商業(yè)銀行信息科技風(fēng)險(xiǎn)現(xiàn)場(chǎng)檢查指南 (一)

商業(yè)銀行信息科技風(fēng)險(xiǎn)

現(xiàn)場(chǎng)檢查指南

目錄

第一部分概述...................................................................12

1.指南說(shuō)明.....................................................................13

1.1目的及適用范圍.........................................................13

1.2編寫原則................................................................14

1.3指南框架................................................................15

第二部分科技管理..............................................................17

2.信息科技治理................................................................18

2.1董事會(huì)及高級(jí)管理層......................................................18

檢查項(xiàng)1:董事會(huì).......................................................18

檢查項(xiàng)2：信息科技管理委員會(huì)..........................................19

檢查項(xiàng)3:首席信息官（CIO）...........................................20

2.2信息科技部門............................................................21

檢查項(xiàng)1：信息科技部門................................................21

檢查項(xiàng)2：信息科技戰(zhàn)略規(guī)劃............................................23

2.3信息科技風(fēng)險(xiǎn)管理部門...................................................24

檢查項(xiàng)1：信息科技風(fēng)險(xiǎn)管理部門........................................24

2.4信息科技風(fēng)險(xiǎn)審計(jì)部門...................................................25

檢查項(xiàng)1：信息科技風(fēng)險(xiǎn)審計(jì)部門........................................25

2.5知識(shí)產(chǎn)權(quán)保護(hù)和信息披露.................................................26

檢查項(xiàng)1:知識(shí)產(chǎn)權(quán)保護(hù)................................................26

檢查項(xiàng)2：信息披露....................................................26

3.信息科技風(fēng)險(xiǎn)管理............................................................28

3.1風(fēng)險(xiǎn)識(shí)別和評(píng)估........................................................28

檢查項(xiàng)1：風(fēng)險(xiǎn)管理策略................................................28

檢查項(xiàng)2:風(fēng)險(xiǎn)識(shí)別與評(píng)估..............................................29

3.2風(fēng)險(xiǎn)防范和檢測(cè)........................................................29

檢查項(xiàng)1：風(fēng)險(xiǎn)防范措施................................................29

檢查項(xiàng)2：風(fēng)險(xiǎn)計(jì)量與檢測(cè)..............................................30

4.信息安全管理................................................................32

4.1安全管理機(jī)制與管理組織.................................................32

檢查項(xiàng)1：信息分類和保護(hù)體系............................................32

檢查項(xiàng)2：安全管理機(jī)制..................................................33

檢查項(xiàng)3：信息安全策略..................................................34

檢查項(xiàng)4：信息安全組織..................................................34

4.2安全管理制度............................................................35

檢查項(xiàng)1：規(guī)章制度......................................................35

檢查項(xiàng)2：制度合規(guī)......................................................36

檢查項(xiàng)3：制度執(zhí)行......................................................37

4.3人員管理................................................................38

檢查項(xiàng)1：人員管理......................................................38

4.4安全評(píng)估報(bào)告............................................................39

檢查項(xiàng)1：安全評(píng)估報(bào)告..................................................39

4.5宣傳、教育和培訓(xùn)........................................................39

檢查項(xiàng)1：宣傳、教育和培訓(xùn)..............................................39

5.系統(tǒng)開發(fā)、測(cè)試與維護(hù)........................................................41

5.1開發(fā)管理................................................................41

檢查項(xiàng)1:管理架構(gòu)......................................................41

檢查項(xiàng)2：制度建設(shè)......................................................43

檢查項(xiàng)3：項(xiàng)目控制體系..................................................44

檢查項(xiàng)4：系統(tǒng)開發(fā)的操作風(fēng)險(xiǎn)...........................................45

檢查項(xiàng)5：數(shù)據(jù)繼承和遷移................................................46

5.2系統(tǒng)測(cè)試與上線..........................................................47

檢查項(xiàng)1：系統(tǒng)測(cè)試......................................................47

檢查項(xiàng)2：系統(tǒng)驗(yàn)收......................................................49

檢查項(xiàng)3：投產(chǎn)上線......................................................49

5.3系統(tǒng)下線................................................................50

檢查項(xiàng)1：系統(tǒng)下線......................................................50

6.系統(tǒng)運(yùn)行管理................................................................52

6.1日常管理................................................................52

檢查項(xiàng)1：職責(zé)分離......................................................52

檢查項(xiàng)2：值班制度......................................................53

檢查項(xiàng)3：操作管理......................................................53

檢查項(xiàng)4：人員管理......................................................54

6.2訪問(wèn)控制策略............................................................55

檢查項(xiàng)1：物理訪問(wèn)控制策略..............................................55

檢查項(xiàng)2：邏輯訪問(wèn)控制策略..............................................56

檢查項(xiàng)3：賬號(hào)及權(quán)限管理................................................57

檢查項(xiàng)4：用戶責(zé)任及終端管理...........................................58

檢查項(xiàng)5：遠(yuǎn)程接入的控制................................................59

6.3日志管理................................................................60

檢查項(xiàng)1：審計(jì)日志檢查..................................................60

檢查項(xiàng)2：E志信息的保護(hù)................................................60

檢查項(xiàng)3：操作日志的檢查................................................61

檢查項(xiàng)4：錯(cuò)誤日志的檢查................................................61

6.4系統(tǒng)監(jiān)控................................................................62

檢查項(xiàng)1：基礎(chǔ)環(huán)境監(jiān)控..................................................62

檢查項(xiàng)2：系統(tǒng)性能監(jiān)控..................................................62

檢查項(xiàng)3：系統(tǒng)運(yùn)行監(jiān)控..................................................63

檢查項(xiàng)4：測(cè)評(píng)體系......................................................64

6.5事件管理................................................................65

檢查項(xiàng)1：事件報(bào)告流程..................................................65

檢查項(xiàng)2：事件管理和改進(jìn)................................................66

檢查項(xiàng)3：服務(wù)臺(tái)管理....................................................67

6.6問(wèn)題管理................................................................67

檢查項(xiàng)1：事件分析和問(wèn)題生成...........................................68

檢查項(xiàng)2：臺(tái)賬管理......................................................68

檢查項(xiàng)3：?jiǎn)栴}處置......................................................68

6.7容量管理................................................................69

檢查項(xiàng)1：容量規(guī)劃......................................................69

檢查項(xiàng)2：容量監(jiān)測(cè)......................................................70

檢查項(xiàng)3：容量變更......................................................70

6.8變更管理................................................................71

檢查項(xiàng)1：變更的流程....................................................72

檢查項(xiàng)2：變更的評(píng)估....................................................72

檢查項(xiàng)3：變更的授權(quán)....................................................73

檢查項(xiàng)4：變更的執(zhí)行....................................................73

檢查項(xiàng)5：緊急變更......................................................74

檢查項(xiàng)6：重大變更......................................................74

7.業(yè)務(wù)連續(xù)性管理..............................................................76

7.1業(yè)務(wù)連續(xù)性管理組織....................................................77

檢查項(xiàng)1：董事會(huì)及高管層的職責(zé).........................................77

檢查項(xiàng)2：業(yè)務(wù)連續(xù)性管理組織的建立.....................................78

檢查項(xiàng)3：業(yè)務(wù)連續(xù)性管理組織職責(zé).......................................79

7.2IT服務(wù)連續(xù)性管理.......................................................80

檢查項(xiàng)1：IT服務(wù)連續(xù)性計(jì)劃的組織保障....................................80

檢查項(xiàng)2：風(fēng)險(xiǎn)評(píng)估及業(yè)務(wù)影響分析.......................................81

檢查項(xiàng)3：IT服務(wù)連續(xù)性計(jì)劃的制定......................................81

檢查項(xiàng)4：IT服務(wù)連續(xù)性計(jì)劃的測(cè)試與維護(hù)................................82

檢查項(xiàng)5：IT服務(wù)連續(xù)性計(jì)劃審計(jì)........................................83

檢查項(xiàng)6：IT服務(wù)連續(xù)性相關(guān)領(lǐng)域的控制..................................84

8.應(yīng)急管理....................................................................85

8.1應(yīng)急組織................................................................85

檢查項(xiàng)1：應(yīng)急管理團(tuán)隊(duì)..................................................85

檢查項(xiàng)2：應(yīng)急管理職責(zé)..................................................86

檢查項(xiàng)3：應(yīng)急管理制度..................................................86

8.2應(yīng)急預(yù)案................................................................87

檢查項(xiàng)1：應(yīng)急預(yù)案制訂..................................................87

檢查項(xiàng)2：應(yīng)急預(yù)案內(nèi)容..................................................87

檢查項(xiàng)3：應(yīng)急預(yù)案更新..................................................89

檢查項(xiàng)4：外包服務(wù)應(yīng)急..................................................89

檢查項(xiàng)5：應(yīng)急預(yù)案培訓(xùn)..................................................90

8.3應(yīng)急保障................................................................90

檢查項(xiàng)1：人員保障......................................................90

檢查項(xiàng)2：物質(zhì)保障......................................................90

檢查項(xiàng)3：技術(shù)保障......................................................91

檢查項(xiàng)4：溝通保障......................................................91

8.4應(yīng)急演練................................................................92

檢查項(xiàng)1：應(yīng)急演練的計(jì)劃................................................92

檢查項(xiàng)2：應(yīng)急演練的實(shí)施................................................92

檢查項(xiàng)3：應(yīng)急演練的總結(jié)................................................93

8.5應(yīng)急響應(yīng)................................................................93

檢查項(xiàng)1：應(yīng)急峋應(yīng)流程..................................................93

檢查項(xiàng)2：全程記錄處置過(guò)程..............................................94

檢查項(xiàng)3：應(yīng)急事件報(bào)告..................................................95

檢查項(xiàng)4：與第三方溝通..................................................95

檢查項(xiàng)5：向新聞媒體通報(bào)制度...........................................96

檢查項(xiàng)6：應(yīng)急處置總結(jié)..................................................96

8.6持續(xù)改進(jìn)................................................................97

檢查項(xiàng)1：應(yīng)急事件評(píng)估..................................................97

檢查項(xiàng)2：應(yīng)急響應(yīng)評(píng)估..................................................97

檢查項(xiàng)3：應(yīng)急管理改進(jìn)..................................................97

9.災(zāi)難恢復(fù)管理................................................................99

9.1災(zāi)難恢復(fù)組織架構(gòu)........................................................99

檢查項(xiàng)1：災(zāi)難恢復(fù)相關(guān)組織架構(gòu).........................................99

9.2災(zāi)難恢復(fù)策略...........................................................101

檢查項(xiàng)1：總體控制.....................................................101

檢查項(xiàng)2：災(zāi)難恢復(fù)策略.................................................101

檢查項(xiàng)3：災(zāi)難備份策略.................................................103

檢查項(xiàng)4：外包風(fēng)險(xiǎn).....................................................104

9.3災(zāi)難恢復(fù)預(yù)案...........................................................105

檢查項(xiàng)1：災(zāi)難恢復(fù)預(yù)案.................................................105

檢查項(xiàng)2：聯(lián)絡(luò)與通訊...................................................106

檢查項(xiàng)3：教育、培訓(xùn)和演練.............................................107

9.4評(píng)估和維護(hù)更新..........................................................107

檢查項(xiàng)1：災(zāi)備策略的評(píng)估和維護(hù)更新....................................107

檢查項(xiàng)2：災(zāi)難恢復(fù)預(yù)案的評(píng)估和維護(hù)更新................................108

10.數(shù)據(jù)管理..................................................................109

10.1數(shù)據(jù)管理制度和崗?fù)?..................................................109

檢查項(xiàng)1：數(shù)據(jù)管理制度.................................................109

檢查項(xiàng)2:數(shù)據(jù)管理崗位................................................110

10.2數(shù)據(jù)備份、恢復(fù)策略....................................................110

檢查項(xiàng)1：數(shù)據(jù)備份、轉(zhuǎn)儲(chǔ)策略...........................................110

檢查項(xiàng)2：數(shù)據(jù)恢復(fù)、抽檢策略...........................................Ill

10.3數(shù)據(jù)存儲(chǔ)介質(zhì)管理......................................................112

檢查項(xiàng)1：介質(zhì)管理......................................................112

檢查項(xiàng)2：介質(zhì)的清理和銷毀.............................................113

11.外包管理....................................................................114

11.1外包管理制度...........................................................114

檢查項(xiàng)1:外包管理制度.................................................114

檢查項(xiàng)2：外包審批流程.................................................114

檢查項(xiàng)3：外包協(xié)議......................................................115

檢查項(xiàng)4：服務(wù)水平協(xié)議.................................................115

檢查項(xiàng)5：外包安全保密措施.............................................116

檢查項(xiàng)6：外包文檔管理.................................................116

11.2外包評(píng)估和監(jiān)督.........................................................117

檢查項(xiàng)1:外包服務(wù)商的評(píng)估.............................................117

檢查項(xiàng)2：外包項(xiàng)目的監(jiān)督管理...........................................117

12.內(nèi)部審計(jì)...................................................................119

12.1內(nèi)部審計(jì)管理.........................................................119

檢查項(xiàng)1：內(nèi)部審計(jì)部門、崗位、人員和職責(zé)..............................119

檢查項(xiàng)2：內(nèi)部審計(jì)制度和辦法...........................................119

12.2內(nèi)部審計(jì)要求.........................................................120

檢查項(xiàng)1：內(nèi)部審計(jì)范圍和頻率...........................................120

檢查項(xiàng)2：內(nèi)部審計(jì)結(jié)果的有效性.........................................120

13.外部審計(jì)..................................................................122

13.1外部審計(jì)資質(zhì).........................................................122

檢查項(xiàng)1：外部審計(jì)機(jī)構(gòu)的資質(zhì)...........................................122

13.2外部審計(jì)要求.........................................................122

檢查項(xiàng)1：商業(yè)銀行配合外部審計(jì)情況....................................122

檢查項(xiàng)2：外部審計(jì)有效性...............................................123

檢查項(xiàng)3：外審過(guò)程中的保密要求.........................................123

第三部分基礎(chǔ)設(shè)施.............................................................125

14.計(jì)算機(jī)機(jī)房................................................................126

14.1計(jì)算機(jī)機(jī)房建設(shè)........................................................126

檢查項(xiàng)1：計(jì)算機(jī)機(jī)房選址...............................................126

檢查項(xiàng)2：機(jī)房功能分區(qū).................................................127

檢查項(xiàng)3：計(jì)算機(jī)機(jī)房基礎(chǔ)設(shè)施建設(shè)......................................127

檢查項(xiàng)4：計(jì)算機(jī)機(jī)房的環(huán)境要求.........................................130

檢查項(xiàng)5：計(jì)算機(jī)機(jī)房日常維護(hù)...........................................131

14.2計(jì)算機(jī)機(jī)房管理.......................................................132

檢查項(xiàng)1：計(jì)算機(jī)機(jī)房安全管理...........................................132

檢查項(xiàng)2：計(jì)算機(jī)機(jī)房集中監(jiān)控系統(tǒng)......................................133

檢查項(xiàng)3：計(jì)算機(jī)機(jī)房安全區(qū)域訪問(wèn)控制..................................134

檢查項(xiàng)4：計(jì)算機(jī)機(jī)房運(yùn)行管理...........................................135

14.3機(jī)房設(shè)備管理..........................................................136

檢查項(xiàng)1：機(jī)房設(shè)備的環(huán)境安全...........................................136

15.網(wǎng)絡(luò)通訊..................................................................137

15.1內(nèi)控管理..............................................................137

檢查項(xiàng)1：內(nèi)控制度.....................................................137

檢查項(xiàng)2：人員管理.....................................................138

檢查項(xiàng)3：訪問(wèn)控制.....................................................138

檢查項(xiàng)4：日志管理.....................................................139

檢查項(xiàng)5：第三方管理...................................................140

檢查項(xiàng)6：服務(wù)外包.....................................................141

檢查項(xiàng)7：文檔管理.....................................................141

檢查項(xiàng)8：風(fēng)險(xiǎn)評(píng)估.....................................................142

15.2網(wǎng)絡(luò)運(yùn)行維護(hù)..........................................................143

檢查項(xiàng)1：運(yùn)行監(jiān)控.....................................................143

檢查項(xiàng)2：性能監(jiān)控.....................................................143

檢查項(xiàng)3：流量監(jiān)控.....................................................144

檢查項(xiàng)4：監(jiān)控預(yù)警.....................................................144

檢查項(xiàng)5：性能調(diào)優(yōu).....................................................144

檢查項(xiàng)6：事件管理.....................................................145

檢查項(xiàng)7：運(yùn)行檢查.....................................................145

15.3網(wǎng)絡(luò)變更管理..........................................................146

檢查項(xiàng)1：變更發(fā)起.....................................................146

檢查項(xiàng)2：變更計(jì)劃.....................................................147

檢查項(xiàng)3：變更測(cè)試.....................................................147

檢查項(xiàng)4：變更審批.....................................................147

檢查項(xiàng)5：變更實(shí)施.....................................................148

15.4網(wǎng)絡(luò)服務(wù)可用怛........................................................149

檢查項(xiàng)1：容量管理.....................................................149

檢查項(xiàng)2：冗余管理.....................................................149

檢查項(xiàng)3：帶外管理.....................................................150

檢查項(xiàng)4：壓力測(cè)試.....................................................151

檢查項(xiàng)5：應(yīng)急管理.....................................................151

15.5網(wǎng)絡(luò)安全技術(shù)..........................................................151

檢查項(xiàng)1：結(jié)構(gòu)安全.....................................................151

檢查項(xiàng)2：物理安全.....................................................153

檢查項(xiàng)3：傳輸安全.....................................................153

檢查項(xiàng)4：訪問(wèn)控制.....................................................154

檢查項(xiàng)5：接入安全.....................................................155

檢查項(xiàng)6：網(wǎng)絡(luò)邊界安全.................................................156

檢查項(xiàng)7：入侵檢測(cè)防范.................................................157

檢查項(xiàng)8：惡意代碼防范.................................................158

檢查項(xiàng)9：網(wǎng)絡(luò)設(shè)備防護(hù).................................................158

檢查項(xiàng)10：網(wǎng)絡(luò)安全測(cè)試................................................160

檢查項(xiàng)11：安全審計(jì)日志................................................161

檢查項(xiàng)12：安全檢查....................................................162

16.操作系統(tǒng)....................................................................163

16.1賬號(hào)及密碼管理........................................................163

檢查項(xiàng)1：管理制度.....................................................163

檢查項(xiàng)2：賬號(hào)、密碼管理...............................................163

檢查項(xiàng)3：賬號(hào)、密碼管理檢查...........................................165

16.2系統(tǒng)訪問(wèn)控制..........................................................165

檢查項(xiàng)1：訪問(wèn)控制策略.................................................165

檢查項(xiàng)2：用戶登錄行為管理.............................................166

檢查項(xiàng)3：登錄失敗日志管理.............................................166

檢查項(xiàng)4：最小化訪問(wèn)...................................................167

16.3遠(yuǎn)程接入管理..........................................................168

檢查項(xiàng)1：遠(yuǎn)程管理制度.................................................168

檢查項(xiàng)2：遠(yuǎn)程維護(hù)管理.................................................169

檢查項(xiàng)3：遠(yuǎn)程維護(hù)審查.................................................169

16.4日常維護(hù)..............................................................170

檢查項(xiàng)1：系統(tǒng)性能監(jiān)控.................................................170

檢查項(xiàng)2：補(bǔ)丁及漏洞管理...............................................170

檢查項(xiàng)3：日常維護(hù)管理.................................................171

檢查項(xiàng)4：系統(tǒng)備份和故障恢復(fù)...........................................172

檢查項(xiàng)5：病毒及惡意代碼管理...........................................172

檢查項(xiàng)6：定時(shí)進(jìn)程設(shè)置管理.............................................173

檢查項(xiàng)7：系統(tǒng)審計(jì)功能.................................................173

17.數(shù)據(jù)庫(kù)管理系統(tǒng)............................................................175

17.1訪問(wèn)控制...............................................................175

檢查項(xiàng)1：身份認(rèn)證.....................................................175

檢查項(xiàng)2：授權(quán)控制.....................................................176

檢查項(xiàng)3：遠(yuǎn)程訪問(wèn).....................................................177

檢查項(xiàng)4：安全參數(shù)設(shè)置.................................................178

17.2日常管理...............................................................178

檢查項(xiàng)1：數(shù)據(jù)安全.....................................................178

檢查項(xiàng)2：審計(jì)功能.....................................................179

檢查項(xiàng)3：性能管理.....................................................180

檢查項(xiàng)4：補(bǔ)丁升級(jí).....................................................181

17.3連續(xù)性管理.............................................................181

檢查項(xiàng)1：備份和恢復(fù)...................................................181

檢查項(xiàng)2：連續(xù)性和應(yīng)急管理.............................................182

18.第三方中間件..............................................................184

18.1產(chǎn)品管理.............................................................184

檢查項(xiàng)1：中間件測(cè)試...................................................184

檢查項(xiàng)2：中間件管理...................................................184

檢查項(xiàng)3：中間件與業(yè)務(wù)系統(tǒng)架構(gòu).........................................185

18.2運(yùn)行管理.............................................................185

檢查項(xiàng)1：維護(hù)流程和操作手冊(cè)...........................................185

檢查項(xiàng)2：中間件配置管理...............................................185

檢查項(xiàng)3：中間件日志管理的程序.........................................186

檢查項(xiàng)4：中間件的性能監(jiān)控.............................................186

檢查項(xiàng)5：中間件產(chǎn)生的事件和問(wèn)題管理..................................187

檢查項(xiàng)6：中間件的變更.................................................187

檢查項(xiàng)7：?jiǎn)吸c(diǎn)故障問(wèn)題和負(fù)載均衡......................................187

檢查項(xiàng)8：壓力測(cè)試.....................................................188

第四部分應(yīng)用系統(tǒng).............................................................189

19.應(yīng)用系統(tǒng)....................................................................190

19.1應(yīng)用系統(tǒng)管理.........................................................190

檢查項(xiàng)1：業(yè)務(wù)管理辦法與操作流程......................................190

檢查項(xiàng)2：重要應(yīng)用系統(tǒng)評(píng)估.............................................190

檢查項(xiàng)3：應(yīng)用系統(tǒng)版本管理.............................................191

檢查項(xiàng)4：應(yīng)用系統(tǒng)培訓(xùn)教育.............................................192

19.2應(yīng)用系統(tǒng)操作.........................................................192

檢查項(xiàng)1：終端用戶管理.................................................192

檢查項(xiàng)2：訪問(wèn)控制與授權(quán)管理...........................................193

檢查項(xiàng)3：數(shù)據(jù)保密處理.................................................194

檢查項(xiàng)4：數(shù)據(jù)完整性處理...............................................195

檢查項(xiàng)5：數(shù)據(jù)準(zhǔn)確性處理...............................................195

檢查項(xiàng)6：日志管理機(jī)制.................................................196

檢查項(xiàng)7：備份、恢復(fù)機(jī)制...............................................197

檢查項(xiàng)8：文檔資料管理.................................................198

檢查項(xiàng)9：內(nèi)部審計(jì)的參與...............................................199

20.電子我行..................................................................200

20.1電子銀行業(yè)務(wù)合規(guī)性....................................................200

檢查項(xiàng)1：電子銀行業(yè)務(wù)合規(guī)性..........................................200

20.2電子銀行風(fēng)險(xiǎn)管理體系.................................................201

檢查項(xiàng)1：電子銀行風(fēng)險(xiǎn)管理體系........................................201

20.3電子銀行安全管理......................................................202

檢查項(xiàng)1：電子根行安全策略管理........................................