SBP Enterprise Technology Governance & Risk Management Framework: Cybersecurity Requirements for Banks

Cybersecurity Themes Inside ETGRM Programmes

• Technology risk ownership and board reporting
• Secure architecture and change control
• Access management and privileged activity oversight
• Monitoring, incident handling, and third-party technology risk

Evidence Examiners Expect

1. Policies linked to operating procedures
2. Risk register entries with owners and treatment status
3. Monitoring metrics (not vanity dashboards)
4. Incident and near-miss reviews with remediation tracking

Tooling Without Sprawl

Prefer one correlation plane and one GRC evidence map over a new product per circular. See SIEM selection for Pakistan.

How CyberSilo Helps

• Control evidence mapping in CSA for PISF 2026
• Detection and case workflows with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

What is ETGRM?

Enterprise Technology Governance and Risk Management — SBP’s framework lens for how banks govern technology and related risks, including cybersecurity themes.

Is ETGRM only for large banks?

SBP expectations scale with institution type. Confirm applicability for your licence category; do not assume small entities are exempt without reading circulars.

How should we evidence ETGRM cyber themes?

Board reporting, risk registers, control testing, monitoring metrics, and incident lessons-learned — preferably exported from living systems rather than annual slide decks.

Related Resources

Cyber Shield · SECP · CSA