ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
The ADGM FSRA's IT risk management guidance for financial institutions: 46 Desired Outcomes with the best practices under each, covering governance and accountability, risk culture and training, a domain-wide risk framework with register and control metrics, incident, problem and insider risk management, third-party lifecycle and supply chain, compliance and audit, system lifecycle including cloud and secure development, asset management, infrastructure and network security, change and patch management, data lifecycle, resilience and continuity, cyber threat awareness, event management and security testing, access management, online transaction security and fraud, cryptography and key management, and governance of algorithm-driven and decentralised infrastructure solutions.
ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) is a compliance framework from Abu Dhabi Global Market (UAE) with 15 domains and 46 controls. The largest domains are Chapter 2 Risk Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) (7 controls), Chapter 7 Operational Infrastructure Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) (5 controls), Chapter 1 Governance and Oversight – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (15)
Chapter 1 Governance and Oversight – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::1.1 | Align IT strategy with business strategy, with the Governing Body accountable and senior management resourced to deliver |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::1.2 | Ensure the Governing Body, senior management, staff and third parties are competent to manage IT risk |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::1.3 | Assign clear accountability for IT risk, name an owner for every risk source and make consequences realistic |
Chapter 10 Cyber Event Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::10.1 | Maintain cyber threat awareness through intelligence, controlled dissemination, oversight of third-party threats and participation in sharing |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::10.2 | Detect and manage cyber events to resolution: log analytics, response procedures integrated with incident management, updated monitoring and oversight of outsourced monitoring |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::10.3 | Validate controls through regular vulnerability assessments and scoped adversarial testing with remediation and retest |
Chapter 11 Access Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::11.1 | Manage credentials through their lifecycle: approved issuance, secure storage, uniqueness, strong passwords or password-less controls, third-party parity, regular reviews, vetted federation, privileged credential discipline and tamper-proof logging |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::11.2 | Authorise on least privilege with segregation of duties, never-alone for privileged activity, no unfettered access for anyone, and regular policy reviews |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::11.3 | Authenticate in proportion to criticality with risk-based MFA, lockout limits, controlled concurrency, vetted external solutions and reviews, and secure OTP, biometric and SSO implementations |
Chapter 12 Online Transaction Security – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::12.1 | Secure online financial services: MFA at login, step-up authentication on distinct channels for high-risk activities, hardened sessions, blocked anonymising protocols, and vetted third-party platforms and providers |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::12.2 | Detect, report and investigate fraud on online services, notify and support affected customers and replace compromised credentials |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::12.3 | Keep customers informed of online risks, rights and responsibilities, threat techniques and platform changes |
Chapter 13 Cryptography – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::13.1 | Use recognised, current cryptographic schemes suited to each use case, keep them resistant to new techniques, secure any PKI and assess post-quantum needs |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::13.2 | Manage cryptographic keys securely through their lifecycle: generation in secure modules, protected storage and transport, purpose and expiry controls, revocation and destruction, inventory, rotation, compromise response, third-party oversight and logging |
Chapter 14 Algorithm Driven Solutions – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::14.1 | Govern algorithm-driven solutions: an approved framework with materiality classification, competent staff, executive accountability per solution, defined objectives with error detection, secure development and testing, vetted sourced models and updates, and acceptable use policies for public tools |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::14.2 | Use algorithm-driven solutions safely: explainable decisions aligned to ethical norms and law, trained human-in-the-loop staff, defence against model attacks, disclosure to affected external parties, regular validation for accuracy and bias, drift review, and no weakening of existing controls |
Chapter 15 Decentralised Infrastructure Solutions – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::15.1 | Understand each decentralised infrastructure solution and its specific IT risks before adopting or participating |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::15.2 | Participate securely in decentralised infrastructure: an approved governance framework, due diligence and ongoing oversight, criminal-use safeguards, monitoring and tracing, regulatory-safe data, AML and sanctions screening, segregated and patched components, governed voting, exit readiness, continuity, programmable contract and digital wallet security |
Chapter 2 Risk Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.1 | Foster a culture of IT risk awareness from the top, with open incident reporting and monitored awareness |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.2 | Run a regular, tailored IT risk awareness training programme for all staff and keep it current |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.3 | Operate a risk assessment framework covering all IT risk domains, integrated with operational risk, with governance, a risk appetite, residual risk acceptance and a risk register |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.4 | Measure control effectiveness with defined metrics, collect them reliably, review them and redesign failing controls |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.5 | Maintain an incident management framework: detection, investigation and escalation, response and recovery, communication, regulatory and law enforcement reporting, and contractual breach handling |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.6 | Practise problem management: study risk events over time to find and fix systemic causes |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::2.7 | Mitigate insider risk with proportionate background checks and monitoring |
Chapter 3 Third Party Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::3.1 | Govern third-party risk within the risk framework: accountability, a management framework and forum, intra-group oversight, KPIs, a register, concentration risk, materiality and outsourcing exit |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::3.2 | Manage each third-party arrangement through its lifecycle: documented due diligence, enforceable contracts with sub-contracting and data clauses, proportionate monitoring and audits, and controlled termination |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::3.3 | Understand and diversify the supply chain behind material third parties and oversee onward data sharing |
Chapter 4 Compliance and Audit – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::4.1 | Build IT regulatory obligations into the compliance programme and test compliance with them |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::4.2 | Give the audit function the competence and coverage to assess IT risk independently, with a board-approved plan, tracked findings and external audit |
Chapter 5 System Lifecycle Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::5.1 | Govern IT projects through a project management framework with competent oversight, a justified business case and a defined plan |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::5.2 | Control system acquisition, development and testing: end-user computing approval, vendor due diligence and security parity, cloud responsibilities, secure development practices, code and open-source controls, and pre-deployment testing |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::5.3 | Track system lifespans to avoid unsupported technology, approve any retained legacy through risk acceptance, and decommission systems and data securely with a documented chain of custody |
Chapter 6 Technology Asset Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::6.1 | Inventory every technology asset, classify it by criticality and data sensitivity, and define what makes a system critical |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::6.2 | Assign every asset to a responsible party and manage asset credentials with recovery procedures |
Chapter 7 Operational Infrastructure Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::7.1 | Standardise configurations through a maintained library of hardened images or templates reviewed against known threats |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::7.2 | Secure physical assets: enforced configurations, endpoint protection, a data loss prevention strategy, encryption of sensitive devices and only authorised devices and services |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::7.3 | Secure networks and connections: segmentation, documented design, access controls and perimeter defences, wireless, VPN, encrypted transfers, API security and hardened internet-facing services |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::7.4 | Secure virtual environments: BYOD and virtual machine controls, device posture checks, remote wipe, data transfer policies and vetted web and mobile services |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::7.5 | Keep environments current and controlled: segregated environments, governed use of production data, change and patch management from verified sources, testing, controlled production deployment with backups, monitoring and rollback, and oversight of third-party updates |
Chapter 8 Data Lifecycle Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::8.1 | Establish data governance structures with a senior executive accountable for each dataset, competent data managers and approved, reviewed deviations |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::8.2 | Manage data across its lifecycle: identification and inventory, minimised collection, disciplined processing, classification-based controls, a storage and backup framework with restoration testing, governed use, transfer and sharing, and recorded destruction |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::8.3 | Design for regulated data from the outset: locate it quickly, enforce retention and other obligations, and report risk events affecting it |
Chapter 9 Resilience – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)
| Code | Title |
|---|---|
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::9.1 | Architect systems, networks and data centres for availability objectives: remove single points of failure and concentration risk, provision capacity, add redundancy and diversity, and secure redundant data centres |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::9.2 | Plan business continuity: identify critical services, set minimum service levels, tolerable disruption, RTOs and RPOs, prioritise systems, and maintain an IT BCP with a steering group |
| adgm-fsra-information-technology-risk-management-guidance-ver01-201124::9.3 | Build scenario-based recovery plans aligned to RTOs and RPOs, approve, review and test them regularly with stakeholders and third parties, operate from recovery arrangements, and follow tested procedures on activation |
What is ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) and who does it apply to?
ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) is a compliance framework from Abu Dhabi Global Market (UAE) with 15 domains and 46 controls. The ADGM FSRA's IT risk management guidance for financial institutions: 46 Desired Outcomes with the best practices under each, covering governance and accountability, risk culture and training, a domain-wide risk framework with register and control metrics, incident, problem and insider risk management, third-party lifecycle and supply chain, compliance and audit, system lifecycle including cloud and secure development, asset management, infrastructure and network security, change and patch management, data lifecycle, resilience and continuity, cyber threat awareness, event management and security testing, access management, online transaction security and fraud, cryptography and key management, and governance of algorithm-driven and decentralised infrastructure solutions. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) actually require?
ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) has 46 controls organised across 15 domains. The largest domains are Chapter 2 Risk Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) (7 controls), Chapter 7 Operational Infrastructure Management – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) (5 controls), Chapter 1 Governance and Oversight – ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) do I already cover?
ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ADGM FSRA Information Technology Risk Management Guidance (VER01.201124)?
Start your ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 46 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required