ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 2.5: Maintain an incident management framework: detection, investigation and escalation, response and recovery, communication, regulatory and law enforcement reporting, and contractual breach handling

What does 2.5 require?

An incident management framework sets out how risk events are investigated with evidence preserved, how incident severity is classified, the processes used to spot, handle and recover from each incident type, who holds which role, which stakeholders are updated when and with what, and the criteria for activating business continuity plans and crisis management teams; it is reviewed, tested and updated regularly. Systems detect risk events and staff and external parties can report them, all hardware, software, networks and connections are monitored, and the framework and lessons learned are broadcast to staff. Risk events are investigated promptly to confirm whether they are incidents, incidents receive an initial severity that is reassessed as they develop, impact is scoped and contained quickly, and resources including third parties are available at all times with performance and reporting requirements. For material incidents the board and senior managers are kept informed so they can decide whether to activate business continuity; an approved, tested incident playbook covers common incidents and aligns with continuity and disaster recovery plans; and every incident ends with an after-action review whose lessons become improved procedures, controls or system changes. A communication plan covers at least the board, senior managers, the media, customers and the general public, setting messages, timing, recipients and coordination points with pre-drafted statements where possible, kept current and known to staff, with deviations only where senior management understands and accepts the consequences. Procedures and escalation frameworks meet regulators' incident reporting duties in whatever format they prescribe; suspected crimes are reported to law enforcement with the chain of evidence maintained; and procedures identify and notify breaches of contractual obligations to customers and counterparties and mitigate further non-performance.