ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 10.1: Maintain cyber threat awareness through intelligence, controlled dissemination, oversight of third-party threats and participation in sharing

What does 10.1 require?

The institution follows developments in the cyber threat landscape to inform control enhancements such as adjusting DDoS mitigation, updating anti-malware signatures or replacing fundamentally vulnerable products, drawing on public vulnerability and attack method knowledge bases and national cyber security centre advisories, through an in-house threat intelligence function or a third-party service that may also detect abuse of its brand or data and pursue takedowns. Policies govern classification and controlled dissemination of intelligence so it does not reach threat actors; awareness extends to known threats to third parties, from which assurance of mitigation is obtained; and the institution is encouraged to contribute to and join threat information sharing arrangements.