎn)。第五條信息科技風(fēng)險(xiǎn)管理的目標(biāo)是通過(guò)建立有效的機(jī)制，實(shí)現(xiàn)對(duì)商業(yè)銀行信息科技風(fēng)險(xiǎn)的識(shí)別、計(jì)量、監(jiān)測(cè)和控制，促進(jìn)商業(yè)銀行安全、持續(xù)、穩(wěn)健運(yùn)行，推動(dòng)業(yè)務(wù)創(chuàng)新，提高信息技術(shù)使用水平，增強(qiáng)核心競(jìng)爭(zhēng)力和可持續(xù)發(fā)展能力。第二章

第六條商業(yè)銀行法定代表人是本機(jī)構(gòu)信息科技風(fēng)險(xiǎn)管理的第一責(zé)任人，負(fù)責(zé)組

第七條商業(yè)銀行的董事會(huì)應(yīng)履行以下信息科技管理職責(zé)：

（一）遵守并貫徹執(zhí)行國(guó)家有關(guān)信息科技管理的法律、法規(guī)和技術(shù)標(biāo)準(zhǔn)，落實(shí)

（二）審查批準(zhǔn)信息科技戰(zhàn)略，確保其與銀行的總體業(yè)務(wù)戰(zhàn)略和重大策略相一

（三）掌握主要的信息科技風(fēng)險(xiǎn)，確定可接受的風(fēng)險(xiǎn)級(jí)別，確保相關(guān)風(fēng)險(xiǎn)能夠

（四）規(guī)范職業(yè)道德行為和廉潔標(biāo)準(zhǔn)，增強(qiáng)內(nèi)部文化建設(shè)，提高全體人員對(duì)信

（六）在建立良好的公司治理的基礎(chǔ)上進(jìn)行信息科技治理，形成分工合理、職責(zé)明確、相互制衡、報(bào)告關(guān)系清晰的信息科技治理組織結(jié)構(gòu)。加強(qiáng)信息科技專(zhuān)

（七）確保內(nèi)部審計(jì)部門(mén)進(jìn)行獨(dú)立有效的信息科技風(fēng)險(xiǎn)管理審計(jì)，對(duì)審計(jì)報(bào)告

（八）每年審閱并向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)送信息科技風(fēng)險(xiǎn)管理的報(bào)告。

（九）（十）確保銀行所有員工充分理解和遵守經(jīng)其批準(zhǔn)的信息科技風(fēng)險(xiǎn)管理制度和

（十二）及時(shí)向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)告本機(jī)構(gòu)發(fā)生的重大信息科技事故或突

（十三）配合銀監(jiān)會(huì)及其派出機(jī)構(gòu)做好信息科技風(fēng)險(xiǎn)監(jiān)督檢查工作，并按照監(jiān)

（十四）第八條商業(yè)銀行應(yīng)設(shè)立首席信息官，直接向行長(zhǎng)匯報(bào)，并參與決策。首席信息

（一）（二）確保信息科技戰(zhàn)略，尤其是信息系統(tǒng)開(kāi)發(fā)戰(zhàn)略，符合本銀行的總體業(yè)務(wù)

（四）確保信息科技風(fēng)險(xiǎn)管理的有效性，并使有關(guān)管理措施落實(shí)到相關(guān)的每一

（五）（六）

第九條商業(yè)銀行應(yīng)對(duì)信息科技部門(mén)內(nèi)部管理職責(zé)進(jìn)行明確的界定；各崗位的人員應(yīng)具有相應(yīng)的專(zhuān)業(yè)知識(shí)和技能，重要崗位應(yīng)制定詳細(xì)完整的工作手冊(cè)并適時(shí)

（一）驗(yàn)證個(gè)人信息，包括核驗(yàn)有效身份證件、學(xué)歷證明、工作經(jīng)歷和專(zhuān)業(yè)資

（二）（三）確保員工了解、遵守信息科技策略、指導(dǎo)原則、信息保密、授權(quán)使用信

（四）評(píng)估關(guān)鍵崗位信息科技員工流失帶來(lái)的風(fēng)險(xiǎn)，做好安排候補(bǔ)員工和崗位接替計(jì)劃等

第十條商業(yè)銀行應(yīng)設(shè)立或指派一個(gè)特定部門(mén)負(fù)責(zé)信息科技風(fēng)險(xiǎn)管理工作，并直接向首席信息官或首席風(fēng)險(xiǎn)官（風(fēng)險(xiǎn)管理委員會(huì)）報(bào)告工作。該部門(mén)應(yīng)為信息科技突發(fā)事件應(yīng)急響應(yīng)小組的成員之一，負(fù)責(zé)協(xié)調(diào)制定有關(guān)信息科技風(fēng)險(xiǎn)管理策略，尤其是在涉及信息安全、業(yè)務(wù)連續(xù)性計(jì)劃和合規(guī)性風(fēng)險(xiǎn)等方面，為業(yè)務(wù)部門(mén)和信息科技部門(mén)提供建議及相關(guān)合規(guī)性信息，實(shí)施持續(xù)信息科技風(fēng)險(xiǎn)評(píng)估，第十一條商業(yè)銀行應(yīng)在內(nèi)部審計(jì)部門(mén)設(shè)立專(zhuān)門(mén)的信息科技風(fēng)險(xiǎn)審計(jì)崗位，負(fù)責(zé)信息科技審計(jì)制度和流程的實(shí)施，制訂和執(zhí)行信息科技審計(jì)計(jì)劃，對(duì)信息科技

第十三條商業(yè)銀行應(yīng)依據(jù)有關(guān)法律法規(guī)的要求，規(guī)范和及時(shí)披露信息科技風(fēng)險(xiǎn)

第三章

第十五條商業(yè)銀行應(yīng)制定全面的信息科技風(fēng)險(xiǎn)管理策略，包括但不限于下述領(lǐng)

（一）（二）

（三）（四）

（五）（六）

（七）第十六條商業(yè)銀行應(yīng)制定持續(xù)的風(fēng)險(xiǎn)識(shí)別和評(píng)估流程，確定信息科技中存在隱患的區(qū)域，評(píng)價(jià)風(fēng)險(xiǎn)對(duì)其業(yè)務(wù)的潛在影響，對(duì)風(fēng)險(xiǎn)進(jìn)行排序，并確定風(fēng)險(xiǎn)防范措施及所

第十七條商業(yè)銀行應(yīng)依據(jù)信息科技風(fēng)險(xiǎn)管理策略和風(fēng)險(xiǎn)評(píng)估結(jié)果，實(shí)施全面的（一）制定明確的信息科技風(fēng)險(xiǎn)管理制度、技術(shù)標(biāo)準(zhǔn)和操作規(guī)程等，定期進(jìn)行

1.2.3.訪問(wèn)授權(quán)以“必需知道”和“4.5.第十八條商業(yè)銀行應(yīng)建立持續(xù)的信息科技風(fēng)險(xiǎn)計(jì)量和監(jiān)測(cè)機(jī)制，其中應(yīng)包括：

（一）（二）

（三）（四）

（五）（六）

（七）定期進(jìn)行運(yùn)行環(huán)境下操作風(fēng)險(xiǎn)和管理控制的檢查。

（八）第十九條中資商業(yè)銀行在境外設(shè)立的機(jī)構(gòu)及境內(nèi)的外資商業(yè)銀行，應(yīng)當(dāng)遵守境內(nèi)外監(jiān)管機(jī)構(gòu)關(guān)于信息科技風(fēng)險(xiǎn)管理的要求，并防范因監(jiān)管差異所造成的風(fēng)險(xiǎn)。第四章

（一）（二）

（三）（四）

（五）（六）

（七）（八）

（九）（十）業(yè)務(wù)連續(xù)性管

（一）（二）

（三）（四）

（五）域的性質(zhì)，如生產(chǎn)域或測(cè)試域、內(nèi)部域或外部域。

（六）（七）

第二十五條商業(yè)銀行應(yīng)通過(guò)以下措施，確保所有計(jì)算機(jī)操作系統(tǒng)和系統(tǒng)軟件的

（一）制定每種類(lèi)型操作系統(tǒng)的基本安全要求，確保所有系統(tǒng)滿足基本安全要

（二）明確定義包括終端用戶、系統(tǒng)開(kāi)發(fā)人員、系統(tǒng)測(cè)試人員、計(jì)算機(jī)操作人

（三）制定最高權(quán)限系統(tǒng)賬戶的審批、驗(yàn)證和監(jiān)控流程，并確保最高權(quán)限用戶

（四）（五）在系統(tǒng)日志中記錄不成功的登錄、重要系統(tǒng)文件的訪問(wèn)、對(duì)用戶賬戶的修改等有關(guān)重要事項(xiàng)，手動(dòng)或自動(dòng)監(jiān)控系統(tǒng)出現(xiàn)的任何異常事件，定期匯報(bào)監(jiān)

第二十六條

（一）明確定義終端用戶和信息科技技術(shù)人員在信息系統(tǒng)安全中的角色和職

（二）（三）加強(qiáng)職責(zé)劃分，對(duì)關(guān)鍵或敏感崗位進(jìn)行雙重控制。

（七）（八）

第二十七條商業(yè)銀行應(yīng)制定相關(guān)策略和流程，管理所有生產(chǎn)系統(tǒng)的活動(dòng)日志，以支持有效的審核、安全取證分析和預(yù)防欺詐。日志可以在軟件的不同層次、（一）交易日志。交易日志由應(yīng)用軟件和數(shù)據(jù)庫(kù)管理系統(tǒng)產(chǎn)生，內(nèi)容包括用戶登錄嘗試、數(shù)據(jù)修改、錯(cuò)誤信息等。交易日志應(yīng)按照國(guó)家會(huì)計(jì)準(zhǔn)則要求予以保

（二）系統(tǒng)日志。系統(tǒng)日志由操作系統(tǒng)、數(shù)據(jù)庫(kù)管理系統(tǒng)、防火墻、入侵檢測(cè)系統(tǒng)和路由器等生成，內(nèi)容包括管理登錄嘗試、系統(tǒng)事件、網(wǎng)絡(luò)事件、錯(cuò)誤信

第二十八條商業(yè)銀行應(yīng)采取加密技術(shù)，防范涉密信息在傳輸、處理、存儲(chǔ)過(guò)程

（一）（二）管理、使用密碼設(shè)備的員工經(jīng)過(guò)專(zhuān)業(yè)培訓(xùn)和嚴(yán)格審查。

（三）（四）

第三十一條商業(yè)銀行應(yīng)對(duì)所有員工進(jìn)行必要的培訓(xùn)，使其充分掌握信息科技風(fēng)險(xiǎn)管理制度和流程，了解違反規(guī)定的后果，并對(duì)違反安全規(guī)定的行為采取零容

第五章

第三十二條商業(yè)銀行應(yīng)有能力對(duì)信息系統(tǒng)進(jìn)行需求分析、規(guī)劃、采購(gòu)、開(kāi)發(fā)、測(cè)試、部署、維護(hù)、升級(jí)和報(bào)廢，制定制度和流程，管理信息科技項(xiàng)目的優(yōu)先排序、立項(xiàng)、審批和控制。項(xiàng)目實(shí)施部門(mén)應(yīng)定期向信息科技管理委員會(huì)提交重大信息科技項(xiàng)目的進(jìn)度報(bào)告，由其進(jìn)行審核，進(jìn)度報(bào)告應(yīng)當(dāng)包括計(jì)劃的重大變更、關(guān)鍵人員或供應(yīng)商的變更以及主要費(fèi)用支出情況。應(yīng)在信息系統(tǒng)投產(chǎn)后一定時(shí)期內(nèi)，組織對(duì)系統(tǒng)的后評(píng)價(jià)，并根據(jù)評(píng)價(jià)結(jié)果及時(shí)對(duì)系統(tǒng)功能進(jìn)行調(diào)整和優(yōu)化。第三十三條商業(yè)銀行應(yīng)認(rèn)識(shí)到信息科技項(xiàng)目相關(guān)的風(fēng)險(xiǎn)，包括潛在的各種操作風(fēng)險(xiǎn)、財(cái)務(wù)損失風(fēng)險(xiǎn)和因無(wú)效項(xiàng)目規(guī)劃或不適當(dāng)?shù)捻?xiàng)目管理控制產(chǎn)生的第三十四條商業(yè)銀行應(yīng)采取適當(dāng)?shù)南到y(tǒng)開(kāi)發(fā)方法，控制信息系統(tǒng)的生命周期。典型的系統(tǒng)生命周期包括系統(tǒng)分析、設(shè)計(jì)、開(kāi)發(fā)或外購(gòu)、測(cè)試、試運(yùn)行、部署、維護(hù)和退出。所采用的系統(tǒng)開(kāi)發(fā)方法應(yīng)符合信息科技項(xiàng)目的規(guī)模、性質(zhì)和復(fù)雜

第三十五條商業(yè)銀行應(yīng)制定相關(guān)控制信息系統(tǒng)變更的制度和流程，確保系統(tǒng)的（一）

（二）生產(chǎn)系統(tǒng)與開(kāi)發(fā)系統(tǒng)、測(cè)試系統(tǒng)的管理職能相分離。

（三）除得到管理層批準(zhǔn)執(zhí)行緊急修復(fù)任務(wù)外，禁止應(yīng)用程序開(kāi)發(fā)和維護(hù)人員進(jìn)入生產(chǎn)系統(tǒng)，且所有

第六章

第四十一條商業(yè)銀行應(yīng)將信息科技運(yùn)行與系統(tǒng)開(kāi)發(fā)和維護(hù)分離，確保信息科技

第四十二條商業(yè)銀行應(yīng)按照有關(guān)法律法規(guī)要求保存交易記錄，采取必要的程序

第四十五條商業(yè)銀行應(yīng)建立服務(wù)水平管理相關(guān)的制度和流程，對(duì)信息科技運(yùn)行

第四十七條商業(yè)銀行應(yīng)制定容量規(guī)劃，以適應(yīng)由于外部環(huán)境變化產(chǎn)生的業(yè)務(wù)發(fā)

第五十一條商業(yè)銀行應(yīng)評(píng)估因意外事件導(dǎo)致其業(yè)務(wù)運(yùn)行中斷的可能性及其影

（一）內(nèi)外部資源的故障或缺失（如人員、系統(tǒng)或其他資產(chǎn)）。

（二）（三）

（一）規(guī)范的業(yè)務(wù)連續(xù)性計(jì)劃,明確降低短期、中期和長(zhǎng)期中斷所造成影響的措施，包括但不限于:

1．資源需求（如人員、系統(tǒng)和其他資產(chǎn)）以及獲取資源的方式。

23．與內(nèi)部各部門(mén)及外部相關(guān)各方（尤其是監(jiān)管機(jī)構(gòu)、客戶和媒體等）的溝通安

（四）當(dāng)商業(yè)銀行的業(yè)務(wù)或風(fēng)險(xiǎn)狀況發(fā)生變化時(shí)，對(duì)本條

（一）到

（三）進(jìn)行

第五十五條商業(yè)銀行不得將其信息科技管理責(zé)任外包，應(yīng)合理謹(jǐn)慎監(jiān)督外包職

第五十七條商業(yè)銀行在簽署外包協(xié)議或?qū)ν獍鼌f(xié)議進(jìn)行重大變更前，應(yīng)做好相

（一）分析外包是否適合商業(yè)銀行的組織結(jié)構(gòu)和報(bào)告路線、業(yè)務(wù)戰(zhàn)略、總體風(fēng)

（二）（三）充分審查、評(píng)估外包服務(wù)商的財(cái)務(wù)穩(wěn)定性和專(zhuān)業(yè)經(jīng)驗(yàn)，對(duì)外包服務(wù)商進(jìn)

（四）考慮外包協(xié)議變更前后實(shí)施的平穩(wěn)過(guò)渡（包括終止合同可能發(fā)生的情

（一）（二）

（三）通過(guò)界定信息所有權(quán)、簽署保密協(xié)議和采取技術(shù)防護(hù)措施保護(hù)客戶信息

（四）（五）外包服務(wù)商遵守商業(yè)銀行有關(guān)信息科技風(fēng)險(xiǎn)制度和流程的意愿及相關(guān)措

（六）外包服務(wù)商提供的業(yè)務(wù)連續(xù)性保障水平，以及提供相關(guān)專(zhuān)屬資源的承諾。

（七）（八）變更外包協(xié)議的流程，以及商業(yè)銀行或外包服務(wù)商選擇變更或終止外包

1.2.3.第五十九條商業(yè)銀行在實(shí)施雙方關(guān)系管理，以及起草服務(wù)水平協(xié)議時(shí)，應(yīng)考慮

（一）提出定性和定量的績(jī)效指標(biāo)，評(píng)估外包服務(wù)商為商業(yè)銀行及其相關(guān)客戶

（二）通過(guò)服務(wù)水平報(bào)告、定期自我評(píng)估、內(nèi)部或外部獨(dú)立審計(jì)進(jìn)行績(jī)效考核。

（三）針對(duì)績(jī)效不達(dá)標(biāo)的情況調(diào)整流程，采取整改措施。

第六十條商業(yè)銀行應(yīng)加強(qiáng)信息科技相關(guān)外包管理工作，確保商業(yè)銀行的客戶資

（一）（二）

（三）（四）

（五）嚴(yán)格控制外包服務(wù)商再次對(duì)外轉(zhuǎn)包，采取足夠措施確保商業(yè)銀行相關(guān)信息

第九章

（一）制定、實(shí)施和調(diào)整審計(jì)計(jì)劃，檢查和評(píng)估商業(yè)銀行信息科技系統(tǒng)和內(nèi)控

（二）（三）

第十章

第六十七條商業(yè)銀行可以在符合法律、法規(guī)和監(jiān)管要求的情況下，委托具備相

第七十三條未設(shè)董事會(huì)的商業(yè)銀行，應(yīng)當(dāng)由其經(jīng)營(yíng)決策機(jī)構(gòu)履行本指引中董事

第七十四條第七十五條

第三篇：《商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引》

銀監(jiān)會(huì)發(fā)布《商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引》

為進(jìn)一步加強(qiáng)商業(yè)銀行信息科技風(fēng)險(xiǎn)管理，銀監(jiān)會(huì)近日發(fā)布《商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引》（以下簡(jiǎn)稱(chēng)《管理指引》），原《銀行業(yè)金融機(jī)構(gòu)信息系統(tǒng)風(fēng)險(xiǎn)管理指引》（銀監(jiān)發(fā)［2006］63號(hào)，以下簡(jiǎn)稱(chēng)原《指引》）同時(shí)廢止。

隨著銀行業(yè)信息化的發(fā)展，信息科技的作用已經(jīng)從業(yè)務(wù)支持逐步走向與業(yè)務(wù)的融合，成為銀行穩(wěn)健運(yùn)營(yíng)和發(fā)展的支柱，原《指引》定位在信息系統(tǒng)風(fēng)險(xiǎn)管理的基本、原則性要求，已難以滿足商業(yè)銀行信息科技風(fēng)險(xiǎn)管理的需要。為此，銀監(jiān)會(huì)在原《指引》的基礎(chǔ)上，廣泛征求業(yè)內(nèi)機(jī)構(gòu)意見(jiàn)，制定了本《管理指引》。

《管理指引》具有以下幾個(gè)特點(diǎn)：一是全面涵蓋商業(yè)銀行的信息科技活動(dòng)，進(jìn)一步明確信息科技與銀行業(yè)務(wù)的關(guān)系，對(duì)于認(rèn)識(shí)和防范風(fēng)險(xiǎn)具有更加積極的作用；二是適用范圍由銀行業(yè)金融機(jī)構(gòu)變?yōu)榉ㄈ松虡I(yè)銀行，其他銀行業(yè)金融機(jī)構(gòu)參照?qǐng)?zhí)行；三是信息科技治理作為首要內(nèi)容提出，充實(shí)并細(xì)化了對(duì)商業(yè)銀行在治理層面的具體要求；四是重點(diǎn)闡述了信息科技風(fēng)險(xiǎn)管理和內(nèi)外部審計(jì)要求，特別是要求審計(jì)貫穿信息科技活動(dòng)的整個(gè)過(guò)程之中；五是參照國(guó)際國(guó)內(nèi)的標(biāo)準(zhǔn)和成功實(shí)踐，對(duì)商業(yè)銀行信息科技整個(gè)生命周期內(nèi)的信息安全、業(yè)務(wù)連續(xù)性管理和外包等方面提出高標(biāo)準(zhǔn)、高要求，使操作性更強(qiáng)；六是加強(qiáng)了對(duì)客戶信息保護(hù)的要求。

新《指引》共十一章七十六條，分為總則，信息科技治理，信息科技風(fēng)險(xiǎn)管理，信息安全，信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)，信息科技運(yùn)行，業(yè)務(wù)連續(xù)性管理，外包，內(nèi)部審計(jì)，外部審計(jì)和附則等十一個(gè)部分。新《指引》的發(fā)布，將進(jìn)一步推動(dòng)我國(guó)銀行業(yè)信息科技風(fēng)險(xiǎn)管理向更高水平邁進(jìn)。

商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

第一章總則

第二條本指引適用于在中華人民共和國(guó)境內(nèi)依法設(shè)立的法人商業(yè)銀行。

第二章信息科技治理

第六條商業(yè)銀行法定代表人是本機(jī)構(gòu)信息科技風(fēng)險(xiǎn)管理的第一責(zé)任人，負(fù)責(zé)組織本指引的貫徹落實(shí)。

第七條商業(yè)銀行的董事會(huì)應(yīng)履行以下信息科技管理職責(zé)：

（八）每年審閱并向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)送信息科技風(fēng)險(xiǎn)管理的報(bào)告。

（九）確保信息科技風(fēng)險(xiǎn)管理工作所需資金。

（十）確保銀行所有員工充分理解和遵守經(jīng)其批準(zhǔn)的信息科技風(fēng)險(xiǎn)管理制度和流程，并安排相關(guān)培訓(xùn)。

（十三）配合銀監(jiān)會(huì)及其派出機(jī)構(gòu)做好信息科技風(fēng)險(xiǎn)監(jiān)督檢查工作，并按照監(jiān)管意見(jiàn)進(jìn)行整改。

（十四）履行信息科技風(fēng)險(xiǎn)管理其他相關(guān)工作。

第八條商業(yè)銀行應(yīng)設(shè)立首席信息官，直接向行長(zhǎng)匯報(bào)，并參與決策。首席信息官的職責(zé)包括：

（一）直接參與本銀行與信息科技運(yùn)用有關(guān)的業(yè)務(wù)發(fā)展決策。

（五）組織專(zhuān)業(yè)培訓(xùn)，提高人才隊(duì)伍的專(zhuān)業(yè)技能。

（六）履行信息科技風(fēng)險(xiǎn)管理其他相關(guān)工作。

（一）驗(yàn)證個(gè)人信息，包括核驗(yàn)有效身份證件、學(xué)歷證明、工作經(jīng)歷和專(zhuān)業(yè)資格證書(shū)等信息。

（二）審核信息科技員工的道德品行，確保其具備相應(yīng)的職業(yè)操守。

（四）評(píng)估關(guān)鍵崗位信息科技員工流失帶來(lái)的風(fēng)險(xiǎn)，做好安排候補(bǔ)員工和崗位接替計(jì)劃等防范措施；在員工崗位發(fā)生變化后及時(shí)變更相關(guān)信息。

第十三條商業(yè)銀行應(yīng)依據(jù)有關(guān)法律法規(guī)的要求，規(guī)范和及時(shí)披露信息科技風(fēng)險(xiǎn)狀況。

第三章信息科技風(fēng)險(xiǎn)管理

第十五條商業(yè)銀行應(yīng)制定全面的信息科技風(fēng)險(xiǎn)管理策略，包括但不限于下述領(lǐng)域：

（一）信息分級(jí)與保護(hù)。

（二）信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)。

（三）信息科技運(yùn)行和維護(hù)。

（四）訪問(wèn)控制。

（五）物理安全。

（六）人員安全。

（七）業(yè)務(wù)連續(xù)性計(jì)劃與應(yīng)急處臵。

（一）制定明確的信息科技風(fēng)險(xiǎn)管理制度、技術(shù)標(biāo)準(zhǔn)和操作規(guī)程等，定期進(jìn)行更新和公示。

1.最高權(quán)限用戶的審查。

2.控制對(duì)數(shù)據(jù)和系統(tǒng)的物理和邏輯訪問(wèn)。

3.訪問(wèn)授權(quán)以“必需知道”和“最小授權(quán)”為原則。 4.審批和授權(quán)。 5.驗(yàn)證和調(diào)節(jié)。

十八條商業(yè)銀行應(yīng)建立持續(xù)的信息科技風(fēng)險(xiǎn)計(jì)量和監(jiān)測(cè)機(jī)制，其中應(yīng)包括：

（一）建立信息科技項(xiàng)目實(shí)施前及實(shí)施后的評(píng)價(jià)機(jī)制。

（二）建立定期檢查系統(tǒng)性能的程序和標(biāo)準(zhǔn)。

（三）建立信息科技服務(wù)投訴和事故處理的報(bào)告機(jī)制。

（四）建立內(nèi)部審計(jì)、外部審計(jì)和監(jiān)管發(fā)現(xiàn)問(wèn)題的整改處理機(jī)制。

（五）安排供應(yīng)商和業(yè)務(wù)部門(mén)對(duì)服務(wù)水平協(xié)議的完成情況進(jìn)行定期審查。

（六）定期評(píng)估新技術(shù)發(fā)展可能造成的影響和已使用軟件面臨的新威脅。

（七）定期進(jìn)行運(yùn)行環(huán)境下操作風(fēng)險(xiǎn)和管理控制的檢查。

（八）定期進(jìn)行信息科技外包項(xiàng)目的風(fēng)險(xiǎn)狀況評(píng)價(jià)。

第四章信息安全

信息安全策略應(yīng)涉及以下領(lǐng)域：

（一）安全制度管理。

（二）信息安全組織管理。

（三）資產(chǎn)管理。

（四）人員安全管理。

（五）物理與環(huán)境安全管理。

（六）通信與運(yùn)營(yíng)管理。

（七）訪問(wèn)控制管理。

（八）系統(tǒng)開(kāi)發(fā)與維護(hù)管理。

（九）信息安全事故管理。

（十）業(yè)務(wù)連續(xù)性管理。

（十一）合規(guī)性管理。

第二十四條商業(yè)銀行應(yīng)根據(jù)信息安全級(jí)別，將網(wǎng)絡(luò)劃分為不同的邏輯安全域（以下簡(jiǎn)稱(chēng)為域）。應(yīng)該對(duì)下列安全因素進(jìn)行評(píng)估，并根據(jù)安全級(jí)別定義和評(píng)估結(jié)果實(shí)施有效的安全控制，4 如對(duì)每個(gè)域和整個(gè)網(wǎng)絡(luò)進(jìn)行物理或邏輯分區(qū)、實(shí)現(xiàn)網(wǎng)絡(luò)內(nèi)容過(guò)濾、邏輯訪問(wèn)控制、傳輸加密、網(wǎng)絡(luò)監(jiān)控、記錄活動(dòng)日志等。

（一）域內(nèi)應(yīng)用程序和用戶組的重要程度。

（二）各種通訊渠道進(jìn)入域的訪問(wèn)點(diǎn)。

（三）域內(nèi)配臵的網(wǎng)絡(luò)設(shè)備和應(yīng)用程序使用的網(wǎng)絡(luò)協(xié)議和端口。

（四）性能要求或標(biāo)準(zhǔn)。

（五）域的性質(zhì)，如生產(chǎn)域或測(cè)試域、內(nèi)部域或外部域。

（六）不同域之間的連通性。

（七）域的可信程度。

第二十五條商業(yè)銀行應(yīng)通過(guò)以下措施，確保所有計(jì)算機(jī)操作系統(tǒng)和系統(tǒng)軟件的安全：

（一）制定每種類(lèi)型操作系統(tǒng)的基本安全要求，確保所有系統(tǒng)滿足基本安全要求。

（三）制定最高權(quán)限系統(tǒng)賬戶的審批、驗(yàn)證和監(jiān)控流程，并確保最高權(quán)限用戶的操作日志被記錄和監(jiān)察。

（四）要求技術(shù)人員定期檢查可用的安全補(bǔ)丁，并報(bào)告補(bǔ)丁管理狀態(tài)。

（五）在系統(tǒng)日志中記錄不成功的登錄、重要系統(tǒng)文件的訪問(wèn)、對(duì)用戶賬戶的修改等有關(guān)重要事項(xiàng)，手動(dòng)或自動(dòng)監(jiān)控系統(tǒng)出現(xiàn)的任何異常事件，定期匯報(bào)監(jiān)控情況。

第二十六條商業(yè)銀行應(yīng)通過(guò)以下措施，確保所有信息系統(tǒng)的安全：

（一）明確定義終端用戶和信息科技技術(shù)人員在信息系統(tǒng)安全中的角色和職責(zé)。

（二）針對(duì)信息系統(tǒng)的重要性和敏感程度，采取有效的身份驗(yàn)證方法。

（三）加強(qiáng)職責(zé)劃分，對(duì)關(guān)鍵或敏感崗位進(jìn)行雙重控制。

（四）在關(guān)鍵的接合點(diǎn)進(jìn)行輸入驗(yàn)證或輸出核對(duì)。

（五）采取安全的方式處理保密信息的輸入和輸出，防止信息泄露或被盜取、篡改。

（六）確保系統(tǒng)按預(yù)先定義的方式處理例外情況，當(dāng)系統(tǒng)被迫終止時(shí)向用戶提供必要信息。

（七）以書(shū)面或電子格式保存審計(jì)痕跡。

（八）要求用戶管理員監(jiān)控和審查未成功的登錄和用戶賬戶的修改。

第二十八條商業(yè)銀行應(yīng)采取加密技術(shù)，防范涉密信息在傳輸、處理、存儲(chǔ)過(guò)程中出現(xiàn)泄露或被篡改的風(fēng)險(xiǎn)，并建立密碼設(shè)備管理制度，以確保：

（一）使用符合國(guó)家要求的加密技術(shù)和加密設(shè)備。

（二）管理、使用密碼設(shè)備的員工經(jīng)過(guò)專(zhuān)業(yè)培訓(xùn)和嚴(yán)格審查。

（三）加密強(qiáng)度滿足信息機(jī)密性的要求。

（四）制定并落實(shí)有效的管理流程，尤其是密鑰和證書(shū)生命周期管理。

第三十一條商業(yè)銀行應(yīng)對(duì)所有員工進(jìn)行必要的培訓(xùn)，使其充分掌握信息科技風(fēng)險(xiǎn)管理制度和流程，了解違反規(guī)定的后果，并對(duì)違反安全規(guī)定的行為采取零容忍政策。

第五章信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)

第三十五條商業(yè)銀行應(yīng)制定相關(guān)控制信息系統(tǒng)變更的制度和流程，確保系統(tǒng)的可靠性、完整性和可維護(hù)性，其中應(yīng)包括以下要求：

（一）生產(chǎn)系統(tǒng)與開(kāi)發(fā)系統(tǒng)、測(cè)試系統(tǒng)有效隔離。

（二）生產(chǎn)系統(tǒng)與開(kāi)發(fā)系統(tǒng)、測(cè)試系統(tǒng)的管理職能相分離。

第六章信息科技運(yùn)行

第四十一條商業(yè)銀行應(yīng)將信息科技運(yùn)行與系統(tǒng)開(kāi)發(fā)和維護(hù)分離，確保信息科技部門(mén)內(nèi)部的崗位制約；對(duì)數(shù)據(jù)中心的崗位和職責(zé)做出明確規(guī)定。

第四十二條商業(yè)銀行應(yīng)按照有關(guān)法律法規(guī)要求保存交易記錄，采取必要的程序和技術(shù)，確保存檔數(shù)據(jù)的完整性，滿足安全保存和可恢復(fù)要求。

第四十五條商業(yè)銀行應(yīng)建立服務(wù)水平管理相關(guān)的制度和流程，對(duì)信息科技運(yùn)行服務(wù)水平進(jìn)行考核。

第四十七條商業(yè)銀行應(yīng)制定容量規(guī)劃，以適應(yīng)由于外部環(huán)境變化產(chǎn)生的業(yè)務(wù)發(fā)展和交易量增長(zhǎng)。容量規(guī)劃應(yīng)涵蓋生產(chǎn)系統(tǒng)、備份系統(tǒng)及相關(guān)設(shè)備。

第七章業(yè)務(wù)連續(xù)性管理

（一）內(nèi)外部資源的故障或缺失（如人員、系統(tǒng)或其他資產(chǎn)）。

（二）信息丟失或受損。

（三）外部事件（如戰(zhàn)爭(zhēng)、地震或臺(tái)風(fēng)等）。

（一）規(guī)范的業(yè)務(wù)連續(xù)性計(jì)劃,明確降低短期、中期和長(zhǎng)期中斷所造成影響的措施，包括但不限于:

1．資源需求（如人員、系統(tǒng)和其他資產(chǎn)）以及獲取資源的方式。2．運(yùn)行恢復(fù)的優(yōu)先順序。

3．與內(nèi)部各部門(mén)及外部相關(guān)各方（尤其是監(jiān)管機(jī)構(gòu)、客戶和媒體等）的溝通安排。

（二）更新實(shí)施業(yè)務(wù)連續(xù)性計(jì)劃的流程及相關(guān)聯(lián)系信息。

（三）驗(yàn)證受中斷影響的信息完整性的步驟。

（四）當(dāng)商業(yè)銀行的業(yè)務(wù)或風(fēng)險(xiǎn)狀況發(fā)生變化時(shí)，對(duì)本條

（一）到

（三）進(jìn)行審核并升級(jí)。

第五十四條商業(yè)銀行的業(yè)務(wù)連續(xù)性計(jì)劃和應(yīng)急演練結(jié)果應(yīng)由信息科技風(fēng)險(xiǎn)管理部門(mén)或信息科技管理委員會(huì)確認(rèn)。

第八章外包

第五十五條商業(yè)銀行不得將其信息科技管理責(zé)任外包，應(yīng)合理謹(jǐn)慎監(jiān)督外包職能的履行。

第五十七條商業(yè)銀行在簽署外包協(xié)議或?qū)ν獍鼌f(xié)議進(jìn)行重大變更前，應(yīng)做好相關(guān)準(zhǔn)備，其中包括：

（二）考慮外包協(xié)議是否允許商業(yè)銀行監(jiān)測(cè)和控制與外包相關(guān)的操作風(fēng)險(xiǎn)。

（四）考慮外包協(xié)議變更前后實(shí)施的平穩(wěn)過(guò)渡（包括終止合同可能發(fā)生的情況）。

第五十八條商業(yè)銀行在與外包服務(wù)商合同談判過(guò)程中，應(yīng)考慮的因素包括但不限于： 

（一）對(duì)外包服務(wù)商的報(bào)告要求和談判必要條件。

（二）銀行業(yè)監(jiān)管機(jī)構(gòu)和內(nèi)部審計(jì)、外部審計(jì)能執(zhí)行足夠的監(jiān)督。

（三）通過(guò)界定信息所有權(quán)、簽署保密協(xié)議和采取技術(shù)防護(hù)措施保護(hù)客戶信息和其他信息。

（四）擔(dān)保和損失賠償是否充足。

（五）外包服務(wù)商遵守商業(yè)銀行有關(guān)信息科技風(fēng)險(xiǎn)制度和流程的意愿及相關(guān)措施。

（六）外包服務(wù)商提供的業(yè)務(wù)連續(xù)性保障水平，以及提供相關(guān)專(zhuān)屬資源的承諾。

（七）第三方供應(yīng)商出現(xiàn)問(wèn)題時(shí)，保證軟件持續(xù)可用的相關(guān)措施。

（八）變更外包協(xié)議的流程，以及商業(yè)銀行或外包服務(wù)商選擇變更或終止外包協(xié)議的條件，例如：

1.商業(yè)銀行或外包服務(wù)商的所有權(quán)或控制權(quán)發(fā)生變化。

2.商業(yè)銀行或外包服務(wù)商的業(yè)務(wù)經(jīng)營(yíng)發(fā)生重大變化。

3.外包服務(wù)商提供的服務(wù)不充分，造成商業(yè)銀行不能履行監(jiān)督義務(wù)。

第五十九條商業(yè)銀行在實(shí)施雙方關(guān)系管理，以及起草服務(wù)水平協(xié)議時(shí)，應(yīng)考慮的因素包括但不限于：

（一）提出定性和定量的績(jī)效指標(biāo)，評(píng)估外包服務(wù)商為商業(yè)銀行及其相關(guān)客戶提供服務(wù)的充分性。

（二）通過(guò)服務(wù)水平報(bào)告、定期自我評(píng)估、內(nèi)部或外部獨(dú)立審計(jì)進(jìn)行績(jī)效考核。

（三）針對(duì)績(jī)效不達(dá)標(biāo)的情況調(diào)整流程，采取整改措施。

第六十條商業(yè)銀行應(yīng)加強(qiáng)信息科技相關(guān)外包管理工作，確保商業(yè)銀行的客戶資料等敏感信息的安全，包括但不限于采取以下措施：

（一）實(shí)現(xiàn)本銀行客戶資料與外包服務(wù)商其他客戶資料的有效隔離。

（二）按照“必需知道”和“最小授權(quán)”原則對(duì)外包服務(wù)商相關(guān)人員授權(quán)。

（三）要求外包服務(wù)商保證其相關(guān)人員遵守保密規(guī)定。

（四）應(yīng)將涉及本銀行客戶資料的外包作為重要外包，并告知相關(guān)客戶。

（五）嚴(yán)格控制外包服務(wù)商再次對(duì)外轉(zhuǎn)包，采取足夠措施確保商業(yè)銀行相關(guān)信息的安全。

（六）確保在中止外包協(xié)議時(shí)收回或銷(xiāo)毀外包服務(wù)商保存的所有客戶資料。

第六十二條商業(yè)銀行所有信息科技外包合同應(yīng)由信息科技風(fēng)險(xiǎn)管理部門(mén)、法律部門(mén)和信息科技管理委員會(huì)審核通過(guò)。商業(yè)銀行應(yīng)設(shè)立流程定期審閱和修訂服務(wù)水平協(xié)議。

第九章內(nèi)部審計(jì)

第六十四條商業(yè)銀行內(nèi)部信息科技審計(jì)的責(zé)任包括：

（一）制定、實(shí)施和調(diào)整審計(jì)計(jì)劃，檢查和評(píng)估商業(yè)銀行信息科技系統(tǒng)和內(nèi)控機(jī)制的充分性和有效性。

（二）按照第（一）款規(guī)定完成審計(jì)工作，在此基礎(chǔ)上提出整改意見(jiàn)。

（三）檢查整改意見(jiàn)是否得到落實(shí)。

第十章外部審計(jì)

第十一章附則

第七十四條銀監(jiān)會(huì)依法對(duì)商業(yè)銀行的信息科技風(fēng)險(xiǎn)管理實(shí)施監(jiān)督檢查。

第七十五條本指引由銀監(jiān)會(huì)負(fù)責(zé)解釋、修訂。

發(fā)文單位：中國(guó)銀行業(yè)監(jiān)督管理委員會(huì)

發(fā)布日期：2009-6-1 執(zhí)行日期：2009-6-1

Chapter I General Provisions

Article 1.Pursuant to the Law of the People?s Republic of China on Banking Regulation and Supervision，the Law of the People's Republic of China on Commercial Banks，the Regulations of the People?s Republic of China on Administration of Foreign-funded Banks，and other applicable laws and regulations，the Guidelines on the Risk Management of Commercial Banks? Information Technology（hereinafter referred to as the Guidelines）is formulated.Article 2.The Guidelines apply to all the commercial banks legally incorporated within the territory of the People?s Republic of China.The Guidelines may apply to other banking institutions including policy banks，rural cooperative banks，urban credit cooperatives，rural credit cooperatives，village banks，loan companies，financial asset management companies，trust and investment companies，finance firms，financial leasing companies，automobile financial companies and money brokers.Article 3.The term “information technology” stated in the Guidelines shall refer to the system built with computer，communication and software technologies，and employed by commercial banks to handle business transactions，operation management，and internal communication，collaborative work and controls.The term also include IT governance，IT organization structure and IT policies and procedures.Article 4.The risk of information technology refers to the operational risk，legal risk and reputation risk that are caused by natural factor，human factor，technological loopholes or management deficiencies when using information technology.Article 5.The objective of information system risk management is to establish an effective mechanism that can identify，measure，monitor，and control the risks of commercial banks? information system，ensure data integrity，availability，confidentiality and consistency，provide the relevant early warning，and thereby enable commercial banks? business innovations，uplift their capability in utilizing information technology，improve their core competitiveness and capacity for sustainable development.Chapter II IT governance

（1）Implementing and complying with the national laws，regulations and technical standards pertaining to the management of information systems，as well as the regulatory requirements set by the China Banking Regulatory Commission（hereinafter referred to as the “CBRC”）；

（2）Periodically reviewing the alignment of IT strategy with the overall business strategies and significant policies of the bank，assessing the overall effectiveness and efficiency of the IT organization.（3）Approving IT risk management strategies and policies，understanding the major IT risks involved，setting acceptable levels for these risks，and ensuring the implementation of the measures necessary to identify，measure，monitor and control these risks.（4）Setting high ethical and integrity standards，and establishing a culture within the bank that emphasizes and demonstrates to all levels of personnel the importance of IT risk management.（5）Establishing an IT steering committee which consists of representatives from senior management，the IT organization，and major business units，to oversee these responsibilities and report the effectiveness of strategic IT planning，the IT budget and actual expenditure，and the overall IT performance to the board of directors and senior management periodically.（6）Establishing IT governance structure，proper segregation of duty，clear role and responsibility，maintaining check and balances and clear reporting relationship.Strengthening IT professional staff by developing incentive program.（7）Ensuring that there is an effective internal audit of the IT risk management carried out by operationally independent，well-trained and qualified staff.The internal audit report should be submitted directly to the IT audit committee；

（8）Submitting an annual report to the CBRC and its local offices on information system risk management that has been reviewed and approved by the board of directors ；

（9）Ensuring the appropriating funding necessary for IT risk management works；

（10）Ensuring that all employees of the bank fully understand and adhere to the IT risk management policies and procedures approved by the board of directors and the senior management，and are provided with pertinent training.（11）Ensuring customer information，financial information，product information and core banking system of the legal entity are held independently within the territory，and complying with the regulatory on-site examination requirements of CBRC and guarding against cross-border risk.（12）Reporting in a timely manner to the CBRC and its local offices any serious incident of information systems or unexpected event，and quickly respond to it in accordance with the contingency plan；

（13）Cooperating with the CBRC and its local offices in the supervisory inspection of the risk management of information systems，and ensure that supervisory opinions are followed up； and

（14）Performing other related IT risk management tasks.Article 8.The head of the IT organization，commonly known as the Chief Information Officer（CIO）should report directly to the president.Roles and responsibilities of the CIO should include the following：

（1）Playing a direct role in key decisions for the business development involving the use of IT in the bank；

（2）The CIO should ensure that information systems meet the needs of the bank，and IT strategies，in particular information system development strategies，comply with the overall business strategies and IT risk management policies of the bank；

（3）The CIO should also be responsible for the establishment of an effective and efficient IT organization to carry out the IT functions of the bank.These include the IT budget and expenditure，IT risk management，IT policies，standards and procedures，IT internal controls，professional development，IT project initiatives，IT project management，information system maintenance and upgrade，IT operations，IT infrastructure，Information security，disaster recovery plan（DRP），IT outsourcing，and information system retirement；

（4）Ensuring the effectiveness of IT risk management throughout the organization including all branches.（5）Organizing professional trainings to improve technical proficiency of staff.（6）Performing other related IT risk management tasks.Article 9.Commercial banks should ensure that a clear definition of the IT organization structure and documentation of all job descriptions of important positions are always in place and updated in a timely manner.Staff in each position should meet relevant requirements on professional skills and knowledge.The following risk mitigation measures should be incorporated in the management program of related staff：

（1）Verification of personal information including confirmation of personal identification issued by government，academic credentials，prior work experience，professional qualifications；

（2）Ensuring that IT staff can meet the required professional ethics by checking character reference；

（3）Signing of agreements with employees about understanding of IT policies and guidelines，non-disclosure of confidential information，authorized use of information systems，and adherence to IT policies and procedures； and

（4）Evaluation of the risk of losing key IT personnel，especially during major IT development stage or in a period of unstable IT operations，and the relevant risk mitigation measures such as staff backup arrangement and staff succession plan.13

Article 10.Commercial banks should establish or designate a particular department for IT risk management.It should report directly to the CIO and the Chief Risk Officer（or risk management committee），serve as a member of the IT incident response team，and be responsible for coordinating the establishment of policies regarding IT risk management，especially the areas of information security，BCP，and compliance with the CBRC regulations，advising the business departments and IT department in implementing these policies，providing relevant compliance information，conducting on-going assessment of IT risks，and ensuring the follow-up of remediation advice，monitoring and escalating management of IT threats and non-compliance events.Article 11.Commercial banks should establish a special IT audit role and responsibility within internal audit function，which should put in place IT audit policies and procedures，develop and execute IT audit plan.Article 12.Commercial banks should put in place policies and procedures to protect intellectual property rights according to laws regarding intellectual properties，ensure purchase of legitimate software and hardware，prevention of the use of pirated software，and the protection of the proprietary rights of IT products developed by the bank，and ensure that these are fully understood and complied by all employees.Article 13.Commercial banks should，in accordance with relevant laws and regulations，disclose the risk profile of their IT normatively and timely.Chapter III IT Risk Management

Article 14.Commercial banks should formulate an IT strategy that aligns with the overall business plan of the bank，IT risk assessment plan and an IT operational plan that can ensure adequate financial resources and human resources to maintain a stable and secure IT environment.Article 15.Commercial banks should put in place a comprehensive set of IT risk management policies that include the following areas：

（1）Information security classification policy

（2）System development，testing and maintenance policy

（3）IT operation and maintenance policy

（4）Access control policy

（5）Physical security policy

（6）Personnel security policy

（7）Business Continuity Planning and Crisis and Emergency Management procedure

Article 17.Commercial banks should implement a comprehensive set of risk mitigation measures complying with the IT risk management policies and commensurate with the risk assessment of the bank.These mitigation measures should include：

（1）A set of clearly documented IT risk policies，technical standards，and operational procedures，which should be communicated to the staff frequently and kept up to date in a timely manner；

（2）Areas of potential conflicts of interest should be identified，minimized，and subject to careful，independent monitoring.Also it requires that an appropriate control structure is set up to facilitate checks and balances，with control activities defined at every business level，which should include：

-Top level reviews；

-Controls over physical and logical access to data and system；

-Access granted on “need to know” and “minimum authorization” basis；

-A system of approvals and authorizations； and

-A system of verification and reconciliation.Article 18.Commercial banks should put in place a set of ongoing risk measurement and monitoring mechanisms，which should include

（1）Pre and post-implementation review of IT projects；

（2）Benchmarks for periodic review of system performance；

（3）Reports of incidents and complaints about IT services；

（4）Reports of internal audit，external audit，and issues identified by CBRC； and

（5）Arrangement with vendors and business units for periodic review of service level agreements（SLAs）。

（6）The possible impact of new development of technology and new threats to software deployed.（7）Timely review of operational risk and management controls in operation area.（8）Assess the risk profile on IT outsourcing projects periodically.Article 19.Chinese commercial banks operating offshore and the foreign commercial banks in China should comply with the relevant regulatory requirements on information systems in and outside the People?s Republic of China.Chapter IV Information Security

Article 20.Information technology department of commercial banks should oversee the establishment of an information classification and protection scheme.All employees of the bank should be made aware of the importance of ensuring information confidentiality and provided with the necessary training to fully understand the information protection procedures within their responsibilities.Article 21.Commercial banks should put in place an information security management function to develop and maintain an ongoing information security management program，promote information security awareness，advise other IT functions on security issues，serve as the leader of IT incident response team，and report the evaluation of the information security of the bank to the IT steering committee periodically.The Information security management program should include Information security standards，strategy，an implementation plan，and an ongoing maintenance plan.Information security policy should include the following areas：

（1）IT security policy management

（2）Organization information security

（3）Asset management

（4）Personnel security

（5）Physical and environment security

（6）Communication and operation security

（7）Access control and authentication

（8）Acquirement，development and maintenance of information system

（9）Information security event management

（10）Business continuity management

（11）Compliance

（2）Access points to the domain through various communication channels；

（3）Network protocols and ports used by the applications and network equipment deployed within the domain；

（4）Performance requirement or benchmark；

（5）Nature of the domain，i.e.production or testing，internal or external；

（6）Connectivity between various domains； and

（7）Trustworthiness of the domain.Article 25.Commercial banks should secure the operating system and system software of all computer systems by

（1）Developing baseline security requirement for each operating system and ensuring all systems meet the baseline security requirement；

（2）Clearly defining a set of access privileges for different groups of users，namely，end-users，system development staff，computer operators，and system administrators and user administrators；

（3）Setting up a system of approval，verification，and monitoring procedures for using the highest privileged system accounts；

（4）Requiring technical staff to review available security patches，and report the patch status periodically； and

（5）Requiring technical staff to include important items such as unsuccessful logins，access to critical system files，changes made to user accounts，etc.in system logs，monitors the systems for any abnormal event manually or automatically，and report the monitoring periodically.Article 26.Commercial banks should ensure the security of all the application systems by

（1）Clearly defining the roles and responsibilities of end-users and IT staff regarding the application security；

（2）Implementing a robust authentication method commensurate with the criticality and sensibility of the application system；

（3）Enforcing segregation of duties and dual control over critical or sensitive functions；

（4）Requiring verification of input or reconciliation of output at critical junctures；

（5）Requiring the input and output of confidential information are handled in a secure manner to prevent theft，tampering，intentional leakage，or inadvertent leakage；

（6）Ensuring system can handle exceptions in a predefined way and provide meaningful message to users when the system is forced to terminate； and

（7）Maintaining audit trail in either paper or electronic format.（8）Requiring user administrator to monitor and review unsuccessful logins and changes to users accounts.Article 27.Commercial banks should have a set of policies and procedures controlling the logging of activities in all production systems to support effective auditing，security forensic analysis，and fraud prevention.Logging can be implemented in different layers of software and on different computer and networking equipment，which falls into two broad categories：

（1）Transaction journals.They are generated by application software and database management system，and contain authentication attempts，modification to data，error messages，etc.Transaction journals should be kept according to the national accounting policy.（2）System logs.They are generated by operating systems，database management system，firewalls，intrusion detection systems，and routers，etc.，and contain authentication attempts，system events，network events，error messages，etc.System logs should be kept for a period scaled to the risk classification，but no less than one year.Banks should ensure that sufficient items be included in the logs to facilitate effective internal controls，system troubleshooting，and auditing while taking appropriate measures to ensure time synchronization on all logs.Sufficient disk space should be allocated to prevent logs from being overwritten.System logs should be reviewed for any exception.The review frequency and retention period for transaction logs or database logs should be determined jointly by IT organization and pertinent business lines，and approved by the IT steering committee.Article 28.Commercial banks should have the capacity to employ encryption technologies to mitigate the risk of losing confidential information in the information systems or during its transmission.Appropriate management processes of the encryption facilities should be put in place to ensure that

（1）Encryption facilities in use should meet national security standards or requirements；

（2）Staff in charge of encryption facilities are well trained and screened；

（3）Encryption strength is adequate to protect the confidentiality of the information； and 18

（4）Effective and efficient key management procedures，especially key lifecycle management and certificate lifecycle management，are in place.Article 29.Commercial banks should put in place an effective and efficient system of securing all end-user computing equipment which include desktop personal computers（PCs），portable PCs，teller terminals，automatic teller machines（ATMs），passbook printers，debit or credit card readers，point of sale（POS）terminals，personal digital assistant（PDAs），etc and conduct periodic security checks on all equipments.Article 30.Commercial banks should put in place a set of policies and procedures to govern the collection，processing，storage，transmission，dissemination，and disposal of customer information.Article 31.All employees，including contract staff，should be provided with the necessary trainings to fully understand these policies procedures and the consequences of their violation.Commercial banks should adopt a zero tolerance policy against security violation.Chapter V Application System Development，Testing and Maintenance

Article 32.Commercial banks should have the capability to identify，plan，acquire，develop，test，deploy，maintain，upgrade，and retire information systems.Policies and procedures should be in place to govern the initiation，prioritization，approval，and control of IT projects.Progress reports of major IT projects should be submitted to and reviewed by the IT steering committee periodically.Decisions involving significant change of schedule，change of key personnel，change of vendors，and major expenditures should be included in the progress report.Article 33.Commercial banks should recognize the risks associated with IT projects，which include the possibilities of incurring various kinds of operational risk，financial losses，and opportunity costs stemming from ineffective project planning or inadequate project management controls of the bank.Therefore，appropriate project management methodologies should be adopted and implemented to control the risks associated with IT projects.Article 34.Commercial banks should adopt and implement a system development methodology to control the life cycle of Information systems.The typical phases of system life cycle include system analysis，design，development or acquisition，testing，trial run，deployment，maintenance，and retirement.The system development methodology to be used should be commensurate with the size，nature，and complexity of the IT project，and，generally speaking，should facilitate the management of the following risks.Article 35.Commercial banks should ensure system reliability，integrity，and maintainability by controlling system changes with a set of policies and procedures，which should include the following elements.（1）Ensure that production systems are separated from development or testing systems；

（2）Separating the duties of managing production systems and managing development or testing systems；

（3）Prohibiting application development and maintenance staff from accessing production system under normal circumstances unless management approval is granted to perform emergency repair，and all emergency repair activities should be recorded and reviewed promptly；

（4）Promoting changes of program or system configuration from development and testing systems to production systems should be jointly approved by IT organization and business departments，properly documented，and reviewed periodically.Article 36.Commercial banks should have in place a set of policies，standards，and procedures to ensure data integrity，confidentiality，and availability.These policies should be in accordance with data integrity amid IT development procedure.Article 37.Commercial banks should ensure that Information system problems could be tracked，analyzed，and resolved systematically through an effective problem management process.Problems should be documented，categorized，and indexed.Support services or technical assistance from vendors，if necessary，should also be documented.Contacts and relevant contract information should be made readily available to the employees concerned.Accountability and line of command should be delineated clearly and communicated to all employees concerned，which is of utmost importance to performing emergency repair.Article 38.Commercial banks should have a set of policies and procedures controlling the process of system upgrade.System upgrade is needed when the hardware reaches its lifespan or runs out of capacity，the underpinning software，namely，operating system，database management system，middleware，has to be upgraded，or the application software has to be upgraded.The system upgrade should be treated as a project and managed by all pertinent project management controls including user acceptance testing.Chapter VI IT Operations

Article 39.Commercial banks should consider fully the environmental threats（e.g.proximity to natural disaster zones，dangerous or hazardous facilities or busy/major roads）when selecting the locations of their data centers.Physical and environmental controls should be implemented to monitor environmental conditions could affect adversely the operation of information processing facilities.Equipment facilities should be protected from power failures and electrical supply interference.Article 40.In controlling access by third-party personnel（e.g.service providers）to secured areas，proper approval of access should be enforced and their activities should be closely monitored.It is important that proper screening procedures including verification and background checks，especially for sensitive technology-related jobs，are developed for permanent and temporary technical staff and contractors.20

Article 41.Commercial banks should separate IT operations or computer center operations from system development and maintenance to ensure segregation of duties within the IT organization.The commercial banks should document the roles and responsibilities of data center functions.Article 42.Commercial banks are required to retain transactional records in compliance with the national accounting policy.Procedures and technology are needed to be put in place to ensure the integrity，safekeeping and retrieval requirements of the archived data.Article 43.Commercial banks should detail operational instructions such as computer operator tasks，job scheduling and execution in the IT operations manual.The IT operations manual should also cover the procedures and requirements for on-site and off-site backup of data and software in both the production and development environments（i.e.frequency，scope and retention periods of back-up）。

Article 44.Commercial banks should have in place a problem management and processing system to respond promptly to IT operations incidents，to escalate reported incidents to relevant IT management staff and to record，analyze and keep tracks of all these incidents until rectification of the incidents with root cause analysis completed.A helpdesk function should be set up to provide front-line support to users on all technology-related problems and to direct the problems to relevant IT functions for investigation and resolution.Article 45.Commercial banks should establish service level agreement and assess the IT service level standard attained.Article 46.Commercial banks should implement a process to ensure that the performance of application systems is continuously monitored and exceptions are reported in a timely and comprehensive manner.The performance monitoring process should include forecasting capability to enable exceptions to be identified and corrected before they affect system performance.Article 47.Commercial banks should carry out capacity plan to cater for business growth and transaction increases due to changes of economic conditions.Capacity plan should be extended to cover back-up systems and related facilities in addition to the production environment.Article 48.Commercial banks should ensure the continued availability of technology related services with timely maintenance and appropriate system upgrades.Proper record keeping（including suspected and actual faults and preventive and corrective maintenance records）is necessary for effective facility and equipment maintenance.Article 49.Commercial banks should have an effective change management process in place to ensure integrity and reliability of the production environment.Commercial banks should develop a formal change management process.Chapter VII Business Continuity Management

Article 50.Commercial banks should have in place appropriate arrangements，having regard to the nature，scale and complexity of its business，to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption.These arrangements should be regularly updated and tested to ensure their effectiveness.Article 51.Commercial banks should consider the likelihood and impact of a disruption to the continuity of its operation from unexpected events.This should include assessing the disruptions to which it is particularly susceptible including but not limited to：

（1）Loss of failure of internal and external resources（such as people，systems and other assets）；

（2）The loss or corruption of its information； and

（3）External events（such as war，earthquake，typhoon，etc）。

Article 52.Commercial bank should act to reduce both the likelihood of disruptions（including system resilience and dual processing）； and the impact of disruptions（including by contingency arrangements and insurance）。

Article 53.Commercial bank should document its strategy for maintaining continuity of its operations，and its plans for communicating and regularly testing the adequacy and effectiveness of this strategy.Commercial bank should establish：

（1）Formal business continuity plans that outline arrangements to reduce the impact of a short，medium and long-term disruption，including：

a）Resource requirements such as people，systems and other assets，and arrangements for obtaining these resources；

b）The recovery priorities for the commercial bank?s operations； and

c）Communication arrangements for internal and external concerned parties（including CBRC，clients and the press）；

（2）Escalation and invocation plans that outline the processes for implementing the business continuity plans，together with relevant contact information；

（3）Processes to validate the integrity of information affected by the disruption；

（4）Processes to review and update（1）to（3）following changes to the commercial bank?s operations or risk profile.Article 54.A final BCP plan and an annual drill result must be signed off by the IT Risk management，or internal auditor and IT Steering Committee.Chapter VIII Outsourcing

Article 55.Commercial banks cannot contract out its regulatory obligations and should take reasonable care to supervise the discharge of outsourcing functions.22

Article 56.Commercial banks should take particular care to manage material outsourcing arrangement（such as outsourcing of data center，IT infrastructure，etc.），and should notify CBRC when it intends to enter into material outsourcing arrangement.Article 57.Before entering into，or significantly changing，an outsourcing arrangement，the commercial bank should：

（1）Analyze how the arrangement will fit with its organization and reporting structure； business strategy； overall risk profile； and ability to meet its regulatory obligations；

（2）Consider whether the arrangements will allow it to monitor and control its operational risk exposure relating to the outsourcing；

（3）Conduct appropriate due diligence of the service provider?s financial stability，expertise and risk assessment of the service provider，facilities and ability to cover the potential liabilities；

（4）Consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement（including what will happen on the termination of the contract）； and

（5）Consider any concentration risk implications such as the business continuity implications that may arise if a single service provider is used by several firms.Article 58.In negotiating its contract with a service provider，the commercial bank should have regard to（but not limited to）：

（1）Reporting and negotiation requirements it may wish to impose on the service provider；

（2）Whether sufficient access will be available to its internal auditors，external auditors and banking regulators；

（3）Information ownership rights，confidentiality agreements and Firewalls to protect client and other information（including arrangements at the termination of contract）；

（4）The adequacy of any guarantees and indemnities；

（5）The extent to which the service provider must comply with the commercial bank?s polices and procedures covering IT Risk；

（6）The extent to which the service provider will provide business continuity for outsourced operations，and whether exclusive access to its resources is agreed；

（7）The need for continued availability of software following difficulty at a third party supplier；

（8）The processes for making changes to the outsourcing arrangement and the conditions under which the commercial bank or service provider can choose to change or terminate the outsourcing arrangement，such as where there is：

a）A change of ownership or control of the service provider or commercial bank； or

b）Significant change in the business operations of the service provider or commercial bank； or

c）Inadequate provision of services that may lead to the commercial bank being unable to meet its regulatory obligations.Article 59.In implementing a relationship management framework，and drafting the service level agreement with the service provider，the commercial bank should have regarded to（but not limited to）：

（1）The identification of qualitative and quantitative performance targets to assess the adequacy of service provision，to both the commercial bank and its clients，where appropriate；

（2）The evaluation of performance through service delivery reports and periodic self assessment and independent review by internal or external auditors； and

（3）Remediation action and escalation process for dealing with inadequate performance.Article 60.The commercial bank should enhance IT related outsourcing management，in place following（not limited to）measures to ensure data security of sensitive information such as customer information：

（1）Effectively separated from other customer information of the service provider；

（2）The related staff of service provider should be authorized on “need to know” and “minimum authorization” basis；

（3）Ensure service provider guarantee its staff for meeting the confidential requests；

（4）All outsourcing arrangements related to customer information should be identified as material outsourcing arrangements and the customers should be notified；

（5）Strictly monitor re-outsourcing actions of the service provider，and implement adequate control measures to ensure information security of the bank；

（6）Ensure all related sensitive information be refunded or deleted from the service provider?s storage when terminating the outsourcing arrangement.Article 61.The commercial bank should ensure that it has appropriate contingency in the event of a significant loss of services from the service provider.Particular issues to consider include a significant loss of resources，turnover of key staff，or financial failure of，the service provider，and unexpected termination of the outsourcing agreement.Article 62.All outsourcing contracts must be reviewed or signed off by IT Risk management，internal IT auditors，legal department and IT Steering Committee.There should be a process to periodically review and refine the service level agreements.Chapter IX Internal Audit

Article 63.Depending on the nature，scale and complexity of its business，it may be appropriate for the commercial banks to delegate much of the task of monitoring the appropriateness and effectiveness of its systems and controls to an internal audit function.An internal audit function should be adequately resourced and staffed by competent individuals，be independent of the day-to-day activities of the commercial bank and have appropriate access to the bank?s records.Article 64.The responsibilities of the internal IT audit function are：

（1）To establish，implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the bank?s systems and internal control mechanisms and arrangements；

（2）To issue recommendations based on the result of work carried out in accordance with 1；

（3）To verify compliance with those recommendations；

（4）To carry out special audit on information technology.The term “special audit” of information technology refers to the investigation，analysis and assessment on the security incidents of the information system，or the audit performed on a special subject based on IT risk assessment result as deemed necessary by the audit department.Article 65.Based on the nature，scale and complexity of its business，deployment of information technology and IT risk assessment，commercial banks could determine the scope and frequency of IT internal audit.However，a comprehensive IT internal audit shall be performed at a minimum once every 3 years.Article 66.Commercial banks should engage its internal audit department and IT Risk management department when implementing system development of significant size and scale to ensure it meets the IT Risk standards of the Commercial banks.Chapter X External Audit

Article 67.The external information technology audit of commercial banks can be carried out by certified service providers in accordance with laws，rules and regulations.Article 68.The commercial bank should ensure IT audit service provider to review and examine bank?s hardware，software，documentation and data to identify IT risk when they are commissioned to perform the audit.Vital commercial and technical information which is protected by national laws and regulations should not be reviewed.Article 69.Commercial bank should communicate with the service provider in depth before the audit to determine audit scope，and should not withhold the truth or do not corporate with the service provider intentionally.Article 70.CBRC and its local offices could designate certified service providers to carry out IT audit or related review on commercial banks when needed.When carrying out audit on commercial banks，as commissioned or authorized by CBRC or its local offices，the service providers shall 25 present the letter of authority，and carry out the audit in accordance to the scope prescribed in the letter of authority.Article 71.Once the IT audit report produced by the service providers is reviewed and approved by CBRC or its local offices，the report will have the same legal status as if it is produced by the CBRC itself.Commercial banks should come up with a correction action plan prescribed in the report and implement the corrective actions according to the timeframe.Article 72.Commercial banks should ensure the service providers to strictly comply with laws and regulations to keep confidential and data security of any commercial secrets and private information learnt and IT risk information when conducting the audit.The service provider should not modify copy or take away any documents provided by the commercial banks.Chapter XI Supplementary Provisions

Article 73.Commercial banks with no board of directors should have their operating decision-making bodies perform the responsibilities of the board with regard to IT risk management specified herein.Article 74.The China Banking Regulatory Commission supervises and regulates the IT risk management of commercial banks under its authority by law.Article 75.The power of interpretation and modification of the Guidelines shall rest with the China Banking Regulatory Commission.Article 76.The Guidelines shall become effective as of the date of its issuance and the former Guidelines on the Risk Management of Banking Institutions? Information Systems shall be revoked at the same time.中國(guó)銀行業(yè)監(jiān)督管理委員會(huì)

第四篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引（推薦）

商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

（七）確保內(nèi)部審計(jì)部門(mén)進(jìn)行獨(dú)立有效的信息科技風(fēng)險(xiǎn)管理審計(jì)，對(duì)審計(jì)

（八）每年審閱并向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)送信息科技風(fēng)險(xiǎn)管理的報(bào)

（九）（十一）確保本法人機(jī)構(gòu)涉及客戶信息、賬務(wù)信息以及產(chǎn)品信息等的核心系統(tǒng)在中國(guó)境內(nèi)獨(dú)立運(yùn)行，并保持最高的管理權(quán)限，符合銀監(jiān)會(huì)監(jiān)管和實(shí)施現(xiàn)場(chǎng)

（十二）及時(shí)向銀監(jiān)會(huì)及其派出機(jī)構(gòu)報(bào)告本機(jī)構(gòu)發(fā)生的重大信息科技事故

（十三）配合銀監(jiān)會(huì)及其派出機(jī)構(gòu)做好信息科技風(fēng)險(xiǎn)監(jiān)督檢查工作，并按

（十四）（一）業(yè)務(wù)戰(zhàn)略和信息科技風(fēng)險(xiǎn)管理

（二）確保信息科技戰(zhàn)略，尤其是信息系統(tǒng)開(kāi)發(fā)戰(zhàn)略，符合本銀行的總體

（四）確保信息科技風(fēng)險(xiǎn)管理的有效性，并使有關(guān)管理措施落實(shí)到相關(guān)的

（五）（六）

（二）信息系統(tǒng)開(kāi)發(fā)、測(cè)試和維護(hù)。

（三）（四）

（五）（六）

（七）

（三）（四）

（六）（七）

（五）域的性質(zhì)，如生產(chǎn)域或測(cè)試域、內(nèi)部域

（二）系統(tǒng)日志。系統(tǒng)日志由操作系統(tǒng)、數(shù)據(jù)庫(kù)管理系統(tǒng)、防火墻、入侵檢測(cè)系統(tǒng)和路由器等生成，內(nèi)容包括管理登錄嘗試、系統(tǒng)事件、網(wǎng)絡(luò)事件、錯(cuò)誤

操作風(fēng)險(xiǎn)、財(cái)務(wù)損失風(fēng)險(xiǎn)和因無(wú)效項(xiàng)目規(guī)劃或不適當(dāng)?shù)捻?xiàng)目管理控制產(chǎn)生的機(jī)會(huì)

術(shù)人員和承包商，尤其是從事敏感性技術(shù)相關(guān)工作的人員，應(yīng)制定嚴(yán)格的審查程

（三）充分審查、評(píng)估外包服務(wù)商的財(cái)務(wù)穩(wěn)定性和專(zhuān)業(yè)經(jīng)驗(yàn)，對(duì)外包服務(wù)

（四）考慮外包協(xié)議變更前后實(shí)施的平穩(wěn)過(guò)渡（包括終止合同可能發(fā)生的

（五）關(guān)注可能存在的集中風(fēng)險(xiǎn)，如多家商業(yè)銀行共用同一外包服務(wù)商帶

（三）（四）應(yīng)將涉及本銀行客戶資料的外包作為重要外包，并告知相關(guān)客戶。

（五）嚴(yán)格控制外包服務(wù)商再次對(duì)外轉(zhuǎn)包，采取足夠措施確保商業(yè)銀行相

（六）確保在中止外包協(xié)議時(shí)收回或銷(xiāo)毀外包服務(wù)商保存的所有客戶資料。

第五篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引_英文版

Guidelines on the Risk Management of Commercial Banks’ Information Technology

Chapter I General Provisions

Article 1.Pursuant to the Law of the People’s Republic of China on Banking Regulation and Supervision, the Law of the People's Republic of China on Commercial Banks, the Regulations of the People’s Republic of China on Administration of Foreign-funded Banks, and other applicable laws and regulations, the Guidelines on the Risk Management of Commercial Banks’ Information Technology(hereinafter referred to as the Guidelines)is formulated.Article 2.The Guidelines apply to all the commercial banks legally incorporated within the territory of the People’s Republic of China.The Guidelines may apply to other banking institutions including policy banks, rural cooperative banks, urban credit cooperatives, rural credit cooperatives, village banks, loan companies, financial asset management companies, trust and investment companies, finance firms, financial leasing companies, automobile financial companies and money brokers.Article 3.The term “information technology” stated in the Guidelines shall refer to the system built with computer, communication and software technologies, and employed by commercial banks to handle business transactions, operation management, and internal communication, collaborative work and controls.The term also include IT governance, IT organization structure and IT policies and procedures.Article 4.The risk of information technology refers to the operational risk, legal risk and reputation risk that are caused by natural factor, human factor, technological loopholes or management deficiencies when using information technology.Article 5.The objective of information system risk management is to establish an effective mechanism that can identify, measure, monitor, and control the risks of commercial banks’ information system, ensure data integrity, availability, confidentiality and consistency, provide the relevant early warning, and thereby enable commercial banks’ business innovations, uplift their capability in utilizing information technology, improve their core competitiveness and capacity for sustainable development.1 of 15 4/17/2013

Chapter II IT governance

Article 6.The legal representative of commercial bank should be responsible to ensure compliance of this guideline.Article 7.The board of directors of commercial banks should have the following responsibilities with respect to the management of information systems:(1)Implementing and complying with the national laws, regulations and technical standards pertaining to the management of information systems, as well as the regulatory requirements set by the China Banking Regulatory Commission(hereinafter referred to as the “CBRC”);(2)Periodically reviewing the alignment of IT strategy with the overall business strategies and significant policies of the bank, assessing the overall effectiveness and efficiency of the IT organization.(3)Approving IT risk management strategies and policies, understanding the major IT risks involved, setting acceptable levels for these risks, and ensuring the implementation of the measures necessary to identify, measure, monitor and control these risks.(4)Setting high ethical and integrity standards, and establishing a culture within the bank that emphasizes and demonstrates to all levels of personnel the importance of IT risk management.(5)Establishing an IT steering committee which consists of representatives from senior management, the IT organization, and major business units, to oversee these responsibilities and report the effectiveness of strategic IT planning, the IT budget and actual expenditure, and the overall IT performance to the board of directors and senior management periodically.(6)Establishing IT governance structure, proper segregation of duty, clear role and responsibility, maintaining check and balances and clear reporting relationship.Strengthening IT professional staff by developing incentive program.(7)Ensuring that there is an effective internal audit of the IT risk management carried out by operationally independent, well-trained and qualified staff.The internal audit report should be submitted directly to the IT audit committee;(8)Submitting an annual report to the CBRC and its local offices on information system risk management that has been reviewed and approved by the board of directors;(9)Ensuring the appropriating funding necessary for IT risk management works;(10)Ensuring that all employees of the bank fully understand and adhere to the IT risk management policies and procedures approved by the board of directors and the senior management, and are provided with pertinent training.(11)Ensuring customer information, financial information, product information and core banking system of the legal entity are held independently within the territory, and complying with the regulatory on-site examination requirements of CBRC and guarding against cross-border risk.(12)Reporting in a timely manner to the CBRC and its local offices any serious incident of information systems or unexpected event, and quickly respond to it in accordance with the contingency plan;(13)Cooperating with the CBRC and its local offices in the supervisory inspection of the risk management of information systems, and ensure that supervisory opinions are followed up;and(14)Performing other related IT risk management tasks.of 15

4/17/2013 Article 8.The head of the IT organization, commonly known as the Chief Information Officer(CIO)should report directly to the president.Roles and responsibilities of the CIO should include the following:(1)Playing a direct role in key decisions for the business development involving the use of IT in the bank;(2)The CIO should ensure that information systems meet the needs of the bank, and IT strategies, in particular information system development strategies, comply with the overall business strategies and IT risk management policies of the bank;(3)The CIO should also be responsible for the establishment of an effective and efficient IT organization to carry out the IT functions of the bank.These include the IT budget and expenditure, IT risk management, IT policies, standards and procedures, IT internal controls, professional development, IT project initiatives, IT project management, information system maintenance and upgrade, IT operations, IT infrastructure, Information security, disaster recovery plan(DRP), IT outsourcing, and information system retirement;(4)Ensuring the effectiveness of IT risk management throughout the organization including all branches.(5)Organizing professional trainings to improve technical proficiency of staff.(6)Performing other related IT risk management tasks.Article 9.Commercial banks should ensure that a clear definition of the IT organization structure and documentation of all job descriptions of important positions are always in place and updated in a timely manner.Staff in each position should meet relevant requirements on professional skills and knowledge.The following risk mitigation measures should be incorporated in the management program of related staff:(1)Verification of personal information including confirmation of personal identification issued by government, academic credentials, prior work experience, professional qualifications;(2)Ensuring that IT staff can meet the required professional ethics by checking character reference;

(3)Signing of agreements with employees about understanding of IT policies and guidelines, non-disclosure of confidential information, authorized use of information systems, and adherence to IT policies and procedures;and(4)Evaluation of the risk of losing key IT personnel, especially during major IT development stage or in a period of unstable IT operations, and the relevant risk mitigation measures such as staff backup arrangement and staff succession plan.Article 10.Commercial banks should establish or designate a particular department for IT risk management.It should report directly to the CIO and the Chief Risk Officer(or risk management committee), serve as a member of the IT incident response team, and be responsible for coordinating the establishment of policies regarding IT risk management, especially the areas of information security, BCP, and compliance with the CBRC regulations, advising the business departments and IT department in implementing these policies, providing relevant compliance information, conducting on-going assessment of IT risks, and ensuring the follow-up of remediation advice, monitoring and escalating management of IT threats and non-compliance events.of 15

4/17/2013

Article 11.Commercial banks should establish a special IT audit role and responsibility within internal audit function, which should put in place IT audit policies and procedures, develop and execute IT audit plan.Article 12.Commercial banks should put in place policies and procedures to protect intellectual property rights according to laws regarding intellectual properties, ensure purchase of legitimate software and hardware, prevention of the use of pirated software, and the protection of the proprietary rights of IT products developed by the bank, and ensure that these are fully understood and complied by all employees.Article 13.Commercial banks should, in accordance with relevant laws and regulations, disclose the risk profile of their IT normatively and timely.Chapter III IT Risk Management

Article 14.Commercial banks should formulate an IT strategy that aligns with the overall business plan of the bank, IT risk assessment plan and an IT operational plan that can ensure adequate financial resources and human resources to maintain a stable and secure IT environment.Article 15.Commercial banks should put in place a comprehensive set of IT risk management policies that include the following areas:(1)Information security classification policy(2)System development, testing and maintenance policy(3)IT operation and maintenance policy(4)Access control policy(5)Physical security policy(6)Personnel security policy(7)Business Continuity Planning and Crisis and Emergency Management procedure

Article 16.Commercial banks should maintain an ongoing risk identification and assessment process that allows the bank to pinpoint the areas of concern in its information systems, assess the potential impact of the risks on its business, rank the risks, and prioritize mitigation actions and the necessary resources(including outsourcing vendors, product vendors and service vendors).Article 17.Commercial banks should implement a comprehensive set of risk mitigation measures complying with the IT risk management policies and commensurate with the risk assessment of the bank.These mitigation measures should include:(1)A set of clearly documented IT risk policies, technical standards, and operational procedures, which should be communicated to the staff frequently and kept up to date in a timely manner;(2)Areas of potential conflicts of interest should be identified, minimized, and subject to careful, independent monitoring.Also it requires that an appropriate of 15

4/17/2013 control structure is set up to facilitate checks and balances, with control activities defined at every business level, which should include:--Top level reviews;

Controls over physical and logical access to data and system;

Access granted on “need to know” and “minimum authorization” basis;A system of approvals and authorizations;and A system of verification and reconciliation.Article 18.Commercial banks should put in place a set of ongoing risk measurement and monitoring mechanisms, which should include(1)Pre and post-implementation review of IT projects;(2)Benchmarks for periodic review of system performance;(3)Reports of incidents and complaints about IT services;(4)Reports of internal audit, external audit, and issues identified by CBRC;and(5)Arrangement with vendors and business units for periodic review of service level agreements(SLAs).(6)The possible impact of new development of technology and new threats to software deployed.(7)Timely review of operational risk and management controls in operation area.(8)Assess the risk profile on IT outsourcing projects periodically.Article 19.Chinese commercial banks operating offshore and the foreign commercial banks in China should comply with the relevant regulatory requirements on information systems in and outside the People’s Republic of China.Chapter IV Information Security

Article 20.Information technology department of commercial banks should oversee the establishment of an information classification and protection scheme.All employees of the bank should be made aware of the importance of ensuring information confidentiality and provided with the necessary training to fully understand the information protection procedures within their responsibilities.Article 21.Commercial banks should put in place an information security management function to develop and maintain an ongoing information security management program, promote information security awareness, advise other IT functions on security issues, serve as the leader of IT incident response team, and report the evaluation of the information security of the bank to the IT steering committee periodically.The Information security management program should include Information security standards, strategy, an implementation plan, and an ongoing maintenance plan.Information security policy should include the following areas:(1)IT security policy management(2)Organization information security of 15

4/17/2013(3)(4)(5)(6)(7)(8)(9)(10)(11)Asset management Personnel security Physical and environment security Communication and operation security Access control and authentication Acquirement, development and maintenance of information system Information security event management Business continuity management Compliance

Article 22.Commercial banks should have an effective process to manage user authentication and access control.Access to data and system should be strictly limited to authorized individuals whose identity is clearly established, and their activities in the information systems should be limited to the minimum required for their legitimate business use.Appropriate user authentication mechanism commensurate with the classification of information to be accessed should be selected.Timely review and removal of user identity from the system should be implemented when user transfers to a new job or leave the commercial bank.Article 23.Commercial banks should ensure all physical security zones, such as computer centers or data centers, network closets, areas containing confidential information or critical IT equipment, and respective accountabilities are clearly defined, and appropriate preventive, detective, and recuperative controls are put in place.Article 24.Commercial banks should divide their networks into logical security domains(hereinafter referred to as the “domain”)with different levels of security.The following security factors have to be assessed in order to define and implement effective security controls, such as physical or logical segregation of network, network filtering, logical access control, traffic encryption, network monitoring, activity log, etc., for each domain and the whole network.(1)criticality of the applications and user groups within the domain;(2)Access points to the domain through various communication channels;(3)Network protocols and ports used by the applications and network equipment deployed within the domain;(4)Performance requirement or benchmark;(5)Nature of the domain, i.e.production or testing, internal or external;(6)Connectivity between various domains;and(7)Trustworthiness of the domain.Article 25.Commercial banks should secure the operating system and system software of all computer systems by(1)Developing baseline security requirement for each operating system and ensuring all systems meet the baseline security requirement;(2)Clearly defining a set of access privileges for different groups of users, namely, end-users, system development staff, computer operators, and system administrators and user administrators;of 15

4/17/2013(3)(4)(5)Setting up a system of approval, verification, and monitoring procedures for using the highest privileged system accounts;Requiring technical staff to review available security patches, and report the patch status periodically;and Requiring technical staff to include important items such as unsuccessful logins, access to critical system files, changes made to user accounts, etc.in system logs, monitors the systems for any abnormal event manually or automatically, and report the monitoring periodically.Article 26.Commercial banks should ensure the security of all the application systems by(1)Clearly defining the roles and responsibilities of end-users and IT staff regarding the application security;(2)Implementing a robust authentication method commensurate with the criticality and sensibility of the application system;(3)Enforcing segregation of duties and dual control over critical or sensitive functions;(4)Requiring verification of input or reconciliation of output at critical junctures;(5)Requiring the input and output of confidential information are handled in a secure manner to prevent theft, tampering, intentional leakage, or inadvertent leakage;

(6)Ensuring system can handle exceptions in a predefined way and provide meaningful message to users when the system is forced to terminate;and(7)Maintaining audit trail in either paper or electronic format.(8)Requiring user administrator to monitor and review unsuccessful logins and changes to users accounts.Article 27.Commercial banks should have a set of policies and procedures controlling the logging of activities in all production systems to support effective auditing, security forensic analysis, and fraud prevention.Logging can be implemented in different layers of software and on different computer and networking equipment, which falls into two broad categories:(1)Transaction journals.They are generated by application software and database management system, and contain authentication attempts, modification to data, error messages, etc.Transaction journals should be kept according to the national accounting policy.(2)System logs.They are generated by operating systems, database management system, firewalls, intrusion detection systems, and routers, etc., and contain authentication attempts, system events, network events, error messages, etc.System logs should be kept for a period scaled to the risk classification, but no less than one year.Banks should ensure that sufficient items be included in the logs to facilitate effective internal controls, system troubleshooting, and auditing while taking appropriate measures to ensure time synchronization on all logs.Sufficient disk space should be allocated to prevent logs from being overwritten.System logs should be reviewed for any exception.The review frequency and retention period for transaction logs or database logs should be determined jointly by IT organization and pertinent business lines, and approved by the IT steering committee.of 15

4/17/2013

Article 28.Commercial banks should have the capacity to employ encryption technologies to mitigate the risk of losing confidential information in the information systems or during its transmission.Appropriate management processes of the encryption facilities should be put in place to ensure that(1)Encryption facilities in use should meet national security standards or requirements;(2)Staff in charge of encryption facilities are well trained and screened;(3)Encryption strength is adequate to protect the confidentiality of the information;and(4)Effective and efficient key management procedures, especially key lifecycle management and certificate lifecycle management, are in place.Article 29.Commercial banks should put in place an effective and efficient system of securing all end-user computing equipment which include desktop personal computers(PCs), portable PCs, teller terminals, automatic teller machines(ATMs), passbook printers, debit or credit card readers, point of sale(POS)terminals, personal digital assistant(PDAs), etc and conduct periodic security checks on all equipments.Article 30.Commercial banks should put in place a set of policies and procedures to govern the collection, processing, storage, transmission, dissemination, and disposal of customer information.Article 31.All employees, including contract staff, should be provided with the necessary trainings to fully understand these policies procedures and the consequences of their violation.Commercial banks should adopt a zero tolerance policy against security violation.Chapter V Application System Development, Testing and Maintenance

Article 32.Commercial banks should have the capability to identify, plan, acquire, develop, test, deploy, maintain, upgrade, and retire information systems.Policies and procedures should be in place to govern the initiation, prioritization, approval, and control of IT projects.Progress reports of major IT projects should be submitted to and reviewed by the IT steering committee periodically.Decisions involving significant change of schedule, change of key personnel, change of vendors, and major expenditures should be included in the progress report.Article 33.Commercial banks should recognize the risks associated with IT projects, which include the possibilities of incurring various kinds of operational risk, financial losses, and opportunity costs stemming from ineffective project planning or inadequate project management controls of the bank.Therefore, appropriate project management methodologies should be adopted and implemented to control the risks associated with IT projects.Article 34.Commercial banks should adopt and implement a system development of 15

4/17/2013 methodology to control the life cycle of Information systems.The typical phases of system life cycle include system analysis, design, development or acquisition, testing, trial run, deployment, maintenance, and retirement.The system development methodology to be used should be commensurate with the size, nature, and complexity of the IT project, and, generally speaking, should facilitate the management of the following risks.Article 35.Commercial banks should ensure system reliability, integrity, and maintainability by controlling system changes with a set of policies and procedures, which should include the following elements.(1)Ensure that production systems are separated from development or testing systems;(2)Separating the duties of managing production systems and managing development or testing systems;(3)Prohibiting application development and maintenance staff from accessing production system under normal circumstances unless management approval is granted to perform emergency repair, and all emergency repair activities should be recorded and reviewed promptly;(4)Promoting changes of program or system configuration from development and testing systems to production systems should be jointly approved by IT organization and business departments, properly documented, and reviewed periodically.Article 36.Commercial banks should have in place a set of policies, standards, and procedures to ensure data integrity, confidentiality, and availability.These policies should be in accordance with data integrity amid IT development procedure.Article 37.Commercial banks should ensure that Information system problems could be tracked, analyzed, and resolved systematically through an effective problem management process.Problems should be documented, categorized, and indexed.Support services or technical assistance from vendors, if necessary, should also be documented.Contacts and relevant contract information should be made readily available to the employees concerned.Accountability and line of command should be delineated clearly and communicated to all employees concerned, which is of utmost importance to performing emergency repair.Article 38.Commercial banks should have a set of policies and procedures controlling the process of system upgrade.System upgrade is needed when the hardware reaches its lifespan or runs out of capacity, the underpinning software, namely, operating system, database management system, middleware, has to be upgraded, or the application software has to be upgraded.The system upgrade should be treated as a project and managed by all pertinent project management controls including user acceptance testing.Chapter VI

IT Operations of 15 4/17/2013 Article 39.Commercial banks should consider fully the environmental threats(e.g.proximity to natural disaster zones, dangerous or hazardous facilities or busy/major roads)when selecting the locations of their data centers.Physical and environmental controls should be implemented to monitor environmental conditions could affect adversely the operation of information processing facilities.Equipment facilities should be protected from power failures and electrical supply interference.Article 40.In controlling access by third-party personnel(e.g.service providers)to secured areas, proper approval of access should be enforced and their activities should be closely monitored.It is important that proper screening procedures including verification and background checks, especially for sensitive technology-related jobs, are developed for permanent and temporary technical staff and contractors.Article 41.Commercial banks should separate IT operations or computer center operations from system development and maintenance to ensure segregation of duties within the IT organization.The commercial banks should document the roles and responsibilities of data center functions.Article 42.Commercial banks are required to retain transactional records in compliance with the national accounting policy.Procedures and technology are needed to be put in place to ensure the integrity, safekeeping and retrieval requirements of the archived data.Article 43.Commercial banks should detail operational instructions such as computer operator tasks, job scheduling and execution in the IT operations manual.The IT operations manual should also cover the procedures and requirements for on-site and off-site backup of data and software in both the production and development environments(i.e.frequency, scope and retention periods of back-up).Article 44.Commercial banks should have in place a problem management and processing system to respond promptly to IT operations incidents, to escalate reported incidents to relevant IT management staff and to record, analyze and keep tracks of all these incidents until rectification of the incidents with root cause analysis completed.A helpdesk function should be set up to provide front-line support to users on all technology-related problems and to direct the problems to relevant IT functions for investigation and resolution.Article 45.Commercial banks should establish service level agreement and assess the IT service level standard attained.Article 46.Commercial banks should implement a process to ensure that the performance of application systems is continuously monitored and exceptions are reported in a timely and comprehensive manner.The performance monitoring process should include forecasting capability to enable exceptions to be identified and corrected before they affect system performance.of 15

4/17/2013

Article 47.Commercial banks should carry out capacity plan to cater for business growth and transaction increases due to changes of economic conditions.Capacity plan should be extended to cover back-up systems and related facilities in addition to the production environment.Article 48.Commercial banks should ensure the continued availability of technology related services with timely maintenance and appropriate system upgrades.Proper record keeping(including suspected and actual faults and preventive and corrective maintenance records)is necessary for effective facility and equipment maintenance.Article 49.Commercial banks should have an effective change management process in place to ensure integrity and reliability of the production environment.Commercial banks should develop a formal change management process.Chapter VII Business Continuity Management

Article 50.Commercial banks should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption.These arrangements should be regularly updated and tested to ensure their effectiveness.Article 51.Commercial banks should consider the likelihood and impact of a disruption to the continuity of its operation from unexpected events.This should include assessing the disruptions to which it is particularly susceptible including but not limited to:(1)Loss of failure of internal and external resources(such as people, systems and other assets);(2)The loss or corruption of its information;and(3)External events(such as war, earthquake, typhoon, etc).Article 52.Commercial bank should act to reduce both the likelihood of disruptions(including system resilience and dual processing);and the impact of disruptions(including by contingency arrangements and insurance).Article 53.Commercial bank should document its strategy for maintaining continuity of its operations, and its plans for communicating and regularly testing the adequacy and effectiveness of this strategy.Commercial bank should establish:(1)Formal business continuity plans that outline arrangements to reduce the impact of a short, medium and long-term disruption, including: a)Resource requirements such as people, systems and other assets, and

arrangements for obtaining these resources;b)The recovery priorities for the commercial bank’s operations;and c)Communication arrangements for internal and external concerned

parties(including CBRC, clients and the press);of 15

4/17/2013(2)(3)(4)Escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;Processes to validate the integrity of information affected by the disruption;Processes to review and update(1)to(3)following changes to the commercial bank’s operations or risk profile.Article 54.A final BCP plan and an annual drill result must be signed off by the IT Risk management, or internal auditor and IT Steering Committee.Chapter VIII Outsourcing

Article 55.Commercial banks cannot contract out its regulatory obligations and should take reasonable care to supervise the discharge of outsourcing functions.Article 56.Commercial banks should take particular care to manage material outsourcing arrangement(such as outsourcing of data center, IT infrastructure, etc.), and should notify CBRC when it intends to enter into material outsourcing arrangement.Article 57.Before entering into, or significantly changing, an outsourcing arrangement, the commercial bank should:(1)Analyze how the arrangement will fit with its organization and reporting structure;business strategy;overall risk profile;and ability to meet its regulatory obligations;(2)Consider whether the arrangements will allow it to monitor and control its operational risk exposure relating to the outsourcing;(3)Conduct appropriate due diligence of the service provider’s financial stability, expertise and risk assessment of the service provider, facilities and ability to cover the potential liabilities;(4)Consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement(including what will happen on the termination of the contract);and

(5)Consider any concentration risk implications such as the business continuity implications that may arise if a single service provider is used by several firms.Article 58.In negotiating its contract with a service provider, the commercial bank should have regard to(but not limited to):(1)Reporting and negotiation requirements it may wish to impose on the service provider;(2)Whether sufficient access will be available to its internal auditors, external auditors and banking regulators;(3)Information ownership rights, confidentiality agreements and Firewalls to protect client and other information(including arrangements at the termination of contract);of 15

4/17/2013(4)(5)(6)(7)(8)The adequacy of any guarantees and indemnities;The extent to which the service provider must comply with the commercial bank’s polices and procedures covering IT Risk;The extent to which the service provider will provide business continuity for outsourced operations, and whether exclusive access to its resources is agreed;The need for continued availability of software following difficulty at a third party supplier;The processes for making changes to the outsourcing arrangement and the conditions under which the commercial bank or service provider can choose to change or terminate the outsourcing arrangement, such as where there is: a)A change of ownership or control of the service provider or

commercial bank;or b)Significant change in the business operations of the service

provider or commercial bank;or c)Inadequate provision of services that may lead to the commercial

bank being unable to meet its regulatory obligations.Article 59.In implementing a relationship management framework, and drafting the service level agreement with the service provider, the commercial bank should have regarded to(but not limited to):(1)The identification of qualitative and quantitative performance targets to assess the adequacy of service provision, to both the commercial bank and its clients, where appropriate;(2)The evaluation of performance through service delivery reports and periodic self assessment and independent review by internal or external auditors;and

(3)Remediation action and escalation process for dealing with inadequate performance.Article 60.The commercial bank should enhance IT related outsourcing management, in place following(not limited to)measures to ensure data security of sensitive information such as customer information:(1)Effectively separated from other customer information of the service provider;(2)The related staff of service provider should be authorized on “need to know” and “minimum authorization” basis;

(3)Ensure service provider guarantee its staff for meeting the confidential requests;(4)All outsourcing arrangements related to customer information should be identified as material outsourcing arrangements and the customers should be notified;(5)Strictly monitor re-outsourcing actions of the service provider, and implement adequate control measures to ensure information security of the bank;(6)Ensure all related sensitive information be refunded or deleted from the service provider’s storage when terminating the outsourcing arrangement.Article 61.The commercial bank should ensure that it has appropriate contingency in the event of 15

4/17/2013 of a significant loss of services from the service provider.Particular issues to consider include a significant loss of resources, turnover of key staff, or financial failure of, the service provider, and unexpected termination of the outsourcing agreement.Article 62.All outsourcing contracts must be reviewed or signed off by IT Risk management, internal IT auditors, legal department and IT Steering Committee.There should be a process to periodically review and refine the service level agreements.Chapter IX Internal Audit

Article 63.Depending on the nature, scale and complexity of its business, it may be appropriate for the commercial banks to delegate much of the task of monitoring the appropriateness and effectiveness of its systems and controls to an internal audit function.An internal audit function should be adequately resourced and staffed by competent individuals, be independent of the day-to-day activities of the commercial bank and have appropriate access to the bank’s records.Article 64.The responsibilities of the internal IT audit function are:(1)To establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the bank’s systems and internal control mechanisms and arrangements;(2)To issue recommendations based on the result of work carried out in accordance with 1;(3)To verify compliance with those recommendations;(4)To carry out special audit on information technology.The term “special audit” of information technology refers to the investigation, analysis and assessment on the security incidents of the information system, or the audit performed on a special subject based on IT risk assessment result as deemed necessary by the audit department.Article 65.Based on the nature, scale and complexity of its business, deployment of information technology and IT risk assessment, commercial banks could determine the scope and frequency of IT internal audit.However, a comprehensive IT internal audit shall be performed at a minimum once every 3 years.Article 66.Commercial banks should engage its internal audit department and IT Risk management department when implementing system development of significant size and scale to ensure it meets the IT Risk standards of the Commercial banks.Chapter X External Audit

Article 67.The external information technology audit of commercial banks can be carried out by certified service providers in accordance with laws, rules and regulations.of 15

4/17/2013

Article 68.The commercial bank should ensure IT audit service provider to review and examine bank’s hardware, software, documentation and data to identify IT risk when they are commissioned to perform the audit.Vital commercial and technical information which is protected by national laws and regulations should not be reviewed.Article 69.Commercial bank should communicate with the service provider in depth before the audit to determine audit scope, and should not withhold the truth or do not corporate with the service provider intentionally.Article 70.CBRC and its local offices could designate certified service providers to carry out IT audit or related review on commercial banks when needed.When carrying out audit on commercial banks, as commissioned or authorized by CBRC or its local offices, the service providers shall present the letter of authority, and carry out the audit in accordance to the scope prescribed in the letter of authority.Article 71.Once the IT audit report produced by the service providers is reviewed and approved by CBRC or its local offices, the report will have the same legal status as if it is produced by the CBRC itself.Commercial banks should come up with a correction action plan prescribed in the report and implement the corrective actions according to the timeframe.Article 72.Commercial banks should ensure the service providers to strictly comply with laws and regulations to keep confidential and data security of any commercial secrets and private information learnt and IT risk information when conducting the audit.The service provider should not modify copy or take away any documents provided by the commercial banks.Chapter XI

Supplementary Provisions

Article 73.Commercial banks with no board of directors should have their operating decision-making bodies perform the responsibilities of the board with regard to IT risk management specified herein.Article 74.The China Banking Regulatory Commission supervises and regulates the IT risk management of commercial banks under its authority by law.Article 75.The power of interpretation and modification of the Guidelines shall rest with the China Banking Regulatory Commission.Article 76.The Guidelines shall become effective as of the date of its issuance and the former Guidelines on the Risk Management of Banking Institutions’ Information Systems shall be revoked at the same time.15 of 15 4/17/2013

久久99精品久久久久久琪琪,久久人人爽人人爽人人片亞洲,熟妇人妻无码中文字幕,亚洲精品无码久久久久久久

商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

第一篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

第二篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引

第三篇：《商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引》

第四篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引（推薦）

第五篇：商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引_英文版

相關(guān)范文推薦

某商業(yè)銀行信息科技風(fēng)險(xiǎn)管理指引—(正式版)

商業(yè)銀行流動(dòng)性風(fēng)險(xiǎn)管理指引

商業(yè)銀行流動(dòng)性風(fēng)險(xiǎn)管理指引

商業(yè)銀行聲譽(yù)風(fēng)險(xiǎn)管理指引（本站推薦）

商業(yè)銀行操作風(fēng)險(xiǎn)管理指引

商業(yè)銀行聲譽(yù)風(fēng)險(xiǎn)管理指引5篇

商業(yè)銀行合規(guī)風(fēng)險(xiǎn)管理指引

商業(yè)銀行合規(guī)風(fēng)險(xiǎn)管理指引