← Frameworks / FCA SYSC 13 / Control Mappings

Machine-readable: JSON API guide

FCA SYSC 13 — Operational Risk: Systems and Controls

Financial Conduct Authority rules for operational risk management applicable to all FCA-regulated firms. Covers operational risk identification and assessment, systems and controls, business continuity planning, outsourcing, technology and cyber risk, change management, information security, access control, data integrity, incident management, insurance, record keeping, and board governance responsibilities. Part of the FCA Senior Management Arrangements, Systems and Controls (SYSC) sourcebook.

Controls: 136
Total Mappings: 226
Publisher: Financial Conduct Authority (FCA) Version: SYSC 13 (current)
FCA SYSC 13 → SP 800-53 SP 800-53 → FCA SYSC 13 Coverage Analysis
AC (10) AT (5) AU (9) CA (4) CM (10) CP (13) IA (5) IR (1) MA (5) PL (4) PM (15) PS (9) RA (7) SA (9) SC (9) SI (11) SR (10)

AC Access Control

Control Name FCA SYSC 13 References
AC-01 Policy and Procedures
SYSC 13.6.5SYSC 13.7.3
AC-02 Account Management
SYSC 13.7.3
AC-03 Access Enforcement
SYSC 13.7.3
AC-05 Separation of Duties
SYSC 13.6.2SYSC 13.7.3
AC-06 Least Privilege
SYSC 13.6.2SYSC 13.7.3
AC-07 Unsuccessful Logon Attempts
SYSC 13.7.3
AC-13 Supervision and Review — Access Control
SYSC 13.6.3
AC-17 Remote Access
SYSC 13.7.3
AC-19 Access Control for Mobile Devices
SYSC 13.7.3
AC-20 Use of External Systems
SYSC 13.7.3

AT Awareness and Training

Control Name FCA SYSC 13 References
AT-01 Policy and Procedures
SYSC 13.5.1SYSC 13.6.1
AT-02 Literacy Training and Awareness
SYSC 13.5.1SYSC 13.6.1
AT-03 Role-based Training
SYSC 13.5.1SYSC 13.6.1
AT-04 Training Records
SYSC 13.6.1
AT-06 Training Feedback
SYSC 13.5.1SYSC 13.6.1

AU Audit and Accountability

Control Name FCA SYSC 13 References
AU-01 Policy and Procedures
SYSC 13.G.4
AU-02 Event Logging
SYSC 13.7.5
AU-03 Content of Audit Records
SYSC 13.7.5
AU-06 Audit Record Review, Analysis, and Reporting
SYSC 13.7.5
AU-07 Audit Record Reduction and Report Generation
SYSC 13.7.5
AU-09 Protection of Audit Information
SYSC 13.G.4
AU-11 Audit Record Retention
SYSC 13.G.4
AU-12 Audit Record Generation
SYSC 13.7.5
AU-16 Cross-organizational Audit Logging
SYSC 13.9.3

CA Security Assessment and Authorization

Control Name FCA SYSC 13 References
CA-02 Control Assessments
SYSC 13.5.3SYSC 13.G.3
CA-04 Security Certification
SYSC 13.G.3
CA-05 Plan of Action and Milestones
SYSC 13.5.3
CA-07 Continuous Monitoring
SYSC 13.5.3SYSC 13.7.5SYSC 13.9.3SYSC 13.G.3

CM Configuration Management

Control Name FCA SYSC 13 References
CM-01 Policy and Procedures
SYSC 13.7.1
CM-02 Baseline Configuration
SYSC 13.7.1SYSC 13.7.2
CM-03 Configuration Change Control
SYSC 13.7.1SYSC 13.7.4SYSC 13.8.4
CM-04 Impact Analyses
SYSC 13.7.4SYSC 13.8.4
CM-05 Access Restrictions for Change
SYSC 13.6.2SYSC 13.7.4
CM-06 Configuration Settings
SYSC 13.6.5SYSC 13.7.1
CM-07 Least Functionality
SYSC 13.7.1
CM-08 System Component Inventory
SYSC 13.7.1SYSC 13.7.2
CM-09 Configuration Management Plan
SYSC 13.7.4
CM-14 Signed Components
SYSC 13.7.4

CP Contingency Planning

Control Name FCA SYSC 13 References
CP-01 Policy and Procedures
SYSC 13.8.1SYSC 13.9.5
CP-02 Contingency Plan
SYSC 13.8.1SYSC 13.8.2SYSC 13.9.5
CP-03 Contingency Training
SYSC 13.8.1
CP-04 Contingency Plan Testing
SYSC 13.8.1SYSC 13.8.2SYSC 13.9.5
CP-05 Contingency Plan Update
SYSC 13.8.1
CP-06 Alternate Storage Site
SYSC 13.8.1SYSC 13.8.2
CP-07 Alternate Processing Site
SYSC 13.8.1SYSC 13.8.2
CP-08 Telecommunications Services
SYSC 13.8.1SYSC 13.8.2
CP-09 System Backup
SYSC 13.8.1SYSC 13.8.2
CP-10 System Recovery and Reconstitution
SYSC 13.8.1SYSC 13.8.2
CP-11 Alternate Communications Protocols
SYSC 13.8.2
CP-12 Safe Mode
SYSC 13.8.1
CP-13 Alternative Security Mechanisms
SYSC 13.8.1

IA Identification and Authentication

Control Name FCA SYSC 13 References
IA-01 Policy and Procedures
SYSC 13.7.3
IA-02 Identification and Authentication (Organizational Users)
SYSC 13.7.3
IA-04 Identifier Management
SYSC 13.7.3
IA-05 Authenticator Management
SYSC 13.7.3
IA-08 Identification and Authentication (Non-organizational Users)
SYSC 13.7.3

IR Incident Response

Control Name FCA SYSC 13 References
IR-06 Incident Reporting
SYSC 13.4

MA Maintenance

Control Name FCA SYSC 13 References
MA-01 Policy and Procedures
SYSC 13.7.2
MA-02 Controlled Maintenance
SYSC 13.7.2
MA-03 Maintenance Tools
SYSC 13.7.2
MA-06 Timely Maintenance
SYSC 13.7.2
MA-07 Field Maintenance
SYSC 13.7.2

PL Planning

Control Name FCA SYSC 13 References
PL-01 Policy and Procedures
SYSC 13.1-2SYSC 13.3SYSC 13.6.5
PL-02 System Security and Privacy Plans
SYSC 13.1-2SYSC 13.6.5
PL-04 Rules of Behavior
SYSC 13.5.1SYSC 13.6.5
PL-09 Central Management
SYSC 13.1-2SYSC 13.G.1

PM Program Management

Control Name FCA SYSC 13 References
PM-01 Information Security Program Plan
SYSC 13.1-2SYSC 13.3SYSC 13.G.1
PM-02 Information Security Program Leadership Role
SYSC 13.1-2SYSC 13.6.3SYSC 13.G.1
PM-04 Plan of Action and Milestones Process
SYSC 13.G.4
PM-06 Measures of Performance
SYSC 13.5.3SYSC 13.7.5SYSC 13.G.3
PM-07 Enterprise Architecture
SYSC 13.4
PM-08 Critical Infrastructure Plan
SYSC 13.5.2
PM-09 Risk Management Strategy
SYSC 13.1-2SYSC 13.3SYSC 13.5.2SYSC 13.8.4SYSC 13.8.5SYSC 13.G.2
PM-10 Authorization Process
SYSC 13.G.1
PM-11 Mission and Business Process Definition
SYSC 13.1-2SYSC 13.5.2SYSC 13.8.4
PM-13 Security and Privacy Workforce
SYSC 13.5.1SYSC 13.6.1
PM-14 Testing, Training, and Monitoring
SYSC 13.5.1SYSC 13.5.3SYSC 13.7.5SYSC 13.G.3
PM-28 Risk Framing
SYSC 13.5.2SYSC 13.G.2
PM-29 Risk Management Program Leadership Roles
SYSC 13.1-2SYSC 13.6.3SYSC 13.G.1
PM-30 Supply Chain Risk Management Strategy
SYSC 13.9.1
PM-31 Continuous Monitoring Strategy
SYSC 13.5.3

PS Personnel Security

Control Name FCA SYSC 13 References
PS-01 Policy and Procedures
SYSC 13.6.1SYSC 13.6.3SYSC 13.6.4
PS-02 Position Risk Designation
SYSC 13.6.1SYSC 13.6.2SYSC 13.6.4
PS-03 Personnel Screening
SYSC 13.6.4
PS-04 Personnel Termination
SYSC 13.6.4
PS-05 Personnel Transfer
SYSC 13.6.4
PS-06 Access Agreements
SYSC 13.6.1
PS-07 External Personnel Security
SYSC 13.6.3SYSC 13.6.4SYSC 13.9.2
PS-08 Personnel Sanctions
SYSC 13.6.4
PS-09 Position Descriptions
SYSC 13.6.1SYSC 13.6.3SYSC 13.G.1

RA Risk Assessment

Control Name FCA SYSC 13 References
RA-01 Policy and Procedures
SYSC 13.1-2SYSC 13.5.3
RA-02 Security Categorization
SYSC 13.5.2
RA-03 Risk Assessment
SYSC 13.1-2SYSC 13.5.2SYSC 13.5.3SYSC 13.8.4SYSC 13.G.2
RA-04 Risk Assessment Update
SYSC 13.5.3
RA-05 Vulnerability Monitoring and Scanning
SYSC 13.5.3
RA-07 Risk Response
SYSC 13.5.2SYSC 13.5.3SYSC 13.8.4SYSC 13.8.5SYSC 13.G.2
RA-09 Criticality Analysis
SYSC 13.5.2

SA System and Services Acquisition

Control Name FCA SYSC 13 References
SA-01 Policy and Procedures
SYSC 13.7.1
SA-03 System Development Life Cycle
SYSC 13.7.1SYSC 13.8.4
SA-04 Acquisition Process
SYSC 13.9.1SYSC 13.9.2SYSC 13.9.3
SA-05 System Documentation
SYSC 13.6.5
SA-08 Security and Privacy Engineering Principles
SYSC 13.7.1SYSC 13.8.4
SA-09 External System Services
SYSC 13.9.1SYSC 13.9.2SYSC 13.9.3SYSC 13.9.5
SA-10 Developer Configuration Management
SYSC 13.7.1SYSC 13.7.4
SA-11 Developer Testing and Evaluation
SYSC 13.7.1SYSC 13.7.4
SA-21 Developer Screening
SYSC 13.9.2

SC System and Communications Protection

Control Name FCA SYSC 13 References
SC-05 Denial-of-service Protection
SYSC 13.7.2SYSC 13.8.2
SC-06 Resource Availability
SYSC 13.7.2SYSC 13.8.2
SC-07 Boundary Protection
SYSC 13.7.3
SC-08 Transmission Confidentiality and Integrity
SYSC 13.7.3
SC-12 Cryptographic Key Establishment and Management
SYSC 13.7.3
SC-13 Cryptographic Protection
SYSC 13.7.3
SC-24 Fail in Known State
SYSC 13.8.2
SC-28 Protection of Information at Rest
SYSC 13.7.3
SC-36 Distributed Processing and Storage
SYSC 13.8.2

SI System and Information Integrity

Control Name FCA SYSC 13 References
SI-01 Policy and Procedures
SYSC 13.7.1
SI-02 Flaw Remediation
SYSC 13.7.1SYSC 13.7.2SYSC 13.7.4
SI-04 System Monitoring
SYSC 13.7.5
SI-05 Security Alerts, Advisories, and Directives
SYSC 13.4
SI-06 Security and Privacy Function Verification
SYSC 13.7.1SYSC 13.7.5
SI-07 Software, Firmware, and Information Integrity
SYSC 13.7.1SYSC 13.7.4
SI-10 Information Input Validation
SYSC 13.7.1
SI-11 Error Handling
SYSC 13.7.1
SI-12 Information Management and Retention
SYSC 13.G.4
SI-13 Predictable Failure Prevention
SYSC 13.7.2SYSC 13.8.2
SI-17 Fail-safe Procedures
SYSC 13.8.2

SR Supply Chain Risk Management

Control Name FCA SYSC 13 References
SR-01 Policy and Procedures
SYSC 13.9.1
SR-02 Supply Chain Risk Management Plan
SYSC 13.9.1
SR-03 Supply Chain Controls and Processes
SYSC 13.9.1SYSC 13.9.3SYSC 13.9.5
SR-04 Provenance
SYSC 13.9.2
SR-05 Acquisition Strategies, Tools, and Methods
SYSC 13.9.2
SR-06 Supplier Assessments and Reviews
SYSC 13.9.1SYSC 13.9.2SYSC 13.9.3
SR-07 Supply Chain Operations Security
SYSC 13.9.2
SR-08 Notification Agreements
SYSC 13.9.3
SR-10 Inspection of Systems or Components
SYSC 13.9.3
SR-12 Component Disposal
SYSC 13.9.5