Trend Micro on BNM's 2023 RMiT Update: CISO Authority, SOC Scope and Cloud Risk
How Trend Micro reads Bank Negara Malaysia's June 2023 RMiT update for banks and insurers: a CISO with board access, a SOC that covers cloud and third parties, and risk assessments before any cloud move.
Bank Negara Malaysia (BNM) issued a revised Risk Management in Technology (RMiT) policy document on 1 June 2023. It tells Malaysian banking, financial services and insurance (BFSI) firms how to build up their cloud risk management as more of their workloads move off premises.
Trend Micro has set out three priorities for BFSI firms working through it.
Giving the CISO real authority
For Trend Micro, compliance starts with governance. A Chief Information Security Officer has to be appointed and then backed over time, so security plans get carried out and reach the board.
The vendor expects the job to grow. Beyond the usual security agenda, the CISO would oversee service level agreements and weigh the risks of cloud services and third-party assets, which Trend Micro says calls for risk-based data across the whole estate.
A wider brief for the SOC
Trend Micro reads RMiT as stretching a security operations centre's round-the-clock monitoring, threat hunting and vulnerability assessment across on-premises systems, cloud workloads and third-party assets alike. It pitches its Vision One XDR platform as the tool for getting there.
Risk assessments before the cloud
Trend Micro expects BNM's digital bank licences to push more of the sector onto the cloud, and says firms need extensive risk assessments before they move.
Firms already working through the policy can read how others have met RMiT rules without disrupting day-to-day operations.