Art. 16 provides a simplified ICT risk management framework for qualifying small and non-interconnected entities. It is addressed via the proportionality setting on this assessment, rather than as separate measures below.
Pillar 1 - ICT Risk Management
Documentation
Implementation
Documentation
Implementation
Documentation
Implementation
Documentation
Implementation
Maturity Scale
Target: ≥ 3/5 for all categories
Documentation
Implementation
No process documentation or not formally approved by management.
Standard process does not exist. Actions are ad hoc and undocumented.
Formally approved process documentation exists but has not been reviewed in the previous 2 years.
Ad-hoc process exists and is performed informally. Results are inconsistent.
Formally approved process documentation exists; exceptions are documented and approved and make up less than 5% of activities.
Formal process exists and is implemented. Evidence available for most activities. Less than 10% process exceptions.
Formally approved process documentation exists; exceptions are documented and approved. Documented & approved less than 3% of activities.
Formal process fully implemented. Evidence available for all activities. Detailed metrics captured and reported. Less than 5% process exceptions.
Formally approved process documentation exists; exceptions are documented and approved. Documented & approved less than 0.5% of activities.
Formal process fully implemented and continually improving. Minimal exceptions (<1%). Process improvements tracked and evidenced.