The Norwegian Financial Supervisory Authority has published an inspection report that identified significant shortcomings in Norse Securities AS’s governance and control of information and communications technology activities. The deficiencies covered its governance framework, risk management and internal controls, as well as business impact analysis, change management, oversight of ICT service providers and continuity testing. The authority had instructed the firm to remedy the shortcomings promptly and prepare an action plan for compliance with the Digital Operational Resilience Act, or DORA. It now considers the extensive remedial measures taken by the firm to have largely addressed the findings. Norse Securities has updated its ICT strategy and governance documents, introduced a control framework and completed a business led impact analysis that informs revised continuity and disaster recovery plans. It has also adopted procedures covering internal and supplier initiated ICT changes, strengthened risk assessments and monitoring of service providers, established access and security controls, and completed scenario based continuity testing. The authority has requested the minutes of the board meeting at which the final report is considered, and the firm must provide the report to its auditor.
Norwegian Financial Supervisory Authority finds Norse Securities has largely addressed significant ICT governance and control shortcomings
The Norwegian Financial Supervisory Authority found significant shortcomings in Norse Securities AS’s ICT governance, risk controls, supplier oversight and continuity arrangements. The firm has since implemented extensive measures that the authority considers largely sufficient to address the findings and support DORA compliance.