Home   »   Critical ICT Third-Party Risk Management for Banks

Critical ICT Third-Party Risk Management for Banks

Critical ICT Third-Party Risk Management for Banks

 

OVERVIEW

Critical ICT Third-Party Risk Management for Banks adalah pendekatan untuk mengidentifikasi, menilai, mengendalikan, dan memantau risiko yang timbul dari penggunaan pihak ketiga penyedia layanan teknologi informasi (ICT) yang kritikal bagi operasional perbankan.

Ketergantungan bank terhadap penyedia layanan teknologi informasi (ICT third party) semakin meningkat, mulai dari cloud computing, data center, fintech, payment gateway, core banking support, cybersecurity, hingga berbagai layanan digital lainnya. Kondisi ini menciptakan risiko strategis, operasional, keamanan informasi, kepatuhan, konsentrasi vendor, dan risiko gangguan layanan yang dapat berdampak langsung terhadap stabilitas serta kepercayaan nasabah.

Pelatihan Critical ICT Third-Party Risk Management for Banks dirancang untuk membantu bank membangun tata kelola dan pengendalian risiko pihak ketiga secara lebih komprehensif, mulai dari due diligence, risk assessment, vendor selection, contract management, monitoring, incident management, business continuity hingga exit strategy.

 

TUJUAN

1. Memahami konsep dan karakteristik ICT Third-Party Risk Management dalam industri perbankan.
2. Mengidentifikasi risiko kritikal dari penggunaan vendor dan penyedia layanan ICT.
3. Menyusun risk-based vendor due diligence dan proses seleksi penyedia jasa.
4. Melakukan klasifikasi dan penilaian critical ICT third party.
5. Memahami pengelolaan risiko cloud, data center, cybersecurity, dan outsourced IT services.
6. Menyusun klausul kontrak yang mendukung perlindungan kepentingan dan keamanan bank.
7. Membangun mekanisme monitoring, assessment, audit, dan performance evaluation vendor.
8. Meningkatkan kesiapan bank menghadapi ICT incident, cyber incident, dan service disruption.
9. Menyusun Business Continuity, contingency dan exit strategy untuk vendor kritikal.
10. Mengembangkan framework ICT third-party risk yang terintegrasi dengan Enterprise Risk Management dan Operational Risk Management.

 

MATERI Training Critical ICT Third-Party Risk Management for Banks

1. Fundamentals of ICT Third-Party Risk Management in Banking

• Konsep dan karakteristik ICT third-party risk.
• Risiko outsourcing dan ketergantungan teknologi.
• Dampak terhadap operasional, keuangan, reputasi, dan kepatuhan bank.

2. ICT Third-Party Governance & Regulatory Framework

• Governance dan policy pengelolaan pihak ketiga.
• Peran Board, Management, Risk, IT, Compliance, dan Procurement.
• Three Lines Model dan accountability.

3. Critical ICT Third-Party Identification & Risk Classification

• Identifikasi vendor dan layanan ICT kritikal.
• Criticality assessment.
• Vendor classification.
• Concentration risk dan single point of failure.

4. Third-Party Due Diligence & Risk Assessment

• Vendor due diligence.
• Financial, operational, technical, dan cybersecurity assessment.
• Inherent dan residual risk.
• Risk scoring, risk rating, dan risk matrix.

5. Cybersecurity, Data Protection & Cloud Third-Party Risk

• Cybersecurity risk pada vendor.
• Data protection dan privacy.
• Cloud service provider risk.
• Data leakage, access control, dan cyber incident.

6. ICT Outsourcing Contract, SLA & Vendor Management

• Critical clauses dalam kontrak ICT.
• SLA, KPI, dan KRI.
• Audit rights dan regulatory access.
• Subcontracting dan vendor accountability.

7. Continuous Monitoring, Performance & Compliance

• Monitoring risiko vendor secara berkala.
• Vendor performance evaluation.
• Continuous risk assessment.
• Vendor scorecard dan early warning indicators.

8. ICT Third-Party Incident, Crisis & Cyber Response

• Incident identification dan escalation.
• Cyber incident response.
• Crisis communication.
• Root cause analysis dan corrective action.

9. Business Continuity, ICT Resilience & Exit Strategy

• Business Continuity dan Disaster Recovery.
• RTO & RPO.
• Resilience testing.
• Vendor transition, data migration, dan exit strategy.

10. Building an Integrated ICT Third-Party Risk Management Framework

• End-to-end third-party risk lifecycle.
• Risk appetite dan risk tolerance.
• ICT third-party risk dashboard.
• Management reporting.
• Strategic roadmap implementasi di bank.