Monthly Technology Risk Committee Pack — Cyber, ICT & Operational Resilience

This monthly Technology Risk Committee (TRC) pack provides executive-level oversight of technology, cyber, and ICT third-party risks at a frequency commensurate with the velocity of the threat landscape and the operational tempo required by DORA Articles 5–16. The TRC is the primary forum below ExCo for reviewing ICT incident trends, control effectiveness, and remediation of audit and regulatory findings. The cadence supports timely escalation of material ICT-related incidents under DORA's classification criteria and ensures that operational resilience self-assessments under PRA/FCA PS6/21 are kept current. The pack covers cyber threat intelligence, vulnerability posture, change risk, third-party concentration, and important business service mapping. The committee is chaired by the CIO or CRO and includes the CISO, COO, Head of Procurement, and second-line technology risk leadership. Regulatory expectations under DORA, NIS2, and the PRA's outsourcing and third-party risk management framework (SS2/21) require firms to demonstrate active, documented governance of ICT risk, with clear linkages between operational risk events, control failures, and capital implications under Pillar 2.