2012 Registration document and annual financial report - BNP Paribas

5RISKSAND CAPITAL ADEQUACYOperational risk5The security framework is drilled down to each individual businessline, taking account of any regulatory requirements, the security riskexposure of the business line in question and the specific threats itfaces. Each business line uses the Group’s standardised approach tomanaging information security (the primary methodology used is ISO27005, supported by the French EBIOS risk analysis methodology), riskassessment indicators, and monitoring action plans. This approach issupported by information security control plans designed to assess itseffectiveness (deployment and quality) with regard to all the Group’s keyassets and to measure the level of maturity of the various structure. Itforms part of the permanent and periodic control framework set up foreach banking activity pursuant to CRBF regulation 97-02 (amended in2004) in France or similar regulations in other countries.Each of BNP Paribas’ business lines is exposed to some specific formof information security risk, with some risks common to all businesses.The Group’s policy for managing these risks takes into considerationthe specific nature of the business, often made more complex by legallyand culturally-specific regulations in the different countries in which theGroup does business.The availability of information systems is vital to allow BNP Paribas tocontinue operating in a crisis or emergency. Although it is impossible toguarantee 100% availability, the Group maintains, improves and regularlyverifies the information back-up capabilities and system robustness, inline with its values of operational excellence, in response to tighterregulations and extreme stress scenarios (natural disasters or othercatastrophes, health pandemics, etc.). Its action in this area is consistentwith the Group’s general business continuity plan.Confidentiality of customer data and transaction integrity are also areascovered by the Bank’s continuous progress approach, not only to counterthe threats described earlier but also to provide our customers with aservice that meets their expectations.BNP Paribas seeks to minimise information security risk and optimiseresources by:■ updating the procedural framework for each business line governingday-to-day practices to take account of developments in businessactivities and new trends;■ raising employees’ awareness of information security imperatives andtraining key players in the appropriate procedures and behavioursrelated to information system resources;■ rolling out and developing controls for BNP Paribas entities andexternal partners, and strengthening support actions;■ strengthening the security of IT developments, better measurementof responsiveness in terms of information security and preventingdata leaks;■ monitoring incidents and developing intelligence of technologicalvulnerability and information systems attacks.BNP Paribas takes a continuous progress approach to information security.Apart from investing heavily in protecting its information systems assetsand information resources, the level of security must be supervised andcontrolled continuously. This enables the Bank to adjust its security levelsto new threats caused by cyber crime. In this respect, the security modelhas been revised to ensure that it takes account of technological changesthat have a strong impact on interactions between users (clients andemployees) and their information systems. This requires Group-levelaction in developing tools to scale up security processes, setting up asecurity community and continuing the major projects forming part ofthe Group’s information security development plan.3122012 Registration document and annual financial report - BNP PARIBAS