Risk Management Policy

This Risk Management Policy establishes a framework for identifying, assessing, managing, monitoring, and mitigating risks related to ICT systems and operations. Designed to comply with the Digital Operational Resilience Act (DORA), the policy enhances operational resilience, security, and regulatory compliance.

• Risk Identification: Conducts regular assessments to identify and classify risks by type, including operational, technical, and third-party risks.
• Risk Mitigation: Develops strategies to address risks, such as strengthening controls, establishing redundancies, and updating security configurations.
• Monitoring and Reporting: Implements continuous monitoring tools and regular reporting to senior management and the board.
• Third-Party Risk Management: Evaluates and audits third-party vendors, ensuring contractual alignment with security and resilience requirements.
• Compliance: Aligns risk management practices with DORA requirements and ensures timely reporting of significant risks to regulatory authorities.

This policy provides a structured approach to managing ICT risks, supporting the organization's operational resilience and regulatory obligations.