SOC for Cybersecurity - Cybersecurity Risk Management Examination DC5: Factors significantly affecting inherent cybersecurity risk: technology and connectivity, organisation and users, and changes in the period

What does DC5 require?

Describe factors with a significant effect on inherent risk: (1) technologies, connection types, service providers and delivery channels (outsourcing and cloud, mobile, network architecture and virtualisation, application and infrastructure types and sources, service providers and external parties with access to sensitive data, external web and in-house applications, dependence on unsupported or emerging-technology equipment); (2) organisational and user characteristics (IT organisation size and structure, user groups, presence in high-risk countries, split of responsibilities between business and IT, separately administered units); and (3) changes during the period (products and channels, key personnel, processes, architecture and providers, unintegrated acquisitions, legal and regulatory changes, divestitures with ongoing support obligations).