# FINMA Circular 2023/1 Operational Risk and Resilience — Banks

Framework id: `finma_circular`. Regulatory. Publisher: Swiss Financial Market Supervisory Authority (FINMA). Version: 2023/1. Region: Switzerland. Mapping licence: CC BY-SA 4.0.
Source text: https://www.finma.ch/en/news/2022/12/20221213-mm-anh-rs-op-risks/

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (84, average coverage 77%)
- IV.A(23) ICT governance framework and policies: AC-01, AT-01, AU-01, CA-01, CA-06, CM-01, CP-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PL-02, PL-03, PL-06, PS-01, RA-01, SA-01, SA-02, SC-01, SI-01, SR-01, PL-09, PL-10, PL-11 (82%)
- IV.A(24) ICT strategy alignment with business strategy: AC-01, CA-01, CA-06, PL-01, PL-02, PL-06, SA-02, PL-09 (67%)
- IV.A(25) ICT strategy documentation and updates: PL-02, PL-03, SA-02, PL-10, PL-11 (72%)
- IV.A(28) ICT infrastructure management and operations: AU-04, AU-08, CM-01, CM-02, CM-06, CM-07, CM-08, CP-08, MA-01, MA-02, MA-03, MA-04, MA-05, MA-06, PE-01, PE-09, PE-11, PE-14, PE-18, SA-03, SA-05, SA-06, SA-08, SC-06, SC-20, SC-21, SC-22, MA-07, PE-21, PE-22, PE-23, CM-12, SI-13 (88%)
- IV.A(29) ICT capacity and performance management: AU-04, CM-02, CM-06, CM-08, MA-02, MA-03, MA-06, SA-08, SC-06, SI-13 (78%)
- IV.A(30) ICT asset inventory: CM-02, CM-08, CM-12, CM-13 (88%)
- IV.A(31) ICT architecture documentation: CM-02, CM-12, CM-13, PL-09 (75%)
- IV.A(36) ICT change management framework: CM-01, CM-03, CM-04, CM-05, MA-01, MA-02, SA-01, SA-03, SA-05, SA-06, SA-07, SA-10, SA-11, SI-02, CM-14 (87%)
- IV.A(37) Change control process and testing: CM-03, CM-04, CM-05, SA-03, SA-10, SA-11, CM-14 (87%)
- IV.A(38) Change impact analysis: CM-03, CM-04, SA-10, RA-07 (82%)
- IV.A(39) Change approval and documentation: CM-03, SA-10, CM-14 (82%)
- IV.A(40) Emergency change procedures: CM-03, RA-07 (77%)
- IV.A(41) Incident management framework: AU-05, IR-01, IR-02, IR-03, IR-04, IR-05, IR-07, SI-11, IR-09 (82%)
- IV.A(42) Incident classification and prioritisation: IR-02, IR-04, RA-07, RA-09 (78%)
- IV.A(43) Incident response and escalation: IR-04, IR-09 (77%)
- IV.A(44) Incident monitoring and tracking: IR-05, IR-06 (80%)
- IV.A(45) Incident reporting to FINMA: IR-06, IR-09 (57%)
- IV.A(46) Incident notification to affected parties: IR-06, IR-09 (62%)
- IV.B.a(47) Incident lessons learned: IR-06, AT-06 (65%)
- IV.B.a(48) ICT personnel and security awareness framework: AT-01, AT-02, AT-03, AT-04, AT-05, PL-01, PL-02, PL-04, PL-06, PS-01, PS-02, PS-03, PS-06, PS-08, RA-01, AT-06, PS-09 (83%)
- IV.B.a(49) ICT security training programme: AT-01, AT-02, AT-03, AT-04, PL-04, AT-06 (82%)
- IV.B.b(50) Security awareness for all staff: AT-02, AT-03, AT-06 (87%)
- IV.B.b(51) Ongoing security awareness updates: AT-02, AT-06 (82%)
- IV.B.b(52) Threat intelligence and information sharing: AT-05, SI-05, RA-07 (72%)
- IV.B.c(53) External threat intelligence sources: AT-05, SI-05, RA-07 (72%)
- IV.B.c(54) ICT risk assessment framework: CA-05, CM-08, PS-02, RA-01, RA-02, RA-03, RA-04, RA-05, RA-06, RA-07, RA-08, RA-09 (85%)
- IV.B.c(55) ICT risk identification and analysis: CA-05, CM-08, RA-02, RA-03, RA-04, RA-07, RA-09 (82%)
- IV.B.c(56) Vulnerability management: RA-03, RA-05, SI-02, SI-05, RA-06, RA-07 (87%)
- IV.B.c(57) Vulnerability scanning and assessment: RA-03, RA-05, RA-06 (87%)
- IV.B.d(58) Risk assessment documentation and review: RA-03, RA-07, RA-09 (82%)
- IV.B.d(59) Access control and security controls framework: AC-01, AC-02, AC-03, AC-04, AC-05, AC-06, AC-07, AC-08, AC-09, AC-10, AC-11, AC-12, AC-13, AC-14, AC-17, AC-18, AC-19, AC-20, AU-09, CM-05, IA-01, IA-02, IA-03, IA-04, IA-05, IA-06, IA-07, MA-04, MP-02, PE-02, PE-03, PS-04, PS-05, PS-06, SA-08, SC-01, SC-05, SC-07, SC-10, SC-11, SC-14, SC-15, SC-18, SC-23, SI-01, SI-02, SI-03, SI-07, SI-08, CA-09, SC-24, SC-46, SC-48 (92%)
- IV.B.d(60) Identity and access management: AC-01, AC-02, AC-03, AC-05, AC-06, AC-13, IA-01, IA-02, IA-04, IA-05, PS-04, PS-05, PS-09, CA-09 (92%)
- IV.C(61) Authentication and session management: AC-02, AC-03, AC-06, AC-07, AC-10, AC-11, AC-12, IA-02, IA-05, SC-10, SC-24 (92%)
- IV.C(62) Network security and segmentation: AC-04, AC-17, AC-18, CA-03, IA-03, MA-04, PE-04, SC-02, SC-03, SC-05, SC-07, SC-14, SC-15, SC-19, SC-20, SC-21, SC-22, CA-09, SC-46, SC-47, SC-48 (88%)
- IV.C(63) Cryptography and data protection in transit: AC-04, AC-17, IA-07, MP-05, PE-19, SC-02, SC-03, SC-07, SC-08, SC-09, SC-11, SC-12, SC-13, SC-16, SC-17, SC-19, SC-23, SC-37, SC-40 (92%)
- IV.C(64) Endpoint and software security: AC-19, CM-06, CM-07, SA-07, SC-12, SC-13, SC-17, SC-18, SI-02, SI-03, SI-07, SI-08, CM-14, SC-34, SC-44, SI-16 (88%)
- IV.C(65) Malware protection: CM-07, SC-05, SI-03, SC-44, SI-16 (88%)
- IV.C(66) Logging and monitoring framework: AU-01, AU-02, AU-03, AU-04, AU-05, AU-06, AU-07, AU-08, AU-09, AU-10, AU-11, CA-07, CM-04, IR-05, PE-06, PE-08, SI-01, SI-04, SI-11, SC-48 (87%)
- IV.C(67) Security event logging: AU-01, AU-02, AU-03, AU-05, AU-06, AU-07, AU-09, AU-10, CA-07, IR-05, SI-04, SC-48 (87%)
- IV.C(68) Log analysis and correlation: AU-02, AU-06, CA-07, SI-04, SC-48 (82%)
- IV.C(69) Automated monitoring and alerting: AU-06, SI-04, SC-48 (82%)
- IV.C(70) Cyber incident response framework: CP-10, IR-01, IR-02, IR-04, IR-07, IR-09, SC-24 (78%)
- IV.D(71) Cyber incident containment and recovery: CP-10, IR-02, IR-04, IR-07, IR-09, SC-24, SI-14 (78%)
- IV.D(72) Cyber incident eradication: CP-10, IR-04, SI-14, SC-34 (78%)
- IV.D(73) Cyber incident reporting to FINMA: IR-06, IR-09 (57%)
- IV.D(74) Cyber incident notification to clients: IR-06, IR-09 (57%)
- IV.D(75) Security testing framework: CA-01, CA-02, CA-04, CA-05, CA-06, CA-07, IR-03, RA-05, SA-11, SI-06, CA-09, RA-06 (87%)
- IV.D(76) Penetration testing and vulnerability assessment: CA-02, CA-04, CA-07, IR-03, RA-05, SA-11, SI-06, CA-09, RA-06 (87%)
- IV.D(77) Independent security testing: CA-02, IR-03, CA-09 (77%)
- IV.D(78) Data classification and protection framework: AC-15, AC-16, MP-01, MP-02, MP-03, MP-04, MP-05, MP-06, PE-19, PL-05, PT-01, PT-02, PT-03, PT-04, PT-05, PT-06, PT-07, RA-02, SC-01, SC-04, SC-08, SC-09, SI-07, SI-09, SI-10, SI-12, CM-12, CM-13, MP-08, RA-08, SC-42 (83%)
- IV.D(79) Data classification scheme: AC-15, AC-16, MP-01, MP-03, PL-05, PT-01, PT-02, PT-03, PT-07, CM-12, CM-13, MP-08 (78%)
- IV.D(80) Data handling and processing controls: AC-16, MP-02, MP-03, PT-03, PT-07, SI-09, SI-10, CM-13, SI-20 (78%)
- IV.D(81) Data protection in storage and transit: MP-04, MP-05, PE-18, SC-08, SC-09, SC-25, SC-38 (87%)
- IV.D(82) Data retention and archiving: AU-11, CP-09, MP-04, PT-06, SI-12, MP-08 (72%)
- IV.E(83) Secure data disposal: AU-11, MP-06, SC-04, SI-12, SR-12, MP-08 (87%)
- IV.E(84) Data quality and accuracy: MP-06, SI-10, SI-18, SI-21 (70%)
- IV.E(87) ICT business continuity management framework: CP-01, CP-02, CP-05, SC-24 (77%)
- IV.E(88) Business impact analysis for ICT: CP-01, CP-02, RA-09 (73%)
- IV.E(89) ICT recovery capabilities: CP-02, CP-06, CP-07, CP-08, CP-09, CP-10, MA-06, PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-17, PE-21, PE-23, SC-24, SI-13 (83%)
- IV.E(90) ICT disaster recovery planning: CP-02, CP-06, CP-07, CP-08, CP-09, CP-10, PE-17, SC-24, SC-47 (82%)
- IV.E(91) Recovery site and backup requirements: CP-02, CP-06, CP-07, CP-09, PE-23 (82%)
- IV.E(92) Business continuity training: CP-03, AT-06 (82%)
- IV.E(93) Business continuity awareness: CP-03, AT-06 (82%)
- IV.E(94) Business continuity testing framework: CP-04, RA-09 (82%)
- IV.E(95) Disaster recovery testing: CP-04, RA-09 (82%)
- IV.E(96) Business continuity testing scenarios: CP-04, RA-09 (77%)
- IV.F(97) Business continuity test results and improvements: CP-04, AT-06 (77%)
- IV.F(98) Business continuity plan maintenance: CP-05 (80%)
- IV.F(99) Business continuity plan distribution: CP-05 (75%)
- IV.F(100) Outsourcing governance framework: AC-20, CA-03, MA-05, PS-03, PS-07, SA-01, SA-04, SA-09, SR-01, SR-02, SR-05, SA-21, SA-23 (72%)
- V(101) Outsourcing risk assessment: AC-20, CA-03, MA-05, PS-07, SA-04, SA-09, SR-01, SR-02, SR-05, RA-07, RA-09, SA-21 (72%)
- V(102) Outsourcing contractual requirements: PS-07, SA-04, SA-09, SR-02, SA-23 (67%)
- V(103) Outsourcing due diligence: SA-04, SA-09, SR-02, SA-21, SA-23 (68%)
- V(104) Outsourcing ongoing monitoring: SA-09, SR-03, CA-09 (63%)
- V(105) Sub-outsourcing controls: SR-03 (55%)
- V(106) Sub-outsourcing notification and approval: SR-03 (50%)
- V(107) Sub-outsourcing risk management: SR-03, RA-07 (52%)
- V(108) Sub-outsourcing audit rights: SR-03 (45%)
- V(109) Supply chain provenance: SR-04, CM-14 (63%)
- V(110) Supply chain provenance verification: SR-04, CM-14 (63%)
- V(111) Acquisition strategy for ICT services: SR-05, SA-20 (72%)
- VI(112) Acquisition methods and tools: SR-05, SA-20 (72%)
- VII.A(113) Supplier assessment and review: SR-06, SR-10, SA-21 (72%)
- VII.B(114) Supplier assessment frequency: SR-06, SR-10 (70%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=finma_circular
- Control-to-clause mappings as JSON: /api/v1/frameworks/finma_circular?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/finma-circular.json
- Page for people: /frameworks/finma-circular/