IT Systems Breaching Legal or Regulatory Obligations
Below are the details of the operational risks covered within this selected sub-risk category:
Architecture or functionality within IT Systems breach legal or regulatory obligations
Risk Description: -
The architecture or functionality of IT Systems may breach legal or regulatory obligations. Such obligations may include: -
- Storing detailed audit trail of all user actions.
- Strong password management on IT Systems with customer information.
- Preventing breach of Chinese walls.
Duration or structure of information stored within IT Systems breach of legal or regulatory obligations
Risk Description: -
The duration or structure of information stored within IT Systems may breach legal or regulatory obligations. Such obligations may include: -
- Storing emails for a certain time period (e.g. 5 years).
- Information about ex-customers should only be stored for a certain time period (e.g. 2 years).
- Retrieve archived information within a time period (e.g. 48 hours) of request by regulatory authority.