ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 10.3: Validate controls through regular vulnerability assessments and scoped adversarial testing with remediation and retest

What does 10.3 require?

A process runs vulnerability assessments of the IT environment regularly and as threat information emerges, prioritising critical systems and addressing findings through change and patch management with reference to industry standards and vendor recommendations. Adversarial testing on production systems with safeguards is arranged regularly, such as penetration tests, phishing exercises, threat hunting, bug bounty programmes and red teaming, and findings drive control, policy and process improvements. Scoping identifies the assets and objectives, defines compromise scenarios by channel, sets approach and methodology with an agreed stop point to contain harm, chooses tools, sets a duration that does not compromise customer services, and formally documents and prioritises findings by severity, impact and likelihood under a risk rating methodology, remediating and retesting all findings before closure; relevant stakeholders, from the board and senior managers to business functions, third parties and customers, are involved as appropriate.