Page 24 - FIGI Digital Financial Services security assurance framework

A high-level risk management process plan is shown in figure 11 below, which encompasses the four phases of
the PDCA.

Figure 11 - Risk Management process

s
t
o
C
E Establish Context t
s
i
l
a
h
b
n
e
t
x
e
e
R Risk Assessment t
i
s

n
A
s
k
s
m
s
s
s
d
R
y
f
t
i
e
i

k
I Identify Risks s
n
z
a
y
s
s
i
A Analyze Risks
k

R
e
n
l
i
u

s
e
t
a
k
R
E Evaluate Risks s No
v
a
l
Communicate Risks Communicate Risks I Is risk
k

r
s
i
s
e
m
s
s
n
e
s
s
p
t
l
e
c complete
m
e
o
m
m
m
m
M Management
m
M M M M M M a a a a a a a n n n n n n n a a a a a a a g g g g g g g e e e e e e e m e e e e e e e n n n n n n n t t t t t t t A Assessment t Monitor and Review Monitor and Review A Assurance e I Interested
m
s
n
n
e
s
n
s
n I I I I I I
s
n
s
s
s
n
n
e
r
e
e
e
r
r
e
r
e
r
r
r
e
t
t
e
t
t
t
t
e
e
e
t
e
e
t
t
t
d
t
e
d
t
t
t
d
e
e
e
e
e
d
d
d
e
d
a
r
c
n
u
s
s
a
a
a
t
t
a
t
i
a
a
a
r
r
r
t
r
r
t
t
t
r
r
s
s
s
e
e
s
i
e
s
s
s
i
e
e
i
e
e
i
i
i
Y Yes s R R R R R R e e e e e e e P P P P P P P Parties, , , , , , , , r r r r r r r s s s s s s s
e
t
t
a
a
a
t
t
t
t
t
o
o
a
o
o
o
l
o
o
a
l
a
a
l
l
l
l
l
g
g
g
g
R Regulators
g
g
g
u
u
u
u
u
u
u
R

i
k
s
r
e
a
t
T Treat Risks s
s
i
s
k
R
e
r

A Are Risks
t
a acceptable e No
b
a
e
c
p
c
l
e
Y Yes s
c
R Risk Acceptance e
i
c
k
s
a
A
e
c

p
t
n
7�1 Scope This framework also includes the controls that
The DFS security assurance framework is applica- have to be deployed by the DFS provider who may
ble to stakeholders in the DFS ecosystem. It defines be a financial institution like a bank or non-bank pro-
security controls to be adopted by DFS users, mobile vider, in some cases the communications network
network operators, providers including banks and provider is also the digital financial services provider.
other licensed non-bank financial institutions, who
supply financial products and services through digi- 7�2 Establishing a context
tal means; these controls can be applied to the assets This is the initial step in the risk management process
such as the infrastructure, applications and devices and the objective is for the stakeholder to gain an
that make digital financial services possible. understanding the DFS operating environment. This
For the user, the framework focuses on the securi- involves identifying internal and external events that
ty controls for the devices like mobile handsets used affect the ability to achieve end to end security, it
to access digital financial services. The means and is therefore important for the stakeholder to under-
technology are usually provided by a mobile network stand and assess the internal and external context
operator that allows for communication between the within which digital financial services operate, this
user and the DFS provider, the framework focuses on also helps frame the scope of the risk assessment.
what the communications network provider has to In order to establish the internal context, the fol-
do to secure the ecosystem. lowing must be formulated.
22 Digital Financial Services Security Assurance Framework