EU EBA GL/2019/04 — Guidelines on ICT and Security Risk Management

Why it Matters

The EBA Guidelines on ICT and Security Risk Management help financialinstitutions safeguard operations and customer data while meetingevolving regulatory expectations.

Key benefits include:

• Strengthen ICT governance

Establish clearpolicies and accountability for managing technology and securityrisks across the organization.

• Enhance regulatory alignment

Supportcompliance with EU financial sector requirements by aligning internalcontrols to supervisory expectations and obligations.

• Promote operational resilience

Enableorganizations to anticipate, withstand, and recover from ICT-relateddisruptions and cyber threats more effectively.

• Improve incident response planning

Ensure thatprocesses for identifying, escalating, and managing securityincidents are structured, documented, and regularly tested.

• Support audit and compliance readiness

Facilitatethorough documentation and systematic evidence collection,streamlining external audits and regulatory reporting processes.

How it Works

The EU EBA GL/2019/04 — Guidelines on ICT and Security RiskManagement is structured around governance domains, a risk managementlifecycle, and a set of security safeguards and regulatoryrequirements covering ICT operations, third‑party risk,incident reporting, and resilience testing. It establishes roles andresponsibilities, control families, and processes for ongoingmonitoring and continuous improvement.

Organizations apply the guidelines by conducting ICT riskassessments, implementing security controls, formalizing governanceand third‑party arrangements, and integrating incident responseand business continuity plans. Firms map controls to the EBArequirements, perform testing and monitoring, collect evidence forcompliance, and use findings to prioritize remediation and elevatematurity across security practices.

In SmartSuite, teams operationalize EU EBA GL/2019/04 by importingcontrol libraries and mapping them to a risk register, managingpolicy governance and third‑party inventories, and centralizingevidence collection. The platform enables compliance tracking,automated remediation workflows, incident tracking, audit readiness,and reporting dashboards to support continuous monitoring andgovernance.

Key Elements

• ICT Governance Structure

Establishesoversight responsibilities, decision-making authorities, andaccountability for ICT and security risk management activities.

• ICT Risk Assessment Processes

Describesapproaches for identifying, evaluating, and prioritizing ICT-relatedthreats and vulnerabilities to information systems.

• Security Control Domains

Organizestechnical and organizational safeguards protecting criticalinfrastructure, sensitive data, and digital services.

• Incident Handling Framework

Specifies methodsfor detecting, reporting, and managing ICT and security incidents,including response and communication protocols.

• Business Continuity Arrangements

Defines measuresto ensure operational resilience and continuity of critical functionsduring ICT disruptions or cyber events.

• Outsourcing and Third-Party Risk Management

Outlinesprocedures for evaluating, monitoring, and managing risks associatedwith external service providers and supply chains.

• Compliance and Audit Mechanisms

Providesstructures for ongoing monitoring, assessment, and demonstration ofadherence with regulatory and EBA guideline requirements.

Framework Scope

EU EBA GL/2019/04 — Guidelines on ICT and Security Risk Managementis adopted by credit institutions, investment firms, and paymentservice providers managing financial data and ICT assets. Theframework oversees information systems and digital infrastructure,typically implemented to meet regulatory obligations, improve ICTrisk management, and support operational resilience and complianceoversight.

Framework Objectives

EU EBA GL/2019/04 — Guidelines on ICT and Security Risk Managementdefines essential objectives for managing ICT and security risks inthe financial sector.

Strengthen cybersecurity risk management and organizationalgovernance practices

Safeguard sensitive data through effective ICT security controls andprocesses

Enhance operational resilience against cyber threats and disruptions

Support compliance with EU regulatory requirements for financialinstitutions

Improve data protection and safeguards for critical businessinformation

Promote audit readiness and robust oversight of ICT risk managementEU EBA GL/2019/04 provides EU banking-specific guidance on ICT andsecurity risk management and operational resilience, often mapped tostandards like ISO/IEC 27001/27002 and DORA and aligned with GDPRrequirements. Banks and financial institutions implement it forregulatory compliance, strengthening operational resilience, securitygovernance, and audit or supervisory preparedness.

Framework in Context

EU EBA GL/2019/04provides EU banking-specific guidance on ICT and security riskmanagement and operational resilience, often mapped to standards likeISO/IEC 27001/27002 and DORA and aligned with GDPR requirements.Banks and financial institutions implement it for regulatorycompliance, strengthening operational resilience, securitygovernance, and audit or supervisory preparedness.

Common Framework Mappings

Organizations map EBA ICT and security guidelines to other standardsto achieve regulatory alignment, harmonize controls, and simplifyaudits across data protection, operational resilience, and technicalsecurity programs.

Mapped frameworks include:

CIS Critical Security Controls

EU Digital Operational Resilience Act (DORA)

EU General Data Protection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27002

NIST Cybersecurity Framework

NIST SP 800-53

SWIFT Customer Security Programme (CSP)

‍