In Episode 5 of MFSA's Podcasts Series
'Navigating Financial Regulation', the speakers, Beatriz
Brunelli Zimmermann and Matthew BenHamed, Analysts within the
Supervisory ICT Risk and Cybersecurity function at the MFSA, delved
into the requirements of Chapter III of the DORA Regulation as regards managing,
classification and reporting of ICT-related incidents, particularly
what financial entities must have in place as regards both pre- and
post-incident phases.
Essentially, Chapter III of DORA can be classified into three,
(i) management, (ii) classification, and (iii) reporting.
Management
First and foremost, as explained by Beatriz Brunelli Zimmermann,
the 'management of an incident' refers to anything that a
financial entity needs to have in place as an inherent part of its
management of ICT-related entities, therefore at a pre-incident
phase. In fact, according to Article 15 of DORA,
"Financial entities shall establish and implement an
ICT-related incident
