Technology and Information Security Guidance for DFSA Compliance

If your business falls under the remit of the Dubai Financial Services Authority (DFSA), this blog can offer some guidance for achieving IT compliance.

The financial services industry is one of the most frequently targeted sectors by cyber criminals. This increased risk, coupled with the responsibility for protecting client and investor assets, emphasises the crucial nature of maintaining a strong cyber security infrastructure.

Who Does DFSA Guidance Apply to?

The DFSA’s cyber supervision activities apply to all DFSA Authorised Firms, Registered Auditors, Credit Rating Agencies and Authorised Market Institutions, however it is recommended that all Dubai businesses acknowledge DFSA guidelines, regardless of size or industry.

DFSA Cyber Risk Principles

A key priority for the DFSA is ensuring that regulated businesses have suitable frameworks in place to protect from cyber risk. No matter the size of the organisation, all companies should take adequate measures against cyber attacks.

While the DFSA doesn’t prescribe a specific framework, the body does expect firms to implement a framework that is consistent with the eight principles outlined below.

Element 1: Cyber Security Strategy and Framework

Establish and maintain a cyber security strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.

Element 2: Governance

Define and facilitate performance of roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cyber security strategy and framework to ensure accountability; and provide adequate resources, appropriate authority, and access to the governing authority (e.g., board of directors or senior officials at public authorities).

Element 3: Risk and Control Assessment

Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritise their relative importance, and assess their respective cyber risks. Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority.

Element 4: Monitoring

Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises.

Element 5: Response

Timely (a) assess the nature, scope, and impact of a cyber incident; (b) contain the incident and mitigate its impact; (c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and (d) coordinate joint response activities as needed.

Element 6: Recovery

Resume operations responsibly, while allowing for continued remediation, including by (a) eliminating harmful remnants of the incident; (b) restoring systems and data to normal and confirming normal state; (c) identifying and mitigating all vulnerabilities that were exploited; (d) remediating vulnerabilities to prevent similar incidents; and (e) communicating appropriately internally and externally.

Element 7: Information Sharing

Engage in the timely sharing of reliable, actionable cyber security information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defences, limit damage, increase situational awareness, and broaden learning.

Element 8: Continuous Learning

Review the cyber security strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned.

What Do the DFSA Cyber Risk Principles Mean for Your Business?

The DFSA has set clear guidelines to protect regulated entities within its jurisdiction from rising cyber threats. These guidelines, notably in section 5.5.14, make cyber security user awareness training a mandatory annual exercise. This mandate underscores the DFSA’s recognition of human error as one of the leading causes of data breaches and cyber incidents. By requiring businesses to educate their staff at least once a year on cyber security risks and best practices, the DFSA aims to reduce vulnerabilities that often arise from unintentional actions by employees, such as clicking on malicious links or mishandling sensitive information.

Section 5.5 also highlights the importance of a robust cyber security framework that includes system management, real-time monitoring, and incident response planning. Businesses are expected to employ proactive monitoring tools and system controls to detect, prevent, and respond to threats as they emerge. Failure to comply not only exposes businesses to operational risks but can also lead to regulatory repercussions, tarnishing their reputation and resulting in potential financial penalties.

How Can Resolution IT Help?

In a complex regulatory environment, how confident are you that your organisation fully adheres to DFSA’s cyber security guidelines? Ensuring compliance with DFSA standards is crucial, but not always straightforward. Is your current IT provider proactively addressing these requirements within your technology setup? If your provider is not discussing DFSA compliance and cyber resilience with you, critical vulnerabilities could be overlooked.

We are here to assist with a comprehensive, fully funded cyber security gap analysis. This analysis is designed to pinpoint any weaknesses in your current security posture and assess your alignment with DFSA standards. The goal of this assessment is to provide you with clarity and assurance, whether you already feel confident in your IT compliance or are seeking an objective evaluation.

Following the gap analysis, we’ll provide a detailed report identifying areas for improvement and actionable steps to enhance your cyber defences. Our approach is risk-free, cost-free, and comes with no obligation. The insights we provide can offer peace of mind, helping you take proactive steps toward solidifying your security measures and safeguarding your organisation’s compliance in a rapidly evolving cyber threat landscape.

Apply for your free cyber security gap analysis here.