EU EBA GL/2019/04 — Guidelines on ICT and Security Risk Management

Overview

EU EBAGL/2019/04 — Guidelines on ICT and Security Risk Management is aregulatory framework that provides financial institutions withrequirements and best practices to identify, manage, and mitigateinformation and communication technology (ICT) and security risks.The guidelines aim to enhance operational resilience, safeguardsensitive data, and strengthen protections against cyber threats anddisruptions.

Published by theEuropean Banking Authority (EBA), this framework applies to creditinstitutions, investment firms, and payment service providers acrossthe European Union. It covers a broad range of areas, includingcybersecurity controls, risk assessment methodologies, incidentresponse planning, business continuity management, and regulatorycompliance with digital operational resilience requirements.

Organizationstypically integrate the EBA Guidelines into their risk management andsecurity programs by establishing robust ICT controls, conductingregular risk assessments, documenting incident handling processes,and aligning with other regulatory and industry frameworks such asDORA, ISO 27001, or NIST standards. This supports effectivegovernance, audit readiness, and ongoing compliance with EU financialsector regulations.

Why it Matters

The EBAGuidelines on ICT and Security Risk Management help financialinstitutions safeguard operations and customer data while meetingevolving regulatory expectations.

Key benefitsinclude:

•  Strengthen ICT governance

Establish clearpolicies and accountability for managing technology and securityrisks across the organization.

•  Enhance regulatory alignment

Supportcompliance with EU financial sector requirements by aligning internalcontrols to supervisory expectations and obligations.

•  Promote operational resilience

Enableorganizations to anticipate, withstand, and recover from ICT-relateddisruptions and cyber threats more effectively.

•  Improve incident response planning

Ensure thatprocesses for identifying, escalating, and managing securityincidents are structured, documented, and regularly tested.

•  Support audit and compliance readiness

Facilitatethorough documentation and systematic evidence collection,streamlining external audits and regulatory reporting processes.

How it Works

The EU EBAGL/2019/04 — Guidelines on ICT and Security Risk Management isstructured around governance domains, a risk management lifecycle,and a set of security safeguards and regulatory requirements coveringICT operations, third party risk, incident reporting, andresilience testing. It establishes roles and responsibilities,control families, and processes for ongoing monitoring and continuousimprovement.

Organizationsapply the guidelines by conducting ICT risk assessments, implementingsecurity controls, formalizing governance and third partyarrangements, and integrating incident response and businesscontinuity plans. Firms map controls to the EBA requirements, performtesting and monitoring, collect evidence for compliance, and usefindings to prioritize remediation and elevate maturity acrosssecurity practices.

In SmartSuite,teams operationalize EU EBA GL/2019/04 by importing control librariesand mapping them to a risk register, managing policy governance andthird party inventories, and centralizing evidence collection.The platform enables compliance tracking, automated remediationworkflows, incident tracking, audit readiness, and reportingdashboards to support continuous monitoring and governance.

Key Elements

•  ICT Governance Structure

Establishesoversight responsibilities, decision-making authorities, andaccountability for ICT and security risk management activities.

•  ICT Risk Assessment Processes

Describesapproaches for identifying, evaluating, and prioritizing ICT-relatedthreats and vulnerabilities to information systems.

•  Security Control Domains

Organizestechnical and organizational safeguards protecting criticalinfrastructure, sensitive data, and digital services.

•  Incident Handling Framework

Specifiesmethods for detecting, reporting, and managing ICT and securityincidents, including response and communication protocols.

•  Business Continuity Arrangements

Defines measuresto ensure operational resilience and continuity of critical functionsduring ICT disruptions or cyber events.

•  Outsourcing and Third-Party Risk Management

Outlinesprocedures for evaluating, monitoring, and managing risks associatedwith external service providers and supply chains.

•  Compliance and Audit Mechanisms

Providesstructures for ongoing monitoring, assessment, and demonstration ofadherence with regulatory and EBA guideline requirements.

Framework Scope

EU EBAGL/2019/04 — Guidelines on ICT and Security Risk Management isadopted by credit institutions, investment firms, and payment serviceproviders managing financial data and ICT assets. The frameworkoversees information systems and digital infrastructure, typicallyimplemented to meet regulatory obligations, improve ICT riskmanagement, and support operational resilience and complianceoversight.

Framework Objectives

EU EBAGL/2019/04 — Guidelines on ICT and Security Risk Management definesessential objectives for managing ICT and security risks in thefinancial sector.

•  Strengthen cybersecurity risk management and organizationalgovernance practices

•  Safeguard sensitive data through effective ICT security controlsand processes

•  Enhance operational resilience against cyber threats anddisruptions

•  Support compliance with EU regulatory requirements for financialinstitutions

•  Improve data protection and safeguards for critical businessinformation

•  Promote audit readiness and robust oversight of ICT riskmanagement EU EBA GL/2019/04 provides EU banking-specific guidance onICT and security risk management and operational resilience, oftenmapped to standards like ISO/IEC 27001/27002 and DORA and alignedwith GDPR requirements. Banks and financial institutions implement itfor regulatory compliance, strengthening operational resilience,security governance, and audit or supervisory preparedness.

Common Framework Mappings

Organizationsmap EBA ICT and security guidelines to other standards to achieveregulatory alignment, harmonize controls, and simplify audits acrossdata protection, operational resilience, and technical securityprograms.

Mappedframeworks include:

CIS CriticalSecurity Controls

EU DigitalOperational Resilience Act (DORA)

EU General DataProtection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27002

NISTCybersecurity Framework

NIST SP 800-53

SWIFT CustomerSecurity Programme (CSP)