ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 2.1: Foster a culture of IT risk awareness from the top, with open incident reporting and monitored awareness

What does 2.1 require?

The Governing Body and senior management set the tone from the top by showing personal commitment to mitigating IT risk, steering between risk aversion and risk blindness. They build a culture of open reporting in which all incidents, however minor, and near misses are reported so patterns can be found and fixed, creating an environment where staff are comfortable flagging gaps and the emphasis is on learning rather than blame. A framework monitors staff awareness of IT risk using qualitative factors such as perceptions of security and quantitative factors such as risk event counts, is reviewed periodically for relevance, and its results are reviewed regularly for lessons and improvements.