BCBS Principles for Operational Resilience (2021) P7-38: Identify critical information assets and infrastructure, prioritise cyber efforts by risk, keep critical information intact through secure storage and immutable offline backup, and evaluate threats and vulnerabilities regularly

What does P7-38 require?

The bank knows which information assets are critical and which infrastructure they rest on, and directs cyber effort according to its ICT risk assessment and how much each asset matters to critical operations, without breaching data protection and confidentiality law. It plans and implements controls that keep critical information intact through a cyber event, for example secure storage and an offline backup on immutable media of the data behind critical operations, and it regularly re-examines the threat picture for those assets, tests for weaknesses and confirms they can withstand ICT risk.