Gestão de Riscos de TI - NBR 27005

download Gestão de Riscos de TI - NBR 27005

of 156

Transcript of Gestão de Riscos de TI - NBR 27005

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    1/156

    Gksti jk

    R`sdis jk Z@FBR 2788;

    Kjsif Oiwnso Bkzkrrn

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    2/156

    N RFX Rkjk Fnd`ifna jk Kfs`fi

    k Xksqu`sn quna`c`dnjn diei

    uen Irgnf`zni Tid`na (IT),

    skfji a`gnjn ni E`f`str`i jn

    D`fd`n, Zkdfiaig`n k @fivni

    ( ED Z @ ) k rks pifs v k a pk a i

    Xrigrnen @ftkre`f`stkr`na RFX,

    quk diftn die n pnrt`d`pni jis

    e`f`str`is jn Kjudni (EKD), jn

    Tnjk (ET) k jn Duaturn (E`fD).

    X`ifk`rn fi ndkssi @ftkrfkt fi

    Brns`a, n RFX panfkmn k enfte nrkjk @p, n rkjk pt`dn fnd`ifna

    ndnje`dn jk nati jkskepkfli.

    Die Xiftis jk Xrkskfn fns

    27 uf`jnjks jn ckjkrni, n rkjk

    tke en`s jk

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    3/156

    Kjsif Oiwnso Bkzkrrn

    Gksti jkR`sdis jk Z@FBR 2788;

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    4/156

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    5/156

    Kjsif Oiwnso Bkzkrrn

    R`i jk Mnfk`ri

    Ksdian Tupkr`ir jk Rkjks

    28>4

    Gksti jkR`sdis jk Z@FBR 2788;

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    6/156

    Dipyr`glt 28>4 Rkjk Fnd`ifna jk Kfs`fi k Xksqu`sn RFX

    Run Anuri Eaakr, >>3 snan >>84

    22208-083 R`i jk Mnfk`ri, RM

    J`rktir GkrnaFkasif T`eks

    J`rktir jk Tkrv`is k TiauksMis Au`z R`bk`ri C`ali

    Ksdian Tupkr`ir jk Rkjks

    Diirjkfni

    Au`z Dikali

    Kj`i

    Xkjri Tnfg`rnrj`

    Diirjkfni Ndnje`dn jk Tkgurnfn k Givkrfnfn jk Z@

    Kjsif Oiwnso Bkzkrrn

    Kqu`pk KTR (ke irjke nacnbt`dn)

    Dka`n End`ka, Dr`st`nfk Ia`vk`rn, Jkra`fn E`rnfjn, Ka`er`n Bnrbisn, Kvkaayf Ck`tisn,

    Cka`pk Fnsd`ekfti, Aiurjks Tifd`f, Aud`nfn Bnt`stn, Au`z Dnrais Aibnti, Rkfnti Junrtk

    k Pvk Nbka Enrd`na.

    Dnpn, primkti v`suna k j`ngrneni

    Zkdfijks`gf

    Skrsi

    2.8.>

    Kstk entkr`na j`jt`di ci` kanbirnji die fs kjudnd`ifn`s. Tia`d`tneis quk qunaqukr krri kfdif-trnji iu jv`jn die rkani ni entkr`na iu sku usi skmn kfv`nji pnrn n kqu`pk jk kanbirni jk

    diftkji jn Ksdian Tupkr`ir jk Rkjks, fi k-en`a `fciHksr.rfp.br. N Rkjk Fnd`ifna jk Kfs`fi kXksqu`sn k is nutirks fi nssueke qunaqukr rkspifsnb`a`jnjk pir kvkftun`s jnfis iu pkrjns, n

    pkssins iu bkfs, ir`g`fnjis ji usi jkstk entkr`na.Ns enrdns rkg`strnjns ekfd`ifnjns fkstk entkr`na pkrtkfdke nis rkspkdt`vis t`tuanrks.

    J`str`bu`i

    Ksdian Tupkr`ir jk RkjksRun Anuri Eaakr, >>3 snan >>84

    22208-083 R`i jk Mnfk`ri, RM

    lttp=//ksr.rfp.br`fciHksr.rfp.br

    Jnjis @ftkrfnd`ifn`s jk Dntnaigni fn Xuba`dni (D@X)

    B;7:g Bkzkrrn, Kjsif Oiwnso

    Gksti jk r`sdis jk Z@= FBR 2788; / Kjsif Oiwnso Bkzkrrn. R`i jk Mnfk`ri= RFX/KTR, 28>4. >4< p. = `a. ? 2< de.

    B`ba`igrnn= p.>47.@TBF 07

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    7/156

    ```

    Tuer`i

    Ksdian Tupkr`ir jk Rkjks

    N ektijiaig`n jn KTR `x

    Tibrk i dursi x

    N quke sk jkst`fn x

    Difvkfks ut`a`znjns fkstk a`vri x

    Xkre`ssks jk usi x`

    Tibrk i nutir x``

    >. @ftrijui Gksti jk R`sdis

    @ftrijui >

    Kxkrdd`i jk f`vkanekfti > @ftrijui gksti jk r`sdis 2

    Difdk`tis cufjnekftn`s 2

    Kxkrdd`i jk xni > Difdk`tis cufjnekftn`s ;

    Xr`fdp`is jn Gksti jk R`sdis ;

    Firens jk gksti jk skgurnfn k jk r`sdis 7

    Firen NBFZ FBR @TI/@KD 2788;=288< 0

    S`si gkrna jn gksti jk r`sdis >8

    Kxkrdd`i jk xni 2 S`si gkrna >2

    Kxkrdd`i jk xni 4 XJDN >;

    Cntirks drt`dis pnrn i sudkssi >;

    rkns jk diflkd`ekfti fkdkssr`ns >3

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    8/156

    `v

    Ritk`ri jk Nt`v`jnjks > >0

    Nt`v`jnjk >.> Diflkdkfji is difdk`tis >0

    Nt`v`jnjk >.2 Diflkdkfji n firen >0

    Nt`v`jnjk >.4 @jkft`dnfji i pridkssi 28

    Nt`v`jnjk >.: Cntirks drt`dis 28

    2. Diftkxti jn gksti jk r`sdis

    @ftrijui 2>

    Kxkrdd`i jk f`vkanekfti > Diftkxti 2>

    Xridkssi jk gksti jk r`sdis jk skgurnfn jn `fcireni 2>

    Diftkxti 22

    Kstnbkakd`ekfti ji diftkxti 24

    Diftkxti jn firen NBFZ FBR @TI/@KD 2788; 24

    Jkf`fji i diftkxti 2:

    @tkfs pnrn jkft`dni 2:

    Kxkrdd`i jk xni > Jkf`fji i diftkxti 2;

    Jkf`fji ksdipi k a`e`tks 23

    Kxkrdd`i jk xni 2 Jkf`fji i ksdipi k a`e`tks 27

    Dr`tr`is pnrn nvna`ni jk r `sdis 2

    Kxkrdd`i jk f`vkanekfti > @jkft`dni jis r`sdis :>

    Xridkssi jk nfa`sk jk r`sdis jk skgurnfn jn `fcireni :>

    @jkft`dni jk r`sdis :2

    @jkft`dnfji is nt`vis :4

    @jkft`dnfji is nt`vis pr`er`is :;

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    9/156

    v

    @jkft`dnfji is nt`vis jk supirtk k `fcrnkstruturn :3

    Kxkrdd`i jk xni > @jkft`dnfji is nt`vis :3

    @jkft`dnfji ns neknns :7

    Kxkrdd`i jk xni 2 @jkft`dnfji ns neknns :0

    @jkft`dnfji is diftriaks kx`stkftks :0

    Ritk`ri jk Nt`v`jnjks 4 ;4

    Nfkxi B @fcrnkstruturn ;;

    :. Nfa`sk jk r`sdis= Suafkrnb`a`jnjks k difskqufd`ns

    @ftrijui ;0

    Kxkrdd`i jk f`vkanekfti > Suafkrnb`a`jnjks k difskqufd`ns ;0

    Xridkssi jk nfa`sk jk r`sdis jk skgurnfn jn `fcireni 38

    @jkft`dnfji ns vuafkrnb`a`jnjks 38

    Kxkrdd`i jk xni > @jkft`dnfji vuafkrnb`a`jnjks 34

    @jkft`dni jns difskqufd`ns 34

    Kxkrdd`i jk xni 2 @jkft`dnfji ns difskqufd`ns 3;

    Ritk`ri jk Nt`v`jnjks : 37

    Nfkxi D Xribakens rkantnjis 30

    ;. Nfa`sk jk R`sdis= Nvna`ni jns difskqufd`ns

    @ftrijui Nvna`ni jns difskqufd`ns

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    10/156

    v`

    3. Nfa`sk jk r`sdis= nvna`ni jn pribnb`a`jnjk

    @ftrijui 0>

    Kxkrdd`i jk f`vkanekfti > Nvna`ni jn pribnb`a`jnjk 0>

    S`si gkrna ji pridkssi jk nvna`ni jk r`sdi 02

    Nvna`ni jn pribnb`a`jnjk jk idirrfd`n jk fd`jkftks 02

    Kxkrdd`i jk xni > Nvna`ni jn pribnb`a`jnjk 0:

    Jktkre`fni ji fvka jk r`sdi 0:

    Ritk`ri jk Nt`v`jnjks 3 07

    7. Nvna`ni jk r`sdis

    @ftrijui >8>

    Kxkrdd`i jk f`vkanekfti > Nvna`ni jk r`sdis >8>

    Xridkssi jk nvna`ni jk r`sdis jk skgurnfn jn fcireni >8>

    Nvna`ni jk r`sdis jk skgurnfn jn fcireni >82

    Kxkrdd`i jk xni > Nvna`ni jk r`sdi >84

    Ritk`ri jk Nt`v`jnjks 7 >8;

    87

    Kxkrdd`i jk f`vkanekfti > Zrntnekfti k ndk`tni jis r`sdis >87

    S`si gkrna ji pridkssi jk trntnekfti ji r`sdi >87

    Zrntnekfti ji r`sdi >80

    R`sdis rks`jun`s >>>

    Eij`dni ji r`sdi >>>

    Rktkfi ji r`sdi >>4

    Ni jk kv`tnr i r`sdi >>4

    Diepnrt`alnekfti ji r`sdi >>4

    Kxkrdd`i jk xni > Zrntnekfti jk r`sdi >>:

    S`si gkrna ji pridkssi jk ndk`tni ji r`sdi >>:

    Ndk`tnfji i r`sdi >>;

    Ritk`ri jk Nt`v`jnjks < >>7

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    11/156

    v``

    0. Dieuf`dni k eif`tirnekfti jis r`sdis

    @ftrijui >2>

    Kxkrdd`i jk f`vkanekfti > Dieuf`dni k difsuatn jis r`sdis >2>

    Xridkssi jk dieuf`dni k difsuatn ji r`sdi jk skgurnfn

    jn `fcireni >22

    Dieuf`dni k difsuatn ji r`sdi jk skgurnfn jn `fcireni >24

    Kxkrdd`i jk xni > Dieuf`dni k difsuatn jis r`sdis >2:

    Ritk`ri jk Nt`v`jnjks 0 >2;

    >8.Eif`tirnekfti jis r`sdis

    @ftrijui >27

    Kxkrdd`i jk f`vkanekfti > Eif`tirnekfti jk r`sdis >27

    Xridkssi jk eif`tirnekfti k nfa`sk drt`dn jk r`sdis jk

    skgurnfn jn fcireni >27

    Eif`tirnekfti k nfa`sk drt`dn jis cntirks jk r`sdi >20

    Kxkrdd`i jk xni > Eif`tirnekfti k nfa`sk drt`dn jis r`sdis >48

    Eif`tirnekfti, nfa`sk drt`dn k ekalir`n ji pridkssi jk

    gksti jk r`sdis >48

    Ritk`ri jk Nt`v`jnjks >8 >44

    Difdausi >4;

    B`ba`igrncn >47

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    12/156

    v```

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    13/156

    `x

    N Ksdian Tupkr`ir jk Rkjks (KTR) n uf`jnjk jn Rkjk Fnd`ifna jk Kfs`fi k Xksqu`sn (RFX)

    rkspifsvka pkan j`sske`fni ji diflkd`ekfti ke Zkdfiaig`ns jn @fcireni k Dieuf`dn-

    i (Z@D). N KTR fnsdk die n pripistn jk skr n cirenjirn k j`sske`fnjirn jk diepktfd`ns

    ke Z@D pnrn i dirpi tdf`di-nje`f`strnt`vi jns uf`vkrs`jnjks ckjkrn`s, ksdians tdf`dns k

    uf`jnjks ckjkrn`s jk pksqu`sn. Tun e`ssi cufjnekftna rkna`znr n dnpnd`tni tdf`dn jidirpi cufd`ifna jns irgnf`znks usur`ns jn RFX, pnrn i kxkrdd`i jk diepktfd`ns npa`d-

    vk`s ni usi kdnz k kd`kftk jns Z@D.

    N KTR ickrkdk jkzkfns jk dursis j`str`bujis fns rkns tket`dns= Nje`f`strni k Xrimkti

    jk Rkjks, Nje`f`strni jk T`stkens, Tkgurnfn, Ej`ns jk Tupirtk Dianbirni J`g`tna k

    Givkrfnfn jk Z@.

    N KTR tnebe pnrt`d`pn jk j`vkrsis primktis jk `ftkrkssk pba`di, diei n kanbirni k

    kxkdui jk panfis jk dnpnd`tni pnrn cireni jk euat`pa`dnjirks pnrn primktis kju-

    dnd`ifn`s diei= cireni fi usi jn difckrfd`n wkb pnrn n [f`vkrs`jnjk Nbkrtn ji Brns`a

    ([NB), cireni ji supirtk tdf`di jk anbirntr`is ji Xri`fci k dr`ni jk ue difmufti jk

    dnrt`alns sibrk rkjks ske i pnrn i prigrnen [e Dieputnjir pir Naufi ([DN).

    N ektijiaig`n jn KTR

    N aisin pkjngg`dn k n ektijiaig`n quk ir`kftne is dursis jn KTR si bnsknjns fn

    nprkfj`zngke diei difstrui ji diflkd`ekfti pir ek`i jn rksiaui jk pribakens tp`-

    dis jn rkna`jnjk ji priss`ifna ke cireni. Is rksuatnjis ibt`jis fis dursis jk fnturkzn

    tkr`di-prt`dn si it`e`znjis, pi`s i `fstrutir, nux`a`nji pkai entkr`na j`jt`di, ntun fi

    npkfns diei kxpis`tir jk difdk`tis k `fcirenks, ens pr`fd`pnaekftk diei ir`kftnjir ji

    naufi fn kxkdui jk nt`v`jnjks diftkxtuna`znjns fns s`tunks ji dit`j`nfi priss`ifna.

    N nprkfj`zngke kftkfj`jn diei n rkspistn ji naufi ni jksni jk s`tunks-pribakenskekalnftks s kfdiftrnjns fn prt`dn priss`ifna, quk si supkrnjns pir ek`i jk nfa`sk,

    sftksk, muagnekfti, pkfsnekfti drt`di k difstrui jk l`ptksks pnrn n rksiaui ji pri-

    baken, ke nbirjngke ir`kftnjn ni jkskfviav`ekfti jk diepktfd`ns.

    Jkssn ciren, i `fstrutir tke pnrt`d`pni nt`vn k j`nag`dn diei ir`kftnjir ji naufi pnrn ns

    nt`v`jnjks ke anbirntr`i. Nt eksei n nprkskftni jn tkir`n fi `fd`i jn skssi jk nprkf -

    j`zngke fi difs`jkrnjn uen s`epaks kxpis`i jk difdk`tis k `fcirenks. I `fstrutir

    busdn `fdkft`vnr n pnrt`d`pni jis naufis dift`funekftk.

    Ksdian Tupkr`ir jk Rkjks

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    14/156

    x

    Ns skssks jk nprkfj`zngke ifjk sk ji n nprkskftni jis diftkjis k n rkna`zni jns

    nt`v`jnjks prt`dns te cirenti prkskfd`na k ksskfd`naekftk prt`di, ut`a`znfji tdf`dns jk

    kstuji j`r`g`ji `fj`v`juna, trnbnali ke kqu`pk k prt`dns ir`kftnjns pnrn i diftkxti jk ntun-

    i ji cuturi kspkd`na`stn quk sk prktkfjk cirenr.

    Ns skssks jk nprkfj`zngke jkskfviavke-sk ke trs ktnpns, die prkjie`ffd`n jk tkepi

    pnrn ns nt`v`jnjks prt`dns, difcirek jksdr`i n skgu`r=

    Xr`ek`rn ktnpn= nprkskftni jn tkir`n k ksdanrkd`ekfti jk jv`jns (jk 38 n 08 e`futis).

    I `fstrutir nprkskftn, jk enfk`rn s`ftt`dn, is difdk`tis tkr`dis dirrkspifjkftks ni tken

    jn skssi jk nprkfj`zngke, die nuxa`i jk sa`jks ke cirenti XiwkrXi`ft. I fstrutir akvnftn

    qukstks sibrk i diftkji jis sa`jks ke vkz jk npkfns nprkskft-ais, difv`jnfji n turen

    rkkxi k pnrt`d`pni. @ssi kv`tn quk ns nprkskftnks skmne eiftifns k quk i naufi sk

    diaiquk ke pis`i jk pnss`v`jnjk, i quk rkjuz`r`n n nprkfj`zngke.

    Tkgufjn ktnpn= nt`v`jnjks prt`dns jk nprkfj`zngke (jk >28 n >;8 e`futis).

    Kstn ktnpn n kssfd`n jis dursis jn KTR. N en`ir`n jns nt`v`jnjks jis dursis nssfdrifn k

    rkna`znjn ke jupans jk naufis, quk ndiepnflne i r`tei ji ritk`ri jk nt`v`jnjks pripisti fi

    a`vri jk npi`i. @fstrutir k eif`tir d`rduane kftrk ns jupans pnrn siaud`ifnr jv`jns k ickrkdkr

    kxpa`dnks diepakekftnrks.

    Zkrdk`rn ktnpn= j`sdussi jns nt`v`jnjks rkna`znjns (48 e`futis).

    I fstrutir diekftn dnjn nt`v`jnjk, nprkskftnfji uen jns siauks pissvk`s pnrn rksiav-an,

    jkvkfji ntkr-sk qukans quk gkrne en`ir j`duajnjk k piae`dn. Is naufis si difv`jnjis n

    diekftnr ns siauks kfdiftrnjns k i `fstrutir rktien tp`dis quk tkflne gkrnji jv`jns,

    kst`euanfji n pnrt`d`pni jis naufis. I `fstrutir skeprk kst`euan is naufis n kfdiftrnrke

    siauks natkrfnt`vns s sugkr`jns pir kak k pkais diakgns k, dnsi kx`stne, n diekft-ans.

    Tibrk i dursi

    I dursi nprkskftn is difdk`tis jk gksti jk r`sdis n pnrt`r jn firen FBR @TI 2788;.Jkfk difdk`tis k trnbnaln n diftkxtuna`zni ji neb`kftk, `jkft`dni k akvnftnekfti

    jis r`sdis ntrnvs ji diflkd`ekfti jns neknns, nt`vis, vuafkrnb`a`jnjks, pribnb`a`jnjk

    jk idirrfd`n k `epndtis. Ti rkna`znjis n kst`ent`vn k i daduai jk r`sdi k jkf`ji i

    trntnekfti en`s njkqunji. Ziji i trnbnali bnsknji ke ue kstuji jk dnsi, v`snfji

    difsia`jnr i diflkd`ekfti tkr`di. Ni fna ji dursi i pnrt`d`pnftk kstnr npti n rkna`znr

    uen nfa`sk jk r`sdi quna`tnt`vn fi neb`kftk jn sun irgnf`zni.

    N quke sk jkst`fn

    Dursi j`rkd`ifnji n gkstirks, tdf`dis k priss`ifn`s jk `fciret`dn iu rkns nfs, quk

    ksti ke busdn ji jkskfviav`ekfti jk diepktfd`ns fn rkna`zni jk gksti k nfa`sk

    jk r`sdis fi neb`kftk jk tkdfiaig`ns jn `fcireni k dieuf`dni (Z@D). Xriss`ifn`s jk

    iutrns rkns pijke pnrt`d`pnr jksjk quk pissune diflkd`ekftis jk Z@D, skgurnfn jn

    `fcireni k firens @TI 2788> k 27882.

    Difvkfks ut`a`znjns fkstk a`vri

    Ns skgu`ftks difvkfks t`pigrdns si usnjns fkstk a`vri=

    @ta`di

    @fj`dn fieks jk nrqu`vis k rkckrfd`ns b`ba`igrdns rkand`ifnjns ni aifgi ji tkxti.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    15/156

    x`

    Anrgurn difstnftk

    @fj`dn dienfjis k suns ipks, vnr`vk`s k ntr`butis, diftkji jk nrqu`vis k rksuatnji jn snjn

    jk dienfjis. Dienfjis quk skri j`g`tnjis pkai usur`i si gr`cnjis ke fkgr`ti k pissuke

    i prkxi ji neb`kftk ke usi (fi A`fux firenaekftk # iu $, kfqunfti fi W`fjiws D=Q).

    Diftkji jk sa`jk@fj`dn i diftkji jis sa`jks rkckrkftks ni dursi nprkskftnjis ke snan jk nuan.

    Tebiai

    @fj`dn rkckrfd`n diepakekftnr j`spifvka ke s`tk iu pg`fn fn `ftkrfkt.

    Tebiai

    @fj`dn ue jiduekfti diei rkckrfd`n diepakekftnr.

    Tebiai

    @fj`dn ue vjki diei rkckrfd`n diepakekftnr.

    Tebiai

    @fj`dn ue nrqu`vi jk nj`i diei rkckrfd`n diepakekftnr.

    Tebiai

    @fj`dn ue nv`si iu prkdnui n skr difs`jkrnjn.

    Tebiai

    @fj`dn qukst`ifnekftis quk kst`euane n rkkxi iu nprkskftn diftkji jk npi`i ni

    kftkfj`ekfti ji tken ke quksti.

    Tebiai@fj`dn fitns k `fcirenks diepakekftnrks diei j`dns, sugkstks jk ak`turn nj`d`ifna iu

    eksei uen ibskrvni.

    Xkre`ssks jk usi

    Zijis is j`rk`tis rkskrvnjis RFX.

    Ngrnjkdkeis skeprk d`tnr kstn ciftk qunfji `fdau`r pnrtk jkstk a`vri ke iutrn ibrn.

    Kxkepai jk d`tni= BK]KRRN, K. O. Gksti jk R`sdis jk Z@ FBR 2788;. R`i jk Mnfk`ri= Ksdian

    Tupkr`ir jk Rkjks, RFX, 28>4.

    Diekftr`is k pkrguftnsXnrn kfv`nr diekftr`is k pkrguftns sibrk kstn puba`dni=

    Ksdian Tupkr`ir jk Rkjks RFX

    Kfjkrki= Nv. Anuri Eaakr >>3 snan >>84 Bitncigi

    R`i jk Mnfk`ri RM 22208-083

    K-en`a= `fciHksr.rfp.br

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    16/156

    x``

    Tibrk i nutir

    Kjsif Oiwnso Bkzkrrn priss`ifna jn rkn jk skgurnfn jn `fcireni k givkrfnfn

    l en`s jk qu`fzk nfis, ntunfji diei nuj`tir ajkr, pksqu`snjir, gkrkftk jk primkti k

    gkrkftk tdf`di, ke `fekris primktis jk gksti jk r`sdis, gksti jk skgurnfn jn `fcir-

    eni, dift`fu`jnjk jk fkgd`is, XD@, nuj`tir`n k rkdupkrni jk jksnstrks ke keprksns

    jk grnfjk pirtk ji sktir jk tkakdieuf`dnks, fnfdk`ri, kfkrg`n, `fjstr`n k givkrfi.

    Die vnstn kxpkr`fd`n fis tkens jk skgurnfn k givkrfnfn, tke ntunji tnebe diei

    pnakstrnftk fis pr`fd`pn`s kvkftis ji Brns`a k n`fjn diei `fstrutir jk trk`fnekftis cidnjis

    ke skgurnfn k givkrfnfn. prickssir k diirjkfnjir jk dursis jk ps-grnjuni fn rkn

    jk skgurnfn jn `fcireni, gksti `ftkgrnjn, `fivni k tkdfiaig`ns wkb. Limk ntun diei

    Diirjkfnjir Ndnje`di jk Tkgurnfn k Givkrfnfn jk Z@ jn Ksdian Tupkr`ir jk Rkjks. Xis-

    su` n dkrt`dni DR@TD jn @TNDN, nae jk j`vkrsns iutrns ke skgurnfn k givkrfnfn.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    17/156

    >

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    ibmkt`vis

    dif

    dk`tis

    >@ftrijui Gksti jk R`sdis

    Difdk`tunr k dieprkkfjkr neknns, vuafkrnb`a`jnjks, pribnb`a`jnjk k r`sdis?

    diflkdkr k ut`a`znr n firen jk gksti jk r`sdis? `jkft`dnr ns nt`v`jnjks ji

    pridkssi jk gksti jk r`sdis k is cntirks drt`dis pnrn i sudkssi? `jkft`dnr

    k jkf`r ns rkns fkdkssr`ns pnrn n gksti jk r `sdis.

    Neknns, vuafkrnb`a`jnjks, pribnb`a`jnjk, r`sdis, skgurnfn jn `fcireni k gkstijk r`sdis.

    @ftrijui

    q> N ni k `ftkrni jis ibmkt`vis die ns `fdkrtkzns ir`g`fne i r `sdi, quk sk nprkskftnfi j`n n j`n jk tijn k qunaqukr nt`v`jnjk.

    > Eu`tns vkzks, i r`sdi fi sk nprkskftn v`svka, skfji fkdkssr`ns nks pnrn jkft`d-ai.

    > Iutrns vkzks, i r`sdi cruti jk nks rkpkft`fns quk cigke ni diftriak luenfi,diei ke kvkftis jk dnusns fnturn`s.

    Fns cnsks ji d`dai jk v`jn jk qunaqukr nt`v`jnjk luenfn panfkmnjn, difv`vkeis die juns dkr-

    tkzns bs`dns= jnqu`ai quk jkvk ndiftkdkr (is ibmkt`vis) k i quk pijk ndiftkdkr (ns `fdkrtkzns).

    N ni k `ftkrni jis ibmkt`vis die ns `fdkrtkzns ji ir`gke ni r`sdi, quk sk nprkskftn fi

    j`n n j`n jk tijn k qunaqukr nt`v`jnjk jkskfviav`jn. Eu`tns vkzks, i r`sdi fi sk nprkskftn

    v`svka, skfji fkdkssr`ns nks pnrn `jkft`d-ai? ke iutrns s`tunks i r`sdi privkf`kftk

    jk nks rkpkft`fns quk cigke ni diftriak ji skr luenfi, diei fi dnsi jk kvkftis jk

    dnusns fnturn`s.

    J`nr`nekftk vkeis enfdlktks ke puba`dnks jns en`s j`vkrsns rkns quk jkstndne, die

    fcnsk, is pribakens rkand`ifnjis nis r`sdis tkdfiag`dis jk skgurnfn jn `fcireni= riubis

    jk ej`ns jk bndoup k jk fitkbiios, vnznekfti jk fekris jk dnrtks jk drj`ti, enfusk`i

    `eprpr`i jk rkg`stris kaktrf`dis, riubi jk jkft`jnjk k qukbrn jk pripr`kjnjk ftkakdtuna.

    Kstk dnptuai nbirjnr is difdk`tis cufjnekftn`s pnrn n Gksti jk R `sdis k nprkskftnr n

    firen NBFZ FBR @TI/@KD 2788;=288< - Zkdfiaig`n jn @fcireni Zdf`dns jk skgurnfn

    Gksti jk r`sdis jk skgurnfn jn `fcireni.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    18/156

    2

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Kxkrdd`i jk f`vkanekfti >k@ftrijui gksti jk r`sdis

    Diei vid nvna`n fn sun irgnf`zni i pridkssi jk gksti jk r`sdis9

    Kx`stke r`sdis pnrn is trnbnalis k nt`v`jnjks jn sun irgnf`zni9

    Difdk`tis cufjnekftn`s

    q> Firen @TI Gu`jk 74=2880 Gksti jk r`sdis Sidnbuar`i2 Rkdiekfjnks pnrn usi ke firens.

    2 Nprkskftn ns pr`fd`pn`s tkre`fiaig`ns pnrn usi fns nt`v`jnjks jk gksti jk r`sdis.

    > Kstn tkre`fiaig`n jkvk skr dieb`fnjn die is tkreis nprkskftnjis fns firens=

    2 NBFZ FBR @TI/@KD 2788>.

    2 NBFZ @TI/@KD 27882.

    > Zkreis nprkskftnjis fns firens=

    2 Tkgurnfn jn @fcireni.

    2 Neknn.

    2 Suafkrnb`a`jnjk.

    2 R`sdi.

    2 R`sdis jk skgurnfn jn `fcireni.2 @jkft`dni jk r`sdis.

    2 @epndti.

    2 Kst`ent`vn jk r`sdis.2 Eij`dni ji r`sdi.

    2 Dieuf`dni ji r`sdi.

    2 Ni jk kv`tnr i r`sdi.

    2 Rktkfi ji r`sdi.

    2 Diepnrt`alnekfti ji r`sdi.

    `epirtnftk tkr skeprk ke ekftk is skgu`ftks difdk`tis=

    Tkgurnfn jn @fcireni n pritki jn `fcireni jk vr `is t`pis jk neknns, v`snfji

    gnrnft`r n dift`fu`jnjk ji fkgd`i, e`f`e`znr is r `sdis quk pissne diepriekt-ai,

    enx`e`znr i rktirfi sibrk is `fvkst`ekftis k ns ipirtuf`jnjks jk fkgd`i. N skgurnfn

    jn `fcireni ibt`jn diei rksuatnji jn `epakekftni jk ue difmufti jk diftriaks,

    dieprkkfjkfji piat`dns, pridkssis, pridkj`ekftis, kstruturns irgnf`znd`ifn`s k cufks

    jk lnrjwnrk k sictwnrk.

    N skgurnfn jn `fcireni ibt`jn die n `epakekftni jk diftriaks quk jkvkri skr

    eif`tirnjis, nfna`snjis k dift`funekftk ekalirnjis, die i ftu`ti jk ntkfjkr nis

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    19/156

    4

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    ibmkt`vis ji fkgd`i, e`t`gnfji is r`sdis k gnrnft`fji is prkdk`tis jk skgurnfn jn irgnf`-

    zni= Difjkfd`na`jnjk, @ftkgr`jnjk, J`spif`b`a`jnjk k Nutkft`d`jnjk (D@JN).

    q> Neknn tiji k qunaqukr kvkfti quk pissn kxpairnr vuafkrnb`a`jnjks.> Dnusn pitkfd`na jk ue `fd`jkftk `fjkskmnji, quk pijk rksuatnr ke jnfi pnrn is

    s`stkens, pkssins iu n prpr`n irgnf`zni.

    > Ns neknns pijke skr danss`dnjns ke=2 Neknns ftkfd`ifn`s.

    2 Neknns jn ni jn fnturkzn.

    2 Neknns fi ftkfd`ifn`s.

    Ti kxkepais jk neknns=

    > Krris luenfis?> Cnalns jk lnrjwnrk?

    > Cnalns jk sictwnrk?

    > Nks jn fnturkzn?> Zkrrir`sei?

    > Snfjna`sei, kftrk iutrns.

    Suafkrnb`a`jnjk qunaqukr crnqukzn quk pissn skr kxpairnjn pnrn diepriektkr n skgu-

    rnfn jk s`stkens iu `fcirenks. Crng`a`jnjk jk ue nt`vi iu grupi jk nt`vis quk pijk skr

    kxpairnjn pir uen iu en`s neknns.

    Xnrn pkfsnr

    Neknn vkrsusSuafkrnb`a`jnjk

    Kftkfjk-sk quk n neknn i kvkfti iu `fd`jkftk, kfqunfti n vuafkrnb`a`jnjk

    n crng`a`jnjk quk skr kxpairnjn pnrn quk n neknn sk tirfk difdrktn. Neknns

    pijke nssue`r j`vkrsns cirens, diei curti jk kqu`pnekftis, ej`n k jidu-

    ekftis, ksdutn fi nutir`znjn, `fdfj`i, `fufjni k rnj`ni kaktriengft`dn,

    nt ckfekfis da`et`dis k sse`dis. Xir kxkepai, ue dieputnjir dumn skfln skmn

    ji diflkd`ekfti jk tijis, sicrk neknns diei riubi, jkstru`i iu natkrni jk

    `fcirenks? n vuafkrnb`a`jnjk quk pkre`tk quk kstns neknns sk difdrkt`zke

    mustnekftk n skfln skr diflkd`jn k diepnrt`alnjn pir tijis.

    Suafkrnb`a`jnjk Neknn

    Cnatn jk trk`fnekfti jk cufd`ifr`is Krris luenfis

    @ftkrrupi fi skrv`jir pir quk`en jn ciftk Cnaln jk lnrjwnrk

    T`stken npa`dnt`vi ndk`tn qunaqukr vnair fis skus dnepis Cnaln jk sictwnrk

    @fufjni jn snan ke v`rtujk jns cirtks dluvns Nks jn fnturkzn

    Kxpaisi prividnjn ftkfd`ifnaekftk fi tkre`fna jk f`bus Zkrrir`sei

    Equ`fn NZE v`rnjn k p`dlnjn Snfjna`sei

    Znbkan >.>

    Kxkepais jk

    vuafkrnb`a`jnjks

    k neknns.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    20/156

    :

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Is difdk`tis n skgu`r j`zke rkspk`ti s nt`v`jnjks nps n `jkft`dni jis r`sdis k rkand`i-

    fnjns ni sku trntnekfti.

    > R`sdi= dieb`fni jn pribnb`a`jnjk (dlnfdk jn neknn sk difdrkt`znr) jk ue kvkfti`fjkskmnji idirrkr k jk suns difskqufd`ns pnrn n irgnf`zni. n `fdkrtkzn rksuatnftk

    jn dieb`fni jn pribnb`a`jnjk jk idirrfd`n jk ue kvkfti k suns difskqufd`ns.

    N pkrguftn ^una i r`sdi9 akvnftn jv`jns n rkspk`ti jn idirrfd`n jk nagi `fdkrti iu

    `fkspkrnji. Ke skgurnfn jn `fcireni, kstn `fdkrtkzn rks`jk fis nspkdtis tkdfi-ag`dis kfviav`jis, fis pridkssis kxkdutnjis k, pr`fd`pnaekftk, fns pkssins quk ke

    nague eiekfti ftkrngke die n tkdfiaig`n k sk kfviavke die is pridkssis.

    > R`sdis jk skgurnfn jn `fcireni= piss`b`a`jnjk jk uen jktkre`fnjn neknn kxpairnrvuafkrnb`a`jnjks jk ue nt`vi iu jk ue difmufti jk nt`vis, nss`e prkmuj`dnfji n irgnf`zni.

    > @jkft`dni jk r`sdis= pridkssi pnrn aidna`znr, a`stnr k dnrndtkr`znr kakekftis jk r `sdi.Xir ekfir quk skmn n pribnb`a`jnjk jk idirrfd`n jk ue r`sdi, pijk skr quk jktkre`fnjn

    `fdkrtkzn idirrn k kxpairk uen vuafkrnb`a`jnjk, difdrkt`znfji uen neknn. Xnrn sk prk-

    pnrnr pnrn `ssi fkdkssr`i diflkdkr is r`sdis jk tiji i neb`kftk, ntrnvs jn rkna`zni

    jk ue pridkssi cirena`znji jk `jkft`dni jk r`sdis.

    > @epndti= eujnfn njvkrsn fi fvka ibt`ji jis ibmkt`vis jk fkgd`is. Difskqufd`n nvn-a`njn jis rksuatnjis die n idirrfd`n jk ue kvkfti ke pnrt`duanr, ke quk jktkre`fnjn

    vuafkrnb`a`jnjk ci` kxpairnjn, uen neknn idirrku k i r`sdi sk difdrkt`ziu. ^una ci` i

    `epndti jkstk kvkfti fis fkgd`is9 unfti sk pkrjku9 N irgnf`zni skr rkspifsnb`a`-

    znjn9 Lnvkr euatns9 Nks akgn`s skri `epktrnjns9 Lnvkr jnfis jk `engke9

    @eng`fk ns skgu`ftks s`tunks l`pitt`dns=

    >. Ke uen cnduajnjk, ue usur`i die ndkssi s `fcirenks jis naufis jk`xiu sun skfln

    ksdr`tn fue pnpka nps rkfiv-an. I quk pijk idirrkr9 ^una i `epndti9

    2. Ke pakfn prkpnrni pnrn i vkst`buanr jk uen jktkre`fnjn `fst`tu`i, ns privns

    vnznrne. ^una i `epndti sk kstk vnznekfti idirrku sk`s eksks nftks jn rkna`zni jivkst`buanr9 K sk idirrku fns :< lirns quk nftkdkjke n rkna`zni ji vkst`buanr9

    Kxkepais jk `epndtis= pkrjns fnfdk`rns, pnrna`sni jk skrv`is ksskfd`n`s, pkrjn jk

    difnfn jis da`kftks, pnfk fi cirfkd`ekfti jk kfkrg`n k cnalns jk tkakdieuf`dnks,

    kftrk tnftis iutris.

    > Kst`ent`vn jk r`sdis= pridkssi ut`a`znji pnrn ntr`bu`r vnairks pribnb`a`jnjk k difsk-qufd`ns jk ue r`sdi. N kst`ent`vn jk r`sdis pkre`tk qunft`dnr iu jksdrkvkr jk ciren

    quna`tnt`vn ue r`sdi, pkre`t`fji s irgnf`znks pr`ir`znr is r `sdis jk ndirji die is

    dr`tr`is kstnbkakd`jis.

    > Nks jk eij`dni ji r`sdi= nks tienjns pnrn rkjuz`r n pribnb`a`jnjk, ns difsk-qufd`ns fkgnt`vns, iu nebns, nssid`njns n ue r`sdi.

    > Dieuf`dni ji r`sdi= tridn iu diepnrt`alnekfti jk `fcirenks sibrk i r`sdi kftrk itienjir jk jkd`si k iutrns pnrtks `ftkrkssnjns.

    > Ni jk kv`tnr i r`sdi= jkd`si jk fi sk kfviavkr iu ng`r jk ciren n e`t`gnr uens`tuni jk r`sdi.

    > Rktkfi ji r`sdi= ndk`tni ji fus jn pkrjn iu ji bkfkcd`i ji gnfli nssid`nji n uejktkre`fnji r`sdi.

    > Diepnrt`alnekfti ji r`sdi= diepnrt`alnekfti die iutrn kft`jnjk ji fus jn pkrjniu ji bkfkcd`i ji gnfli nssid`nji n ue r`sdi.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    21/156

    ;

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    Kxkrdd`i jk c`xni >kDifdk`tis cufjnekftn`s

    Jurnftk uen nprkskftni sibrk is difdk`tis jk gksti jk r`sdis pnrn n natn j`rki jn sun

    irgnf`zni, vid ci` qukst`ifnji sibrk juns pissvk`s neknns kx`stkftks k skus r`sdis.

    Diei vid rkspifjkr`n9

    Ke cufi jn sun rkspistn pnrn n natn j`rki, alk pkj`rne pnrn kxpa`dnr is pissvk`s

    `epndtis rkand`ifnjis n kstks r`sdis. Diei vid rkspifjkr`n9

    Xr`fdp`is jn Gksti jk R`sdis

    qXr`fdp`is jn gksti jk r`sdis=> N gksti jk r`sdis dr`n k pritkgk vnair.

    > N gksti jk r `sdis pnrtk `ftkgrnftk jk tijis is pridkssis irgnf`znd`ifn`s.> N gksti jk r `sdis pnrtk jn tienjn jk jkd`sks.

    > N gksti jk r `sdis nbirjn kxpa`d`tnekftk n `fdkrtkzn.> N gksti jk r`sdis s`stket`dn, kstruturnjn k ipirtufn.

    > N gksti jk r `sdis bnsk`n-sk fns ekalirks `fcirenks j`spifvk`s.

    > N gksti jk r `sdis ck`tn sib ekj`jn.

    > N gksti jk r `sdis difs`jkrn cntirks luenfis k duaturn`s.

    > N gksti jk r `sdis trnfspnrkftk k `fdaus`vn.

    > N gksti jk r `sdis j`fe`dn, `tkrnt`vn k dnpnz jk rkng`r n eujnfns.> N gksti jk r `sdis cnd`a`tn n ekalir`n diftfun jn irgnf`zni.

    Xnrn n gksti jk r`sdis skr kdnz, difve quk uen irgnf`zni, ke tijis is fvk`s, ntkfjn

    nis pr`fdp`is jksdr`tis n skgu`r.

    n. N gksti jk r`sdis dr`n k pritkgk vnair.

    N gksti jk r `sdis diftr`bu` pnrn n rkna`zni jkeifstrvka jis ibmkt`vis k pnrn n ekalir`n

    ji jkskepkfli, rkckrkftk skgurnfn k snjk jns pkssins, difcire`jnjk akgna k rkguan-

    tr`n, ndk`tni pba`dn, pritki ji ek`i neb`kftk, quna`jnjk ji prijuti, ni gkrkf-

    d`nekfti jk primktis, kd`fd`n fns ipkrnks, givkrfnfn k rkputni.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    22/156

    3

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    b. N gksti jk r`sdis pnrtk ftkgrnftk jk tijis is pridkssis irgnf`znd`ifn`s.

    N gksti jk r `sdis fi uen nt`v`jnjk nutfien skpnrnjn jns pr`fd`pn`s nt`v`jnjks k

    pridkssis jn irgnf`zni. N gksti jk r`sdis cnz pnrtk jns rkspifsnb`a`jnjks jn nje`f`s-

    trni k pnrtk `ftkgrnftk jk tijis is pridkssis irgnf`znd`ifn`s, `fdau`fji i panfkmnekfti

    kstrntg`di k tijis is pridkssis jk gksti jk primktis k gksti jk eujnfns.

    d. N gksti jk r`sdis pnrtk jn tienjn jk jkd`sks.

    N gksti jk r`sdis nux`a`n is tienjirks jk jkd`si n cnzkr ksdialns difsd`kftks, pr`ir`znr

    nks k j`st`fgu`r kftrk cirens natkrfnt`vns jk ni.

    j. N gksti jk r`sdis nbirjn kxpa`d`tnekftk n fdkrtkzn.

    N gksti jk r`sdis kxpa`d`tnekftk akvn ke difs`jkrni n `fdkrtkzn, n fnturkzn jkssn `fdkr-

    tkzn, k diei kan pijk skr trntnjn.

    k. N gksti jk r`sdis s`stket`dn, kstruturnjn k ipirtufn.

    [en nbirjngke s`stket`dn, ipirtufn k kstruturnjn pnrn n gksti jk r`sdis diftr`bu` pnrn

    n kd`fd`n k pnrn is rksuatnjis difs`stkftks, diepnrvk`s k difvk`s.

    c. N gksti jk r`sdis bnsk`n-sk fns ekalirks fcirenks j`spifvk`s.

    Ns kftrnjns pnrn i pridkssi jk gkrkfd`nr r`sdis si bnsknjns ke ciftks jk `fcireni, tn`s

    diei jnjis l`str`dis, kxpkr`fd`ns, rktrina`ekftni jns pnrtks `ftkrkssnjns, ibskr-

    vnks, prkv`sks k ip`f`ks jk kspkd`na`stns. Kftrktnfti, difve quk is tienjirks jk

    jkd`si sk `fcireke k akvke ke difs`jkrni qun`squkr a`e`tnks jis jnjis iu eijk-

    angke ut`a`znjis, iu n piss`b`a`jnjk jk j`vkrgfd`ns kftrk kspkd`na`stns.

    g. N gksti jk r`sdis ck`tn sib ekj`jn.

    N gksti jk r`sdis kst na`flnjn die i diftkxti `ftkrfi k kxtkrfi jn irgnf`zni k die i

    pkra ji r`sdi.

    l. N gksti jk r`sdis difs`jkrn cntirks luenfis k duaturn`s.

    N gksti jk r`sdis rkdiflkdk ns dnpnd`jnjks, pkrdkpks k `ftkfks ji pkssina `ftkrfi k

    kxtkrfi, quk pijke cnd`a`tnr iu j`duatnr n rkna`zni jis ibmkt`vis jn irgnf`zni.

    `. N gksti jk r`sdis trnfspnrkftk k fdaus`vn.

    I kfviav`ekfti npripr`nji k ipirtufi jk pnrtks `ftkrkssnjns k, ke pnrt`duanr, jis tien-

    jirks jk jkd`si ke tijis is fvk`s jn irgnf`zni nsskgurn quk n gksti jk r`sdis pkren-

    fkn pkrt`fkftk k ntuna`znjn. I kfviav`ekfti tnebe pkre`tk quk ns pnrtks `ftkrkssnjns

    skmne jkv`jnekftk rkprkskftnjns k tkflne suns ip`f`ks akvnjns ke difs`jkrni fn

    jktkre`fni jis dr`tr`is jk r`sdi.

    m. N gksti jk r`sdis j`fe`dn, `tkrnt`vn k dnpnz jk rkng`r n eujnfns.

    N gksti jk r`sdis dift`funekftk pkrdkbk k rkngk s eujnfns. ekj`jn quk ndiftkdke

    kvkftis kxtkrfis k `ftkrfis, i diftkxti k i diflkd`ekfti eij`dne-sk, i eif`tirnekfti

    k n nfa`sk drt`dn jk r`sdis si rkna`znjis, fivis r`sdis surgke, nagufs sk eij`dne k

    iutris jksnpnrkdke.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    23/156

    7

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    o. N gksti jk r`sdis cnd`a`tn n ekalir`n diftfun jn irgnf`zni.

    Difve quk ns irgnf`znks jkskfviavne k `epakekftke kstrntg`ns pnrn ekalirnr n sun

    entur`jnjk fn gksti jk r`sdis, muftnekftk die tijis is jken`s nspkdtis jn sun irgnf`zni.

    Kstks pr`fdp`is jn gksti jis r`sdis jkvke skr is firtknjirks jkstn fibrk nt`v`-

    jnjk fi j`n n j`n jns irgnf`znks.

    Firens jk gksti jk skgurnfn k jk r`sdis

    q> Firen NBFZ FBR @TI/@KD 2788>=2883> Firen NBFZ FBR @TI/@KD 27882=288;

    N rkn jk skgurnfn jn `fcireni pissu` ue difmufti jk firens pnrn skrke ut`a`znjns

    fns en`s j`vkrsns irgnf`znks, n e jk pkre`t`r uen pnjrif`zni jis rkqu`s`tis k pridk-

    j`ekftis pnrn n `epakekftni jk ue TGT@.

    Firen NBFZFBR @TI/@KD 2788>=2883

    2 Zkdfiaig`n jn @fcireni Zdf`dns jk skgurnfn T`stkens jk gksti jk skgurnfnjn fcireni Rkqu`s`tis

    2 Nprkskftn k jksdrkvk is rkqu`s`tis quk jkvke skr `epakekftnjis fi kstnbkakd`-ekfti jk ue T`stken jk Gksti jk Tkgurnfn jn @fcireni (TGT@).

    > Firen NBFZ FBR @TI/@KD 27882=288;2 Zkdfiaig`n jn fcireni Zdf`dns jk skgurnfn Dj`gi jk prt`dn pnrn n gksti

    jk skgurnfn jn `fcireni

    2 Nprkskftn ns ekalirks prt`dns pnrn uen gksti njkqunjn jn skgurnfn jn `fcireni.

    Xijkfji skr npa`dnjns n qunaqukr neb`kftk jk uen irgnf`zni (pnrt`duanrekftk ni neb`kftkjk Z@), kstns firens jkstndne n fkdkss`jnjk jns irgnf`znks jk pissurke uen gksti jk

    r`sdis kstruturnjn, die n pnjrif`zni jk pridkssis k rkqu`s`tis jk gksti jk r`sdis.

    Ke >00;, n die`ssi jk pnjrif`zni jn Nustra`n k Fivn ]kafj`n anfiu n pr`ek`rn

    firen trntnfji ji tken= NT/F]T :438 Gksti jk R`sdi. Gkfr`dn, n firen kstnbkakdk ue

    pridkssi jk gksti jk r`sdis nepanekftk ndk`ti, tkfji s`ji ntuna`znjn ke >000 (NT/F]T

    :438=>000). Ke >003, n @ftkrfnt`ifna Irgnf`znt`if cir Ttnfjnrj`znt`if (@TI) dr`iu ue grupi

    jk trnbnali bnsknji fn NT/F]T :438 pnrn dr`nr ue primkti jk gksti jk r`sdi, quk pnssiu

    pir j`vkrsis pribakens k s ci` difdauji ke 2880.

    qNBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rktr`zks=> Firen quk cirfkdk is pr`fdp`is k j`rktr`zks gkfr`dns pnrn qunaqukr `fjstr`n iu sktir.> Dr`njn pnrn skr npa`dnjn n qunaqukr neb`kftk iu irgnf`zni.

    NBFZ @TI G[@JK 74=2880 Gksti jk R `sdis Sidnbuar`i=

    > Firen quk nprkskftn ns jkf`ks jk tkreis gkfr`dis rkant`vis gksti jk r`sdis.> Rkckrfd`n jk difdk`tis a`gnjis gksti jk r`sdi.

    NBFZ

    Cufjnjn ke >0:8, n

    Nssid`ni Brns`ak`rn

    jk Firens Zdf`dns i

    rgi rkspifsvka pkan

    firena`zni tdf`dn

    fi pns, cirfkdkfjin bnsk fkdkssr`n ni

    jkskfviav`ekfti tkdfi-

    ag`di brns`ak`ri. uenkft`jnjk pr`vnjn, ske

    c`fs audrnt`vis.

    Tn`bn en`s

    Ns firens jksdr`tns

    nd`en si nprkskftnjns

    fi dursi Gksti jk Tkgu-

    rnfn jn @fcireni

    FBR 2788> k 27882,

    ickrkd`ji pkan Ksdian

    Tupkr`ir jk Rkjks.

    a

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    24/156

    8>8=2880 Gksti jk r`sdis Zdf`dns jk nvna`ni jk r`sdis=> Firen quk jkvk skr trnbnalnjn ke npi`i firen NBFZ FBR @TI 4>888=2880 Gksti

    jk R`sdis Xr `fdp`is k j`rktr`zks.

    > Jksdrkvk ns j`vkrsns tdf`dns k ckrrnekftns jk nfa`sk jk r`sdi, k fi ci` n`fjn trnju-z`jn pkan NBFZ.

    Ke 2880 anfnjn pkan @TI k `ekj`ntnekftk pkan Nssid`ni Brns`ak`rn jk Firens Zd-f`dns (NBFZ) n firen NBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rktr`zks.

    Kstn firen cirfkdk is pr`fdp`is k j`rktr`zks gkfr`dns pnrn qunaqukr `fjstr`n iu sktir.

    Fi eksei nfi ci` anfnjn n firen NBFZ @TI G[@JK 74=2880 Gksti jk R`sdis Sidnbu-

    ar`i. Kan nprkskftn ns jkf`ks jk tkreis gkfr`dis rkant`vis gksti jk r`sdis. ^unfji

    sk prktkfjk cnzkr rkckrfd`n n ue difdk`ti jk gksti jk r`sdis, jkvk skr ut`a`znjn n jk-

    f`i jn firen NBFZ @TI G[@JK 74=2880 Gksti jk R`sdis Sidnbuar`i. Tkgufji n NBFZ=

    Kstk gu`n cirfkdk ns jkf`ks jk tkreis gkfr`dis rkant`vis gksti jk r`sdis. Jkst`fn-sk

    n fdkft`vnr uen dieprkkfsi etun k difs`stkftk, uen nbirjngke dikrkftk fn jksdr`i

    jns nt`v`jnjks rkant`vns gksti jk r`sdis k n ut`a`zni jk tkre`fiaig`n uf`cirek jk gksti

    jk r`sdis ke pridkssis k kstruturns pnrn gkrkfd`nr r`sdis.

    Ke 28>2, ci` anfnjn ke pirtugus n firen NBFZ FBR @TI/@KD 4>8>8=28>2 Gksti jk r`sdis

    Zdf`dns pnrn i pridkssi jk nvna`ni jk r`sdis jkvk skr trnbnalnjn ke npi`i firen

    NBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rktr`zks. N firen jksdrkvk ns

    j`vkrsns tdf`dns k ckrrnekftns jk nfa`sk jk r `sdi, cirfkdkfji ir`kftnks sibrk n skaki

    k npa`dni jk tdf`dns s`stket`dns pnrn i pridkssi jk nvna`ni jk r`sdis.

    Kstk grupi jk firens jn sr`k 4>888 v`sn ntkfjkr n qunaqukr t`pi jk neb`kftk jk uen

    irgnf`zni. Xripird`ifne, pirtnfti, uen difdkpi nepan k gkfr`dn jn gksti jk r`sdis,

    skfji npa`dnjns pnrn nvna`nr k trntnr qunaqukr t`pi jk r`sdi dirpirnt`vi. Jurnftk i jkskf-

    viav`ekfti jkstns firens, ci` puba`dnjn ke 288888=2880, k pirtnfti ntkfjk nis skus

    rkqu`s`tis k ni sku pridkssi jk gksti jk r `sdi. N @TI/@KD 2788; cnz pnrtk ji difmufti jk

    firens jn sr`k jk 27888, sibrk i T`stken jk Gksti jk Tkgurnfn jn @fcireni (TGT@),

    ifjk si `fdaujns n`fjn ns firens @TI/@KD 2788> k @TI/@KD 27882. Kstn firen nprkskftn ns

    ekalirks prt`dns k piss`b`a`tn i npricufjnekfti ke nspkdtis kxdaus`vis jn skgurnfn jn

    `fcireni, kfqunfti n @TI 4>888 en`s gkfr`dn k diftkepan tijis is sktirks.

    I kfciquk jkstk dursi kst fn firen NBFZ FBR @TI/@KD 2788;= 288< Zkdfiaig`n

    jn @fcireni Zdf`dns jk Tkgurnfn Gksti jk r`sdis jk skgurnfn jn `fcir-eni. Is difdk`tis, pridkssis k nt`v`jnjks nprkskftnjis sk njkqune ni quk

    pripk n firen NBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rk-

    tr`zks, pijkfji skr npa`dnjis ke qunaqukr iutrn rkn quk fi n jk Z@.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    25/156

    0

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    I qunjri nbn`xi nprkskftn ue rksuei diepnrnt`vi kftrk kstns firens=

    Firen Ztuai Ibmkt`vi Ibskrvni

    2788> Zkdfiaig`n jn fcir-eni Zdf`dns jkskgurnfn T`stkensjk gksti jk skgu-rnfn jn fcireni Rkqu`s`tis

    Kspkd`c`dn is rkqu`s`tis pnrn kstnbkakdkr,`epakekftnr, ipkrnr, eif`tirnr, nfna`snr dr`t`-dnekftk, enftkr k ekalirnr ue TGT@ jidu-ekftnji fi diftkxti jis r`sdis jk fkgd`igaibn`s jn irgnf`zni. Kspkd`c`dn rkqu`s`tispnrn n `epakekftni jk diftriaks jk skgu-rnfn pkrsifna`znjis pnrn ns fkdkss`jnjks`fj`v`jun`s jk irgnf`znks iu jk suns pnrtks.Dibrk tijis is t`pis jk irgnf`zni (keprk-kfj`ekftis diekrd`n`s, ngfd`ns givkrfnekf-tn`s, irgnf`znks ske c`fs audrnt`vis, kftrkj`vkrsns iutrns).

    Zrntn en`s kspkd`c`dn-ekftk jk j`rktr`zksk pr`fdp`is pnrn ues`stken jk gksti jkskgurnfn jn fcir-eni.

    27882 Zkdfiaig`n jn fcir-eni Zdf`dns jkskgurnfn Dj`gi jkprt`dn pnrn n gkstijk skgurnfn jn fcir-eni

    Kstnbkakdk j`rktr`zks k pr`fdp`is gkrn`s pnrn`f`d`nr, `epakekftnr, enftkr k ekalirnr ngksti jk skgurnfn jn `fcireni. Is ibmk-t`vis jkc`f`jis fkstn firen kstnbkakdke j`rk-tr`zks gkrn`s pnrn ns ektns k ekalirks prt`dnspnrn n gksti jn skgurnfn jn `fcireni.

    Siatnjn pnrn diftriaksjk skgurnfn.

    2788; Zkdfiaig`n jn fcir-eni Zdf`dns jkskgurnfn Gkstijk r`sdis jk skgu-rnfn jn `fcireni

    Nprkskftn ue s`stken jk gksti jk r`sdis jkskgurnfn jn `fcireni die cidi ke tkdfi-aig`n jn fcireni.

    Ksdanrkdk diei gkrkf-d`nr r`sdis jk skgu-rnfn jn fcireni.

    4>888 Gksti jk r`sdis Xr`fdp`is k j`rktr`zks

    Firen quk nprkskftn pr`fdp`is k j`rktr`zksbs`dns pnrn n gksti jk r`sdis ke gkrna kequnaqukr t`pi jk neb`kftk.

    Kj`tnjn ke2880, jkstk nfi kej`nftk ns jken`sfirens jk gksti jkr`sdis jkvke kstnrna`flnjns n kan.

    4>8>8 Gksti jk r`sdis Zdf`dns pnrn ipridkssi jk nvna`nijk r`sdis

    Jksdrkvk ns j`vkrsns tdf`dns k ckrrnekftnsjk nfa`sk jk r`sdis.

    Kj`tnjn ke 28>2.

    G[@JK 74 Gksti jk r`sis Sidnbuar`i

    Nprkskftn ns jkc `f`ks jk tkreis gkfr`disrkant`vis gksti jk r`sdis.

    Kj`tnjn ke 2880.

    Firen NBFZ FBR @TI/@KD 2788;=288 Nprkskftn ns j`rktr`zks pnrn i gkrkfd`nekfti jis r`sdis jk skgurnfn jn `fcireni.

    > Keprkgn is difdk`tis jn firen NBFZ FBR @TI 2788>=288;.

    N firen NBFZ FBR @TI/@KD 2788;=288< Zkdfiaig`n jn @fcireni Zdf`dns jk Tkgu-

    rnfn Gksti jk r`sdis jk skgurnfn jn `fcireni ci` puba`dnjn ke muali jk 288< k

    nprkskftn ns j`rktr`zks pnrn i gkrkfd`nekfti jis r`sdis jk skgurnfn jn fcireni.

    Keprkgn is difdk`tis jn firen NBFZ FBR @TI 2788>=288;, quk kspkd`dn is rkqu`s`tis jk

    s`stkens jk gksti jn skgurnfn jn `fcireni.

    Znbkan >.2

    Rksuei

    diepnrnt`vi kftrk

    ns firens.

    http://www.qsp.org.br/siso_27000.shtmlhttp://www.qsp.org.br/siso_27000.shtml
  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    26/156

    >8

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Kstn firen jksdrkvk tiji i pridkssi fkdkssr`i pnrn n gksti jk r`sdis jk skgurnfn jn

    `fcireni k ns nt`v`jnjks fkdkssr`ns pnrn n pkrck`tn kxkdui jn gksti. Nprkskftn pr-

    t`dns pnrn gksti jk r`sdis jn skgurnfn jn `fcireni. Ns tdf`dns fkan jksdr`tns skguke

    i difdk`ti, is eijkais k is pridkssis gaibn`s kspkd`dnjis fn firen NBFZ FBR @TI/@KD

    2788>, nae jk nprkskftnr n ektijiaig`n jk nvna`ni k trntnekfti jis r`sdis rkqukr`jis

    pkan eksen firen.

    Xnrt`fji ji pr`fdp`i jk quk n gksti jk r`sdis ue pridkssi dda`di k diftfui, n firenkst j`v`j`jn ke skssks k nfkxis. Ns skssks difte ns `fcirenks ji pridkssi k jns

    nt`v`jnjks fkdkssr`ns pnrn n sun kxkdui. Kx`stke >2 skssks ni tiji= ns skssks jk >

    n : trntne jns rkckrfd`ns k jn kstruturn jn firen, k ns skssks ; k 3 nprkskftne n v`si

    gkrna ji pridkssi jk gksti jk r`sdis. Ns skssks n pnrt`r jn 7 trntne kspkd`dnekftk ji

    pridkssi jk gksti jk r`sdis. Is sk`s nfkxis si `jkft`dnjis jk N n C k trnzke `fcirenks

    nj`d`ifn`s k kxkepais.

    Fns skssks jk 7 n >2 ns nt`v`jnjks jk gksti si nprkskftnjns jk ndirji die n

    skgu`ftk kstruturn=

    > Kftrnjn= rkckrk-sk nis `fsueis k prke`ssns fkdkssr`ns pnrn n rkna`zni jn nt`v`jnjk.

    > Ni= jksdr`i jn nt`v`jnjk, skeprk ndiepnflnjn ji difve.

    > J`rktr`zks pnrn epakekftni= j`rktr`zks fkdkssr`ns pnrn n rkna`zni jn ni, `sti ,i jktnalnekfti jk diei n ni pijk skr rkna`znjn. Kstns j`rktr`zks jkvke skr njnptnjns

    n dnjn t`pi jk irgnf`zni. Znebe ksti ndiepnflnjns ji difve.

    > Tnjn= nprkskftn is rksuatnjis quk jkvke skr nadnfnjis k quk vi skrv`r pnrn gkrnr kv`jfd`ns.

    Kstk dursi ut`a`zn i pridkssi jk gksti jk r`sdis firent`znji dift`ji fn firen NBFZ FBR

    @TI/@KD 2788;.

    S`si gkrna jn gksti jk r`sdis

    q> fkdkssr`n uen nbirjngke s`stket`dn jk gksti jk r`sdis quk vnr`n jk irgnf`-

    zni pnrn irgnf`zni nss`e diei i fvka jk r`sdi ndk`tvka jk dnjn uen.

    > R`sdi ndk`tvka i grnu jk r`sdi quk n irgnf`zni kst j`spistn n ndk`tnr pnrn dif-drkt`znr is skus ibmkt`vis.

    > Fkdkss`jnjk jk nuekftnr n dnpnd`jnjk jk gkr`r i r`sdi k it`e`znr i rktirfi.

    > N nbirjngke jk gksti jk r`sdis jk skgurnfn jn `fcireni jkvk skr=

    2 Diftfun.

    2 Rkna`znjn fi tkepi npripr`nji.

    2 Rkpkt`t`vn.2 Xrpr`n ni neb`kftk jn irgnf`zni.

    2 Nmustnjn ni pridkssi jk gksti jk r`sdis dirpirnt`vis.

    2 Na`flnjn die is rkqu`s`tis jk fkgd`is.

    2 Npi`njn pkan natn j`rki.

    Gksti jk r`sdis si nt`v `jnjks cirena`znjns k diirjkfnjns pnrn diftrianr k j`r`g`r ue dif-

    mufti jk `fstnanks k pkssins die rkanks k rkspifsnb`a`jnjks, kftrk s` k kxtkrfnekftk,

    fi quk sk rkckrk n r`sdis fis fkgd`is sib n t`dn jn skgurnfn jn `fcireni.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    27/156

    >>

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    Jkf`i ji diftkxti?

    > Nfa`sk/Nvna`ni jk r`sdis?

    > Zrntnekfti ji r`sdi?

    > Ndk`tni ji r`sdi?

    > Dieuf`dni ji r`sdi?

    > Eif`tirnekfti k nfa`sk drt`dn?> D`dai jk ekalir`n diftfun XJDN.

    N Znbkan >.4 eistrn ns pr`fd`pn`s nt`v`jnjks jk gksti jk r`sdis jn skgurnfn jn fcireni.

    Xridkssi ji TGT@ Xridkssi jk gksti jk r`sdis jk skgurnfn jn fcireni

    XANFKMNR

    >Jkc`f`i ji diftkxti>Nfa`sk/Nvna`ni jk r`sdis>Jkc`f`i ji panfi jk trntnekfti ji r `sdi>Ndk`tni ji r`sdi

    K\KD[ZNR @epakekftni ji panfi jk trntnekfti ji r`sdi

    SKR@C@DNR Eif`tirnekfti diftfui k nfa`sk drt`dn jk r`sdis

    NG@REnfutkfi k ekalir`n ji pridkssi jk gksti jk r `sdis jk skgu-rnfn jn `fcireni

    Ke sku a`vri Jksni nis jkusks= n cnsd`fnftk l`str`n ji r`sdi, Xktkr Bkrfstk`f fis prk-

    skftk`n die uen jktnalnjn nfa`sk l`str`dn jn kviaui ji diftriak k prkv`si jis r`sdis

    pkan luenf`jnjk, jksjk n Grd`n nft`gn. Tkgufji i nutir, sieis pissu`jirks jk kakvnji

    pitkfd`na tdf`di pnrn n prkvkfi jns pkrjns k gnflis, eksei quk i diepirtnekfti jis

    ngkftks skmn eprkv`svka. Fns suns pnanvrns= ... ndiftkn i quk ndiftkdkr k npksnr jk tijis

    is fissis ksciris, is skrks luenfis fi pissuke i diflkd`ekfti diepakti sibrk ns ak`s

    quk jkfke n irjke ji eufji ibmkt`vnekftk kx`stkftk. Xirtnfti, i nutir fis jksquna`-

    dn diei prkv`sirks pkrck`tis ji cuturi.

    Bkrfstk`f j`z n`fjn quk ^unfji `fvkst`jirks dieprne nks, d`rurg`ks rkna`zne ipkrn-

    ks, kfgkflk`ris primktne piftks, keprksr`is nbrke skus fkgd`is k piat`dis difdirrke

    n dnrgis kakt`vis, i r`sdi ue pnrdk`ri `fkv`tvka. Diftuji, suns nks rkvkane quk i r`sdi

    fi prkd`sn skr ti tke`ji= nje`f`strnr i r`sdi s`ff`ei jk jksni k ipirtuf`jnjk.

    I r`sdi cnz pnrtk jk fissi dit`j`nfi, jk eiji quk prkd`sneis diflkd-ai pnrn pijkr trnt-

    -ai k jkak kxtrn`r fivns ipirtuf`jnjks.

    `fqukst`ifvka n `epirtfd`n ji pnpka quk n tkdfiaig`n jn `fcireni kxkrdk fn sid`k-

    jnjk pnrn quk kstn nadnfdk skus ibmkt`vis. N `ftkgrni ji neb`kftk tkdfiag`di, dnrndtk-r`znji pkan diepakx`jnjk k `ftkrjkpkfjfd`n, prijuz diftkxtis eu`tns vkzks list`s quk

    prip`d`ne ntnquks dnjn vkz en`s crkqukftks skgurnfn jn `fcireni, kx`g`fji rkspistns

    dnjn vkz en`s rp`jns jns irgnf`znks. N kstk qunjri ve sienr-sk fivns ibr`gnks

    akgn`s, jk pritki jk pr`vnd`jnjk k givkrfnfn dirpirnt`vn, gkrnfji n fkdkss`jnjk jns

    irgnf`znks gkrkfd`nrke en`s kckt`vnekftk sun `fcrnkstruturn jk tkdfiaig`n.

    Xnrn kfcrkftnr kstns fivns neknns k jkenfjns ns irgnf`znks jkvke jkskfviavkr uen

    nt`tujk print`vn, nftkd`pnfji-sk ke diflkdkr suns crnqukzns k vuafkrnb`a`jnjks. @sti pijk

    skr ibt`ji ntrnvs jn njii jk ue pridkssi cirena jk gkrkfd`nekfti jk r`sdis jk skgu-

    rnfn jn `fcireni, quk pkre`tn irgnf`zni kstnbkakdkr ue fvka ndk`tvka jk r`sdi.

    Znbkan >.4

    Xr`fd`pn`s

    nt`v`jnjks jk

    gksti jk r`sdis

    jn skgurnfn jn

    `fcireni.

    Tn`bn en`s

    J`dn jk ak`turn=

    BKRFTZK@F, Xktkr.Jksni nis jkusks= n cns-

    d`fnftk l`str`n ji r`sdi.Kj`tirn Dnepus, >007.

    a

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    28/156

    >2

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Xnrn `ssi fkdkssr`n uen nbirjngke s`stket`dn jk gksti jk r`sdis, quk `r vnr `nr jk

    ndirji die i fkgd`i jk dnjn irgnf`zni, nss`e diei i fvka jk r`sdi ndk`tvka kstnbkak-

    d`ji pkan j`rki jk dnjn irgnf`zni.

    R`sdindk`tvka i grnu jk r`sdi quk n irgnf`zni kst j`spistn n ndk`tnr pnrn n

    difdrkt`zni jis skus ibmkt`vis kstrntg`dis.

    Kxkrdd`i jk c`xni 2kS`si gkrna

    Fn sun irgnf`zni, quna skr`n i r`sdi ndk`tvka fn rkna`zni jns suns nt`v`jnjks9 Kxpa`quk.

    Nuekftnr n dnpnd`jnjk jk gkr`r i r `sdi k it`e`znr i rktirfi si nks `ftkgrnftks jk uen

    nbirjngke s`ste`dn, quk pripird`ifn ue pridkssi cirena pnrn n ekalir`n jn dnpnd`jnjk

    jk `jkft`dnik nvna`ni jis r`sdis. Kstn nbirjngke jkvk kstnr jk ndirji die is ibmk-

    t`vis jn irgnf`zni, ntkfjkfji s suns fkdkss`jnjks kspkddns jk ndirji die is rkqu`-

    s`tis jk skgurnfn jn `fcireni. Xnrn `ssi, n nbirjngke jk gksti jk r`sdis jk skgurnfn

    jn `fcireni jkvk skr=

    > Diftfun?

    > Rkna`znjn fi tkepi npripr`nji?

    > Rkpkt`t`vn?

    > Jk ndirji die i neb`kftk jn irgnf`zni?

    > Nmustnjn ni pridkssi jk gksti jk r`sdis dirpirnt`vis?> Na`flnjn die is rkqu`s`tis jk fkgd`is?

    > Npi`njn pkan natn j`rki.

    Xnrt`fji ji difdk`ti nepai jk quk i pridkssi jk gksti diepisti jk nt`v`jnjks diirjkfnjns

    k cirena`znjns pnrn diftrianr k j`r`g`r uen irgnf`zni cirenjn pir suns `fstnanks k pkssina,

    die rkanks k rkspifsnb`a`jnjks kftrk s` k die ngkftks kxtkrfis , pijk-sk `fckr`r quk n gksti

    jk r`sdis diepistn jk nt`v`jnjks cirena`znjns k diirjkfnjns pnrn diftrianr k j`r`g`r ue

    difmufti jk `fstnanks k pkssins die rkanks k rkspifsnb`a`jnjks, kftrk s` k die i neb`kftk

    kxtkrfi, fi quk sk rkckrk n r`sdis fis fkgd`is sib n t`dn jn skgurnfn jn `fcireni.

    http://pt.shvoong.com/tags/risco/http://pt.shvoong.com/tags/identificar/http://pt.shvoong.com/tags/identificar/http://pt.shvoong.com/tags/risco/
  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    29/156

    >4

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    N C`gurn >.> nprkskftn uen v`si ji pridkssi jk gksti jk r`sdis jk skgurnfn jn fcir-

    eni skgufji n firen NBFZ FBR @TI/@KD 2788;.

    @JKFZ@C@DNI JK R@TDIT

    NFA@TK JK R@TDIT

    NDK@ZNI JI R@TDI

    C@E JN XR@EK@RN I[ JNT JKEN@T @ZKRNKT

    DIE[F@DN

    IKDIFT[AZNJIR@TDI

    EIF@ZIRNEKFZI

    KNFA@TKDRZ@DNJKR@TDIT

    XIFZI JK JKD@TI 2

    Zrntnekfti snt`scntr`i

    XIFZI JK JKD@TI >

    Nvna`ni snt`scntr`n

    Fi

    T`e

    Fi

    T`e

    XRIDKTTI JK NSNA@NI JK R@TDIT

    ZRNZNEKFZI JI R@TDI

    NSNA@NI JK R@TDIT

    JKC@F@I JI DIFZK\ZI

    I pridkssi tke sk`s grnfjks grupis jk nt`v `jnjks=

    > Jkf`i ji diftkxti?

    > Nfa`sk/Nvna`ni jk r`sdis?

    > Zrntnekfti ji r`sdi?

    > Ndk`tni ji r`sdi?

    > Dieuf`dni ji r`sdi?

    > Eif`tirnekfti k nfa`sk drt`dn.

    Diei pijk skr v`sti fn C`gurn >.>, i d`dai jk v`jn jn gksti jk r`sdis jk skgurnfn jn `fcir-

    eni `tkrnt`vi, ifjk n gksti sk jkskfviavk jk enfk`rn `fdrkekftna, ntrnvs jk uen

    sudkssi jk `tkrnks, k dnjn `tkrni a`bkrn uen kftrkgn (snjn) pnrn n skgu`ftk, e`f`e`-

    znfji tkepi k ksciri.

    Jkc`f`i ji diftkxti

    Jkftri ji pridkssi, n jkf`i ji diftkxti rkspifsvka pkan jkf`i ji neb`kftk,

    ksdipi, dr`tr`is jk nvna`ni, kftrk iutrns jkf`ks.

    C`gurn >.>

    Xridkssi jk

    gksti jk r`sdis

    jk skgurnfn jn

    `fcireni.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    30/156

    >:

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Kstn ktnpn ksskfd`na pnrn n kqu`pk quk rkna`zn n gksti jk r `sdi diflkdkr tijns ns `fcir-

    enks sibrk n irgnf`zni.

    Nfa`sk/Nvna`ni jk r`sdis

    N prx`en `tkrni jk nfa`sk k nvna`ni jk r`sdi, quk pkre`t`r n `jkft`dni jis r`sdis

    k n jktkre`fni jns nks fkdkssr`ns pnrn rkjuz`r i r`sdi n ue fvka ndk`tvka.

    Zrntnekfti ji r`sdi

    N pnrt`r jis rksuatnjis ibt`jis fn nfa`sk k nvna`ni ji r`sdi si jkf`jis is diftriaks

    fkdkssr`is pnrn i trntnekfti ji r`sdi. N firen NBFZ FBR @TI/@KD 2788> kspkd`dn is

    diftriaks quk jkvkri skr `epakekftnjis.

    Ndk`tni ji r`sdi

    Nsskgurn is r`sdis ndk`tis pkan irgnf`zni, iu skmn, is r`sdis quk pir nague eit`vi fi

    skri trntnjis iu skri trntnjis pnrd`naekftk. Ti is dlnenjis r`sdis rks`jun`s, dumi

    kfqunjrnekfti fkstn dntkgir`n jkvkr skr must`dnji.

    Dieuf`dni ji r`sdi

    Fkstn ktnpn ck`tn n dieuf`dni ji r`sdi k jn ciren diei skr trntnji, pnrn tijns ns

    rkns ipkrnd`ifn`s k skus gkstirks.

    Eif`tirnekfti k nfa`sk drt`dn

    Ti ns nt`v`jnjks jk ndiepnflnekfti jis rksuatnjis, `epakekftni jis diftriaks k jk

    nfa`sk drt`dn pnrn n ekalir`n diftfun ji pridkssi jk gksti jk r `sdis.

    Zijns kstns ktnpns skri jktnalnjns fns prx`ens skssks.

    N firen NBFZ FBR @TI/@KD 2788> kspkd`dn quk is diftriaks `epakekftnjis fi ksdipi,

    a`e`tks k diftkxti ji T`stken jk Gksti jk Tkgurnfn jn @fcireni (TGT@) jkvke kstnr

    bnsknjis fi r`sdi. Kstk rkqu`s`ti jkvk skr ntkfj`ji ntrnvs jn npa`dni ji pridkssi jk

    gksti jk r`sdis jk skgurnfn jn `fcireni.

    Fi neb`kftk jk ue TGT@, n jkf`i ji diftkxti, n nfa`sk k nvna`ni jk r`sdis, i jkskf-

    viav`ekfti ji panfi jk trntnekfti ji r`sdi k n ndk`tni ji r`sdi cnzke pnrtk jn cnsk Xan-

    fkmnr ji d`dai jk ekalir`n diftfun XJDN. M n cnsk Kxkdutnr ji TGT@ n `epakekftni

    jk diftriaks pnrn difjuz`r is r`sdis ni fvka ndk`tvka pkan irgnf`zni. N cnsk Skr`dnr

    ji TGT@, pir sun vkz , `fdau` ns nks jk rkv`si. C`fnaekftk, n cnsk Ng`r dieprkkfjk ns

    nks fkdkssr`ns pnrn kxkdui, `fdau`fji n rknpa`dni ji pridkssi jk gksti jk r`sdis jk

    skgurnfn jn `fcireni.

    Xijkeis rksue`r jn skgu`ftk ciren ns pr`fd`pn`s nt`v`jnjks jk Gksti jk r`sdis jk skgu-rnfn jn fcireni=

    Xridkssi ji TGT@ Xridkssi jk gksti jk r`sdis jk skgurnfn jn fcireni

    XANFKMNR

    Jkc`f`i ji diftkxti

    Nfa`sk/Nvna`ni jk r`sdis

    Jkc`f`i ji panfi jk trntnekfti ji r `sdi

    Ndk`tni ji r`sdi

    K\KD[ZNR @epakekftni ji panfi jk trntnekfti ji r`sdi

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    31/156

    >;

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    Xridkssi ji TGT@ Xridkssi jk gksti jk r`sdis jk skgurnfn jn fcireni

    SKR@C@DNR Eif`tirnekfti diftfui k nfa`sk drt`dn jk r`sdis

    NG@REnfutkfi k ekalir`n i pridkssi jk Gksti jk R`sdis jk Tkgu-rnfn jn @fcireni

    Enfutkfik ekalir`nji pridkssi

    Eif`tirnekftik nfa`skdrt`dn

    @epakekftnri panfi jktrntnekfti

    Ndk`tniji r`sdi

    Jkf`iji panfi jktrntnekfti

    Nfa`sk/Nvna`nijk r`sdis

    Jkf`iji diftkxti

    NG@R

    XANFKMNR

    XANFK

    MNR

    XA

    NFKMN

    R

    XANFKMNR

    K\KD

    [ZNR

    SKR

    @C

    @DNR

    Kxkrdd`i jk c`xni 4kXJDN

    Kxpa`quk diei n cnsk panfkmnr (XJDN) ji pridkssi ji TGT@ kxkdutnji fi pridkssi jk

    gksti jk r`sdis jk skgurnfn jn `fcireni.

    Cntirks drt`dis pnrn i sudkssi

    q>Rkjui jns surprksns ipkrnd`ifn`s k prkmuzis.

    > @jkft`dni jk ipirtuf`jnjks jk drksd`ekfti k ekalir`ns.

    > Rnd`ifna`zni ji dnp`tna kstnbkakdkfji uen irjke jk pr`ir`jnjks jk `fvkst`ekfti.

    > Xr-nt`v`jnjk die i usi jis rkdursis dieputnd`ifn`s fis fkgd`is.

    > Kfviav`ekfti k pnrt`d`pni jn natn j`rki fi pridkssi.> Dieuf`dni k trk`fnekfti.

    > Jkf`i jk ibmkt`vis.

    > Xnp`s k rkspifsnb`a`jnjks jkf`jis.

    > @ftkgrni die ns nt`v`jnjks jk gksti jk skgurnfn jn `fcireni.

    C`gurn >.2

    Xridkssi jk gksti

    jk r`sdis k i

    eijkai XJDN.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    32/156

    >3

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    N gksti jk r `sdis jk skgurnfn jn `fcireni `epakekftnjn pkans irgnf`znks fn

    busdn pir vnftngkfs diepkt`t`vns pnrn is fkgd`is. cufjnekftna jkeifstrnr, pnrn ns

    pnrtks `ftkrkssnjns, uen pisturn jk skgurnfn fn gksti jis r`sdis rkand`ifnjis pri-

    tki jis nt`vis k `fcirenks.

    Is cntirks drt`dis pnrn i sudkssi ksti rkand`ifnjis nis bkfkcd`is quk jkvke skr nadnf-

    njis pkans irgnf`znks, n jkpkfjkr jn fnturkzn jk dnjn irgnf`zni. Xnrn nt`fg`r tn`s

    bkfkcd`is prkd`si rkna`znr ns ktnpns quk kfviavke is cntirks drt`dis pnrn i sudkssi.Diei kxkepais jkstks cntirks pijkeis ekfd`ifnr is a`stnjis n skgu`r.

    Kfviav`ekfti k pnrt`d`pni jn natn j`rki fi pridkssi

    ksskfd`na pnrn i sudkssi jk qunaqukr primkti quk n j`rki kstkmn kfviav`jn k diepriekt`jn

    die i sku jkskfviav`ekfti k sudkssi jk ndirji die is ibmkt`vis kstrntg`dis jkf`jis.

    Dieuf`dni k trk`fnekfti

    Ziji i pridkssi prkd`sn skr dieuf`dnji n tijns ns pnrtks kfviav`jns nftks ji sku fd`i,

    jurnftk i sku jkskfviav`ekfti k nps sun difdausi, die n nprkskftni jis rksuatnjis

    nadnfnjis k ektns nt`fg`jns. Ke ue pridkssi jk gksti jk r `sdis tijis is pnrt`d`pnftks

    jkvke skr kfviav`jis, k pnrn `ssi fkdkssr`n n rkna`zni jk dnepnflns jk difsd`kft`-

    zni k trk`fnekftis.

    Jkc`f`i jk ibmkt`vis

    I kstnbkakd`ekfti jk ibmkt`vis diftr`bu` jkd`s`vnekftk die i nadnfdk jns ektns jn gksti

    jk r`sdis.

    Xnp`s k rkspifsnb`a`jnjks jkc`f`jns

    Zijis is `ftkgrnftks jns pnrtks kfviav`jns jkvke diflkdkr ns suns ntr`bu`ks k rkspifsn-

    b`a`jnjks jurnftk tiji i pridkssi jk gksti jk r`sdis jk skgurnfn jn `fcireni.

    @ftkgrni die n gksti jk skgurnfn jn `fcireni

    Ns nt`v`jnjks jk gksti jk r`sdis jkvke kstnr titnaekftk `ftkgrnjns s nt`v`jnjks ji TGT@.

    Fi jkskfviav`ekfti jkstk dursi skri kxpairnjis is cntirks dr t`dis jk sudkssi pkrtkf-

    dkftks n dnjn ktnpn jn gksti jk r`sdis jk skgurnfn jn `fcireni.

    rkns jk diflkd`ekfti fkdkssr`ns

    qIs priss`ifn`s kfviav`jis fns nt`v`jnjks jk nfa`sk jk r`sdi pissuke ue pkra diediflkd`ekfti ke j`vkrsns rkns=

    > Zdf`di.

    > Fkgd`is.

    > Akg`sani.

    > Xridkssis.

    Xnrn n ekalir npa`dni ji pridkssi jk gksti jk r`sdis, `epirtnftk quk is priss`ifn`s

    kfviav`jis pissune ue pkra die diflkd`ekfti jk rkns j`vkrsns, pkre`t`fji n `jkft`-

    dni jns neknns k vuafkrnb`a`jnjks ke qunaqukr neb`kftk irgnf`znd`ifna.

    Fn kqu`pk kfdnrrkgnjn jn rkna`zni jn nfa`sk jk r`sdi prkckrkfd`naekftk jkvke skr

    kfdiftrnjis is skgu`ftks pkrs=

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    33/156

    >7

    Dnptuai

    >-@ftrijuiGkstijkR`sdis

    > Zdf`di= diftr`bu` fi ntkfj`ekfti jns jkenfjns jns j`vkrsns rkns tdf`dns jn irgnf`-zni, `fdau`fji ns rkns jk lnrjwnrk, sictwnrk, s`stkens ipkrnd`ifn`s, `fcrnkstruturn k

    npa`dnks wkb, kftrk iutrns.

    > Fkgd`is= nux`a`n n kqu`pk fi kftkfj`ekfti prkd`si jis fkgd`is jn irgnf`zni k skuseat`pais pridkssis, nae jk tkr `epirtfd`n fi daduai jis `epndtis.

    > Akg`sani= pkra viatnji ni kftkfj`ekfti jis nspkdtis akgn`s k firent`vis die isqun`s n irgnf`zni nfna`snjn fkdkss`tn sk na`flnr.

    > Xridkssis= pkre`tk n dieprkkfsi jis pridkssis k ntrnvs jk sun nfa`sk `jkft`dn pis-svk`s neknns k vuafkrnb`a`jnjks, diftr`bu`fji die n kanbirni jk panfis jk gksti k

    trntnekfti jk r`sdis.

    Kstks si nagufs kxkepais jk pkrs iu diflkd`ekftis fkdkssr`is pnrn n nfa`sk jk r`sdi.

    I t`pi jn irgnf`zni k skus ibmkt`vis jk fkgd`is `fj`dnri is pkrs rknaekftk `epirtnftks

    pnrn diepir n kqu`pk jk trnbnali. Fi kx`stk n fkdkss`jnjk jk ue priss`ifna pnrn dnjn

    pkra d`tnji, pi`s is diflkd`ekftis pijke skr kfdiftrnjis ke ue eksei priss`ifna.

    N qunft`jnjk jk priss`ifn`s naidnjis skr jktkre`fnjn pkai ksdipi jn nfa`sk k prnzi.

    Ak`turn diepakekftnr

    > Tkssks :, ; k 3 jn firen NBFZ FBR @TI/@KD 2788;.

    > @tke : jn Firen Diepakekftnr Gksti jk R`sdis jk Tkgurnfn jn @fcireni k Dieuf`-dnks GRT@D, ji JT@D/GT@/XR= lttp=//js`d.panfnati.giv.br/jiduekftis/fdY8:Ygrs`d.pjc

    > Kftkrpr`sk R`so Enfngkekft= Xnst, Xrkskft nfj Cuturk=lttp=//www.dnsndt.irg/kjudnt`if/kre/288:/lnfjiuts/oaienf.pjc

    > @ftkrj`sd`pa`fnry R`so Enfngkekft=lttp=//www.r`so`fci.die/rer/rermuf8;.lte

    > ^untri j`dns pnrn uen gksti jk r `sdis kd`kftk=lttp=//d`i.uia.die.br/gkstni/2880/87/84/quntri-j`dns-pnrn-n-bin-gkstni-jk-r`sdis/

    > NT/F]T :438=lttp=//www.stnfjnrjs.irg.nu/

    > L`str`n jn NT/F]T :438=lttp=//www.r`so`fci.die/rer/rerskpt88.lte

    http://dsic.planalto.gov.br/documentos/nc_04_grsic.pdfhttp://www.casact.org/education/erm/2004/handouts/kloman.pdfhttp://www.riskinfo.com/rmr/rmrjun05.htmhttp://cio.uol.com.br/gestao/2009/07/03/quatro-dicas-para-a-boa-gestao-de-riscos/http://www.riskinfo.com/rmr/rmrsept00.htmhttp://www.riskinfo.com/rmr/rmrsept00.htmhttp://cio.uol.com.br/gestao/2009/07/03/quatro-dicas-para-a-boa-gestao-de-riscos/http://www.riskinfo.com/rmr/rmrjun05.htmhttp://www.casact.org/education/erm/2004/handouts/kloman.pdfhttp://dsic.planalto.gov.br/documentos/nc_04_grsic.pdf
  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    34/156

    >0

    Dnptuai

    >-Ritk`rijkNt`v`jnjks

    Ritk`ri jk Nt`v`jnjks >

    Nt`v`jnjk >.> Diflkdkfji is difdk`tis

    Xnrn dnjn difdk`ti n skgu`r, kxpa`quk k nprkskftk ue kxkepai bnsknji fn irgnf`zni kequk vid trnbnaln. Must`quk sun rkspistn=

    Difdk`ti Jkc`f`i Kxkepai Must`c`dnt`vn

    R`sdis jk skgurnfnjn `fcireni

    @jkft`c`dni jk r`sdis

    @epndti

    Diepnrt`alnekfti jir`sdi

    Kv`tnr i r`sdi

    Dieuf`dni ji r`sdi

    Kst`ent`vn ji r`sdi

    Zrntnekfti ji r`sdi

    Ndk`tni ji r`sdi

    Nt`v`jnjk >.2 Diflkdkfji n firen

    Jksdrkvn diei kst irgnf`znjn n firen NBFZ FBR @TI/@KD 2788;, d`tnfji suns skssks.

    Kxpa`quk diei ksti kstruturnjns ns nt`v `jnjks jns skssks 7 n >2 jn firen

    NBFZ FBR @TI/@KD 2788;.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    36/156

    28

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Nt`v`jnjk >.4 @jkft`c`dnfji i pridkssi

    Jksdrkvn n skqufd`n jns ktnpns ji pridkssi jk gksti jk r`sdis.

    Nt`v`jnjk >.: Cntirks drt`dis

    I quk n gksti jk r`sdis jk skgurnfn jn `fcireni k diei kan sk npa`dn fn sun irgnf`zni9

    ^un`s si is cntirks dr t`dis jk sudkssi9 J kxkepais bnsknjis fn sun irgnf`zni.

    Ke sun ip`f`i quna n `epirtfd`n jk kftkfjkreis n gksti jk r`sdi pnrn i kxkrdd`i jns

    fissns nt`v`jnjks dit`j`nfns9

    I quk ci` nprkfj`ji

    q> Difdk`ti jk gksti jk r`sdi.> S`si gkrna jn gksti jk r`sdi.> Cntirks drt`dis jk sudkssi.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    37/156

    2>

    Dnptuai

    2-Diftkxtijngkstijkr`sd

    is

    ibmkt`vis

    difdk`tis

    2Diftkxti jn gksti jk r`sdis

    Difdk`tunr k jkf`r i diftkxti ji neb`kftk jn gksti jk r`sdis? `jkft`dnr i ksdipi

    k ns nt`v`jnjks jk jkf`i jk dr`tr`is fi pridkssi jk gksti jk r`sdis.

    Diftkxti, ksdipi, a`e`tks k dr`tr`is.

    @ftrijui

    Ni `f`d`nr qunaqukr t`pi jk trnbnali, n pr`ek`rn nt`v`jnjk n skr ck`tn diflkdkr i neb`kftk ke

    quk i trnbnali skr jkskfviav`ji, ns pkssins quk jk naguen ciren `ri `ftkrng`r, i quk skr

    jkskfviav`ji? ke rksuei, diflkdkr i tkrrkfi pnrn snbkr difjuz`r i nfjnekfti jis trnbnalis.

    Fns nt`v`jnjks quk kfviavke gksti jk r`sdis jk skgurnfn jn `fcireni n jkf`i ji dif-

    tkxti n pnrtk `f`d`na k tke diei ibmkt`vi pkre`t`r i diflkd`ekfti ji neb`kftk jn irgnf`zni.

    Kxkrdd`i jk f`vkanekfti >kDiftkxtiFi sku kftkfj`ekfti quna i diftkxti ntuna jn sun irgnf`zni9

    Xridkssi jk gksti jk r`sdis jk skgurnfn jn `fcireni q> Diflkdkr n skqufd`n jns cnsks jn gksti jk r`sdis.> Zkr ndkssi n tijn n jiduekftni jn irgnf`zni.

    Fn skssi nftkr`ir ci` nprkskftnjn n v`si gkrna ji pridkssi jk gksti jk r`sdis. fkdks-

    sr`i quk i diflkd`ekfti jn skqufd`n jns cnsks ji pridkssi cnn pnrtk ji j`n n j`n jis

    priss`ifn`s kfviav`jis die n gksti jk r`sdis.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    38/156

    22

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    @JKFZ@C@DNI JK R@TDIT

    NFA@TK JK R@TDIT

    NDK@ZNI JI R@TDI

    C@E JN XR@EK@RN I[ JNT JKEN@T @ZKRNKT

    DI

    E[F@DNIKDIFT[AZNJIR@TDI

    EIF@Z

    IRNEKFZIKNFA@TKDRZ@DNJKR@TDIT

    XIFZI JK JKD@TI 2

    Zrntnekfti snt`scntr`i

    XIFZI JK JKD@TI >

    Nvna`ni snt`scntr`n

    Fi

    T`e

    Fi

    T`e

    XRIDKTTI JK NSNA@NI JK R@TDIT

    ZRNZNEKFZI JI R@TDI

    NSNA@NI JK R@TDIT

    JKC@F@I JI DIFZK\ZI

    Xnrn rkna`znr kstn nt`v`jnjk, is priss`ifn`s jkvkri tkr ndkssi n tijn jiduekftni sibrk n

    irgnf`zni, pkre`t`fji nss`e i nepai diflkd`ekfti sibrk ns kspkd`d`jnjks jn irgnf`zni.

    Diftkxti

    fkdkssr`i kftkfjkr i s`gf`dnji difdk`tuna jk diftkxti k sun npa`dni fn gksti jk

    r`sdis. Ni busdnr i sku s`gf`dnji fis j`d`ifr`is, kfdiftrn-sk, kftrk iutrns jkf`ks,

    quk diftkxti ue substnft`vi ensdua`fi quk s`gf`dn `ftkr-rkani jk d`rdufstfd`ns quk

    ndiepnflne ue cnti iu uen s`tuni.

    Nss`e, ni fis rkckr`reis n diftkxti qukrkeis fn vkrjnjk trntnr jn titna`jnjk jk d`rdufstf-

    d`ns quk piss`b`a`tne, difj`d`ifne iu jktkre`fne n rkna`zni jk ue tkxti, primkti, nt`v`-jnjk iu eksei jk ue kvkfti jk skgurnfn jn `fcireni. Ke iutrns pnanvrns, diftkxti i

    difmufti jk d`rdufstfd`ns quk sk rkand`ifne jk naguen ciren die ue jktkre`fnji ndiftkd`-

    ekfti. n s`tuni gkrna iu i neb`kftk n quk kst skfji rkckr`ji ue jktkre`fnji nssufti.

    Dlneneis jk diftkxtuna`zni n nt`v`jnjk jk enpknr tiji i neb`kftk quk kfviavk

    i kvkfti ke nfa`sk. Fi pridkssi jk gksti jk r`sdis kstn n pr`ek`rn nt`v`jnjk n

    skr jkskepkflnjn.

    C`gurn 2.>

    Jkf`i jidiftkxti.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    39/156

    24

    Dnptuai

    2-Diftkxtijngkstijkr`sd

    is

    Tkgufji n firen NBFZ FBR @TI 4>888=2880 i diftkxti pijk skr nfna`snji sib ji`s nspkdtis=

    q> Diftkxti Kxtkrfi= i neb`kftk kxtkrfi fi quna n irgnf`zni sk s`tun k busdn nt`fg`rskus ibmkt`vis (neb`kftk duaturna, fnfdk`ri, rkguantr`is, tkdfiag`di, kdife`di,

    diepkt`t`vi, kftrk iutris).

    > Diftkxti @ftkrfi= i neb`kftk `ftkrfi fi quna n irgnf`zni busdn nt`fg`r skus

    ibmkt`vis (givkrfnfn, kstruturn irgnf`znd`ifna, piat`dns, ibmkt`vis, dnpnd`jnjks,s`stkens jk `fcireni, duaturn irgnf`znd`ifna, firens, j`rktr`zks, kftrk iutrns).

    Kstnbkakd`ekfti ji diftkxti

    qJk ndirji die n firen NBFZ FBR @TI/@KD 4>888, fi eiekfti ke quk n irgnf`znikstnbkakdk sku diftkxti kan=

    > Nrt`duan skus ibmkt`vis.

    > Jkfk pnrektris `ftkrfis k kxtkrfis.

    > Jkfk i ksdipi k is dr`tr`is jk r `sdi pnrn tiji i pridkssi jk gksti jk r`sdis.

    Jk ndirji die n firen NBFZ FBR @TI/@KD 4>888, fi eiekfti quk n irgnf`zni kstnbk-akdk sku diftkxti kan nrt`duan skus ibmkt`vis, jkf`fji pnrektris `ftkrfis k kxtkrfis quk

    jkvke skr akvnjis ke difs`jkrni pnrn gkrkfd`nr i r`sdi, k jkfk i ksdipi k is dr`tr`is

    jk r`sdi pnrn tiji i pridkssi jk gksti jk r `sdis.

    Diftkxti jn firen NBFZ FBR @TI/@KD 2788;

    qTki 7 jn NBFZ FBR @TI/@KD 2788;= trntn ns nt`v`jnjks jkskfviav `jns jurnftk n cnskjk diftkxti jn gksti jk r`sdis.

    > Nprkskftnks jn irgnf`zni.

    > Kftrkv`stns.

    > ^ukst`ifr`is=

    2 Tki 7.> Difs`jkrnks `f`d`n`s.

    2 Tki 7.2 Dr`tr`is bs`dis.

    2 Tki 7.4 Ksdipi k a`e`tks.

    2 Tki 7.: Irgnf`zni pnrn gksti jk r`sdis jk skgurnfn jn `fcireni.> Nfkxi N @fcirent`vi.

    N ski 7 jn firen NBFZ FBR @TI/@KD 2788; trntn jns nt`v`jnjks quk jkvke skr jkskf-

    viav`jns jurnftk n cnsk jk diftkxti jn gksti jk r`sdis. Kssns nt`v`jnjks jkvke skr

    jkskfviav`jns pkan kqu`pk rkspifsvka pkan gksti jk r `sdis, skfji rkna`znjns pir ek`i jk`ftkrnks die is priss`ifn`s jn irgnf`zni nvna`njn ntrnvs jk=

    > Nprkskftnks jn irgnf`zni?

    > Kftrkv`stns die j`rktirks, gkrkftks, tdf`dis k usur`is?

    > ^ukst`ifr`is.

    N ski 7 jkstn firen kst irgnf`znjn jn skgu`ftk ciren=

    > Tki 7.> Difs`jkrnks `f`d`n`s= fna`jnjk jk rkna`znr n diftkxtuna`zni?

    > Tki 7.2 Dr`tr`is bs dis= dr`tr`is jk nvna`ni?

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    40/156

    2:

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    > Tki 7.4 Ksdipi k a`e`tks= `epirtfd`n jn jkf`i ji ksdipi k is a`e`tks jn gkstijk r`sdis?

    > Tki 7.: Irgnf`zni pnrn gksti jk r`sdis jk skgurnfn jn `fcireni= irgnf`znik rkspifsnb`a`jnjks ji pridkssi jk gksti jk r`sdis?

    > Nfkxi N @fcirent`vi= jktnalks pnrn n jkf`i ji ksdipi k rkstr`ks quk pijke`epndtnr fis trnbnalis.

    Jkc`f`fji i diftkxti

    q> Tupirtk n TGT@.> Difcire`jnjk akgna.

    > Xanfi jk dift`fu`jnjk jk fkgd`is.

    > Xanfi jk rkspistn n `fd`jkftks.

    Ni `f`d`nr i trnbnali jk gksti jk r`sdis jkvk-sk pr`ek`rnekftk cnzkr ue akvnftnekfti jk

    tijns ns fcirenks rkakvnftks sibrk i neb`kftk ifjk skr kxkdutnjn n nfa`sk jk r`sdis.

    Jkvk kstnr danri n`fjn i kftkfj`ekfti sibrk ns nt`v `jnjks jn irgnf`zni k is prips`tis

    quk n akvnrne gksti jk r`sdis jk skgurnfn jn `fcireni.

    Ti kxkepais jkstks prips`tis=

    > Tupirtk n TGT@= n irgnf`zni iptiu pir `epakekftnr ue TGT@ k pnrn `ssi jkvk rkna`znrn gksti jk r`sdi jk skgurnfn jn `fcireni diei rkqu`s`ti ibr`gntr`i.

    > Difcire`jnjk akgna= ntkfj`ekfti n uen jktkre`fni akgna iu firent`znjirn.Kx= bnfdis, ipkrnjirns jk dnrti jk drj`ti.

    > Xanfi jk Dift`fu`jnjk jk Fkgd`is= fkdkssr`i pnrn n prkpnrni ji panfi quk v`snkstruturnr i eiji diei n irgnf`zni kfcrkftnr ue kvkfti dntnstrdi. Xnrn quk fi

    idirrn ue `epndti s`gf`dnt`vi ni fkgd`i fkdkssr`n n rkna`zni ji pridkssi jk

    gksti jk r`sdis.> Xanfi jk rkspistn n fd`jkftks= pnrn quk n irgnf`zni pissn tkr sku panfi jk rks-

    pistns n `fd`jkftks fkdkssr`i i diflkd`ekfti jk skus r`sdis k vuafkrnb`a`jnjks.

    Jk eiji gkrna, i kftkfj`ekfti jis prips`tis jn `epanftni jn gksti jk r`sdis piss`b`-

    a`tn uen v`si jn `epirtfd`n jkstn nt`v`jnjk pnrn is fkgd`is jn irgnf`zni. Fn firen

    NBFZ FBR @TI/@KD 2788; i prips`ti cnz pnrtk jns j`rktr`zks pnrn `epakekftni jn nt`v `-

    jnjk jk jkf`i ji diftkxti= v`jk 7.> Difs`jkrnks gkrn`s.

    @tkfs pnrn `jkft`c`dni

    Ni nfna`snr i neb`kftk jn irgnf`zni, n kqu`pk jk nfna`stns jkvk `jkft`dnr is kakekftis

    quk dnrndtkr`zne n irgnf`zni k diftr`buke pnrn i sku jkskfviav`ekfti. Fn nfa`sk jnirgnf`zni jkvke difstnr pkai ekfis is skgu`ftks `tkfs=

    @tkfs pnrn jkft`c`dni Kxkepai jk qukst`ifnekftis

    Xrips`ti pr`fd`pna jnirgnf`zni

    ^una n c`fna`jnjk jn keprksn9 un`s skus ibmkt`vis9

    I fkgd`i ^una i sku fkgd`i9 ^una n c`fna`jnjk ji quk prijuz`ji / jkskfviav`ji9

    N e`ssi ^una n sun e`ssi9 Xnrn quk kan kx`stk9 I quk kan sk pripk n cnzkr9 Xnrn quke9

    Znbkan 2.>@tkfs pnrn nfa`sk

    jn irgnf`zni.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    41/156

    2;

    Dnptuai

    2-Diftkxtijngkstijkr`sd

    is

    @tkfs pnrn jkft c`dni Kxkepai jk qukst`ifnekftis

    N v`si jk cuturi ^una sun v`si jk cuturi9 I quk sk kspkrn jkan fi tkepi9

    Is vnairks ^un`s is skus vnairks9 Diei kaks si kv`jkfd`njis9

    N kstruturn irgnf`znd`ifnaDiei kan kst irgnf`znjn k kstruturnjn9 K n skgurnfn jns `fcirenks9K ns rkspifsnb`a`jnjks pkan skgurnfn9

    I irgnfigrnen^una i sku irgnfigrnen9 ^uke quke k ke quk sktir trnbnaln9L rkn jk skgurnfn jn `fcireni9

    Ns kstrntg`ns ^un`s si ns suns pr`fd`pn`s kstrntg`ns jk fkgd`is9 K jk skgurnfn jn `fcireni9

    Is prijutis ^un`s si is skus prijutis9 ^una i pr`fd`pna prijuti jk nanvnfdngke jis fkgd`is9

    Is pnrdk`ris^uke si skus pnrdk`ris9 Diei si ksdial`jis9 Diei diftr`buke9 Diei irkand`ifnekfti jn skgurnfn jn fcireni die kaks9 un`s ns ibr`gnks jnskgurnfn jn fcireni9

    Is tkrdk`ris^uke si is tkrdk`ris9 Diei si ksdial`jis9 Diei diftr`buke9 Diei i rkan -d`ifnekfti jn skgurnfn jn `fcireni die kaks9 Diei i diftrnti9 ^un`s nsibr`gnks jn skgurnfn jn fcireni9

    Ns `fstnanksDiei kst j`v`j`jn n irgnf`zni9 Ifjk ksti is skrv`jirks9 L nague ekdnf`seijk prkvkfi jk `fdfj`i9 Diei ck`tn n pritki cs`dn9 Diei si is ndkssis9

    Is cufd`ifr`isDiei si diftrntnjis9 L trk`fnekfti jk skgurnfn jn fcireni9Diei si diftrntnjis9

    Kxkrdd`i jk c`xni >kJkc`f`fji i diftkxti

    ^una n fna`jnjk jn sun irgnf`zni9 Kxpa`quk.

    ^una jkvk skr ue jis prips`tis quk jkvke akvnr n gksti jk r`sdis jk skgurnfn jn `fcir-eni fn sun irgnf`zni9 Must`quk.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    42/156

    23

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Jkc`f`fji ksdipi k a`e`tks

    q> Ksdipi jksdr`i jis a`e`tks ji primkti, sun nbrnfgfd`n, skus rksuatnjis kkftrkgns. n fna`jnjk jn gksti jk r`sdis.

    > Jkvke skr difs`jkrnjis=

    2 Is ibmkt`vis k piat`dns jn irgnf`zni.2 Kstruturn k cufks jn irgnf`zni.

    2 Xridkssis jk fkgd`is.

    2 Nt`vis.

    2 Kxpkdtnt`vns.

    2 Rkstr`ks.

    > Ns rkstr `ks ncktne n irgnf`zni k jktkre`fne i j`rkd`ifnekfti jn skgurnfnjn fcireni.

    > Naguens jkstns rkstr `ks pijke dnusnr `epndtis fi ksdipi k n kqu`pk tke qukkstnr prkpnrnjn pnrn `jkft`d- ans k jktkre`fnr n `fufd`n quk tkri fi ksdipi.

    Kxkepais jk rkstr`ks=

    2 Rkstr`ks tdf`dns.

    2 Rkstr`ks fnfdk`rns.

    2 Rkstr`ks neb`kftn`s.

    2 Rkstr`ks tkepirn`s (tkepi ue cntir jktkre`fnftk).

    2 Rkstr`ks irgnf`znd`ifn`s.> I nfkxi N jn firen NBFZ FBR @TI/@KD 2788; nprkskftn k jktnaln kstns rkstr`ks.

    > Kxkepais jk ksdipi k a`e`tks=

    2 [en npa`dni jk Z@.

    2 N `fcrnkstruturn jk Z@.

    2 [e pridkssi jk fkgd`i.

    2 I jkpnrtnekfti jk Z@.

    2 [en a`na.

    2 I s`stken jk `ftkrfkt bnfo`fg jk uen `fst `tu`i fnfdk`rn.

    2 I skrv`i jk k-en`a jn irgnf`zni.

    2 I pridkssi jk diftriak jk ndkssi cs`di jn irgnf`zni.

    2 I jntndkftkr jn irgnf`zni.

    2 N `fcrnkstruturn quk ntkfjk nis skrv `is NJTA jk uen ipkrnjirn.2 I skrv`i jk dnaadkftkr.

    2 I s`stken aigst`di jk j`str`bu`i jk privns jk difdursi pba`di fnd`ifna.

    2 N `ftrnfkt jn irgnf`zni.

    Xnrn a`jnr die n diepakx`jnjk jn jkf`i ji ksdipi, rkdiekfjvka ksdrkv-an

    pir tp`dis, tkfji n dkrtkzn jk quk tijis is piftis cirne `fdaujis k quk fi

    kx`stke jv`jns, pr`fd`pnaekftk kftrk i kftkfj`ekfti jn kqu`pk jk gksti jk

    r`sdis k n irgnf`zni.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    43/156

    27

    Dnptuai

    2-Diftkxtijngkstijkr`sd

    is

    `epirtnftk quk n irgnf`zni jkfn i ksdipi k is a`e`tks jn gksti jk r`sdis jk skgurnfn

    jn `fcireni. Ens i quk ksdipi9

    Ksdipi n enfk`rn diei si jksdr `tis is a`e`tks ji primkti, sun nbrnfgfd`n, skus rksua-

    tnjis k suns kftrkgns. n fna`jnjk, i navi, i `ftkfti iu prips`ti jn gksti jk r `sdis. Tk

    i ksdipi cir fkbuaisi, iu jk`xnr enrgke pnrn `ftkrprktni, skr j`cd`a pnrn n kqu`pk jk

    gksti jk r`sdis `jkft`dnr is a`e`tks ji sku trnbnali. Xirtnfti, i ksdipi jkvk skr danri,

    bke jkf`ji k kftkfj`ji pkan kqu`pk jk trnbnali k pkan irgnf`zni. Jkstn ciren, diei ksdipi k is a`e`tks `jkft`dnjis, n kqu`pk jk nfa`sk k n irgnf`zni kstnri nptis n

    akvnftnr is nt`vis, pkssins, pridkssis k `fstnanks quk skri kfviav`jns fn nt`v`jnjk jk

    nfa`sk k nvna`ni jis r`sdis.

    Ni jkf`r i ksdipi, n irgnf`zni jkvkr akvnr ke diftn is ibmkt`vis quk jkvke skr nadnfnjis

    die n nfa`sk/nvna`ni (prips`tis). Xnrn ssi jkvke skr difs`jkrnjis=

    > Is ibmkt`vis k piat`dns jn irgnf`zni?

    > Kstruturn k cufks jn irgnf`zni?

    > Xridkssis jk fkgd`is?

    > Nt`vis?> Kxpkdtnt`vns?

    > Rkstr`ks.

    `epirtnftk difs`jkrnr ns rkstr`ks quk ncktne n irgnf`zni k jktkre`fne i j`rkd`ifn-

    ekfti jn skgurnfn jn `fcireni. Naguens jkstns rkstr`ks pijke dnusnr `epndtis fi

    ksdipi, jk eiji quk n kqu`pk prkd`sn kstnr prkpnrnjn pnrn `jkft`d-ans k jktkre`fnr n

    `fufd`n quk tkri fi ksdipi. Nagufs kxkepais jk rkstr`ks=

    > Rkstr`ks tdf`dns?

    > Rkstr`ks fnfdk`rns?

    > Rkstr`ks neb`kftn`s?> Rkstr`ks tkepirn`s (tkepi ue cntir jktkre`fnftk)?

    > Rkstr`ks irgnf`znd`ifn`s.

    Kx`stke eu`tns iutrns rkstr`ks, quk `ri vnr`nr ke cufi ji t`pi iu ji fkgd`i jn irgn-

    f`zni, nss`e diei tnebe `r vnr`nr n `fufd`n jkstns rkstr`ks fn gksti jk r`sdis.

    I nfkxi N jn firen NBFZ FBR @TI/@KD 2788;nprkskftnk jktnaln kstns rkstr`ks, skfji

    uen ak`turn ibr`gntr`n pnrn ue ekalir kftkfj`ekfti. Kstks si npkfns nagufs kxkepais

    bke ibmkt`vis. prkd`si nvna`nr n diepakx`jnjk ji ksdipi k cnzkr ue jktnalnekfti jis

    skus ibmkt`vis, pnrn quk fi lnmn jv`jn n rkspk`ti jn sun nepa`tujk.

    Kxkrdd`i jk c`xni 2kJkc`f`fji i ksdipi k a`e`tks

    ^un`s prips`tis jkvke skr difs`jkrnjis fn sun irgnf`zni pnrn jkf`i ji ksdipi9

    Must`quk.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    44/156

    2 Is dr`tr`is cnzke pnrtk ji etiji jn gksti jk r`sdis.> Is dr`tr`is si n ciren k i vnair (pksis) die quk is r`sdis k `epndtis skri vnairnjis.

    N pnanvrn dr`tr`i, ji grkgi or`tr`ifpkai ant`e dr`tr`i, s`gf`dn kstnbkakdkr ue pnjri quk

    skrvk jk bnsk pnrn quk di`sns k pkssins pissne skr diepnrnjns k muagnjns.

    Is dr`tr`is pnrn nvna`ni jk r`sdis skrvke pnrn nvna`nr is r`sdis jk skgurnfn k

    jkvke difs`jkrnr=

    > I vnair kstrntg`di ji pridkssi?

    > N dr`t`d`jnjk jis nt`vis?

    > I l`str`di jk idirrfd`ns jk kvkftis jk skgurnfn?

    > I vnair ji nt`vi pnrn i pridkssi?

    > N pribnb`a`jnjk jk idirrfd`ns k iutris, jk ndirji die n irgnf`zni k ksdipi.

    Is dr`tr`is tnebe skri ut`a`znjis pnrn jkf`r ns pr`ir`jnjks pnrn i trntnekfti jis r`sdis.

    Kxkepai=

    Ke ue neb`kftk quk pissu` uen snan usnjn diei jkps`ti jk pnpka k die ue prkdr`i

    s`stken jk prkvkfi k diebntk n `fdfj`is, i r`sdi jk ue `fdfj`i pijk skr NAZI.

    Fi jkskfviav`ekfti jis dr`tr`is `epirtnftk quk=

    >. Jkf`r n qunft`jnjk jk fvk`s fkdkssr`is pnrn i dr`tr `i?

    2. Jkf`r i fiek ji fvka?

    4. Jkf`r is vnairks jk dnjn fvka?

    :. Cnzkr uen jksdr`i jktnalnjn jk dnjn fvka. Diaidnr i ex`ei jk `fcirenks ji quk

    nbrnfgk nqukak fvka n e jk pkre`t`r quk qunaqukr iutrn pkssin pissn kftkfjkr dnjn

    fvka ji dr`tr`i k npa`dn-ai jk ciren `guna`tr`n k uf`cirek.

    Dr`tr`is jk `epndti

    @epndti n eujnfn njvkrsn fi fvka ibt`ji fis ibmkt`vis jk fkgd`is. Is dr`tr`is jk

    `epndti skrvke pnrn ekfsurnr i eiftnftk jis jnfis iu dustis irgnf`zni dnusnjis

    pkan idirrfd`n jk ue kvkfti jk skgurnfn jn `fcireni. Gkrnaekftk ksti rkand`ifnjis

    n pkrjns fnfdk`rns. Jkvke difs`jkrnr, kftrk iutris=

    > I diepriekt`ekfti jns ipkrnks?

    > I jksduepr`ekfti jk prnzis?

    > Is jnfis jk rkputni k `engke?

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    45/156

    20

    Dnptuai

    2-Diftkxtijngkstijkr`sd

    is

    > S`ianks jk rkqu`s`tis akgn`s k rkguantr`is?> Tkvkr`jnjk k dr`t`d`jnjk?> I diepriekt`ekfti jn difjkfd`na`jnjk, ftkgr`jnjk k j`spif`b`a`jnjk?

    > Iutris, jk ndirji die n irgnf`zni k ksdipi.

    Kxkepai

    Tk fn idirrfd`n jk ue `fdfj`i is prkmuzis cirne npkfns aidn`s, rkstr`tis n uen snan, i`epndti pijk skr danss`dnji diei BN@\I. Fn s`tuni ji `fdfj`i tkr sk nanstrnji, k fi

    tkr s`ji pissvka diftria-ai, jk eiji n tkr jkstruji j`vkrsns snans, kqu`pnekftis k jidu-

    ekftis `epirtnftks, i `epndti pijk skr danss`dnji diei KAKSNJI.

    Dr`tr`is pnrn ndk`tni ji r`sdi

    Tkrvke pnrn n irgnf`zni jkf`r i sku fvka iu n sun ksdnan jk ndk`tni jis r `sdis.

    Jkpkfjke jns piat`dns, ektns k ibmkt`vis jn irgnf`zni, skfji jkf`jis die n pnrt`d`-

    pni jn natn j`rki jn irgnf`zni. Jkvke difs`jkrnr=

    > Nspkdtis akgn`s k rkguantr`is?

    > C`fnfns?

    > Nspkdtis sid`n`s?

    > Rkpkrdussi fn `engke?

    > Nspkdtis ipkrnd`ifn`s?

    > Fkgd`is?

    > Zkdfiaig`ns.

    > Iutris, jk ndirji die n irgnf`zni k panfkmnekfti cuturi jis fkgd`is.

    Kxkepai=

    N keprksn jkf`u quk tiji r`sdi E[@ZI BN@\I quk pissu`r @EXNDZI BN@\TT@EI iu quk

    pissn dnusnr pkrjns fnfdk`rnsnbn`xi jk R$ >8 e`askr danss`dnji diei R@TDI NDK@ZSKA

    k fi skr trntnji die pr`ir`jnjk.

    Kxkepais jk dr`tr`is=

    Fvka Jkc`f`i

    Crkqukftk 6 8,02

    Xrivvka 6 8,3; k 1 5 8,02

    Idns`ifna 6 8,40 k 1 5 8,3;

    Rkeiti 6 8,>; k 1 5 8,40

    @eprivvka 6 5 8 k 1 58,>;

    Snair Jkc`f`i

    > Npkfns fn rkjk aidna.

    2 Rkstr`fgk-sk ni sktir, jkpnrtnekfti iu gkrfd`n.

    4 Nt`fgk pnrtk ji s`tk ifjk kst i nt`vi.

    Znbkan 2.2

    Kxkepai jk dr`tr`i

    jk pribnb`a`jnjk.

    Znbkan 2. 4

    Kxkepai jk dr`tr`i

    jk nbrnfgfd`n.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    46/156

    48

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Snair Jkc`f`i

    : Ns difskqufd`ns `fd`jke sibrk tiji i s`tk/c`a`na ifjk kst i nt`vi.

    ; I nt`vi tke difskqufd`ns sibrk tijn n irgnf`zni.

    Fvka jk r`sdi Snair Jksdr`i

    Kxtrkei ; Jk ndirji die n irgnf`zni

    Natss`ei : Jk ndirji die n irgnf`zni

    Nati 4 Jk ndirji die n irgnf`zni

    Ej`i 2 Jk ndirji die n irgnf`zni

    Bn`xi > Jk ndirji die n irgnf`zni

    @rrkakvnftk 8,; Jk ndirji die n irgnf`zni

    Iutri pifti `epirtnftk n jkf`i jis dr`tr`is (7.2 Dr`tr`is bs`dis). Is dr`tr`is cnzke

    pnrtk ji etiji die i quna skr ck`tn n gksti jk r`sdis. Ke iutrns pnanvrns, is dr`tr`is si nciren k i vnair (pksis) die quk skri vnairnjis is r`sdis k is `epndtis. Xnrn `jkft`dnr i en`ir

    iu ekfir r`sdi, k i en`s nati iu en`s bn`xi `epndti, prkd`si jkf`r is dr`tr`is. Dr`tr`i ue

    pnjri quk skrvk jk bnsk pnrn quk di`sns k pkssins pissne skr diepnrnjns k muagnjns.

    qN jkf`i jk dr`tr`is jk r `sdi kfviavk jkd`j`r sibrk=> N fnturkzn k is t`pis jk difskqufd`ns n skrke `fdaujis k n ciren diei skri

    ekj`jis.

    > N enfk`rn pkan quna ns pribnb`a`jnjks skri rkprkskftnjns.

    > I eiji diei ue fvka jk r`sdi skr jktkre`fnji.

    > Is dr`tr`is quk firtknri n jkd`si pkai trntnekfti ji r`sdi.> Is pnrektris pnrn jkf`r qunfji ue r`sdi ndk`tvka k/iu tiakrvka.

    > Tk ns dieb`fnks jk r`sdis skri tienjns ke difs`jkrni.

    Is dr`tr`is pijke skr bnsknjis ke ciftks diei=

    > Is ibmkt`vis ndirjnjis ji pridkssi?

    > Is dr`tr`is `jkft`dnjis fi dnjkrfi jk kfdnrgis?> Ns ciftks jk jnjis?

    > Dr`tr`is gkrnaekftk ndk`tis pkan `fjstr`n, diei fvk`s jk `ftkgr`jnjk, skgurnfn(ekalirks prt`dns)?

    > I npkt`tk jk r`sdi jn irgnf`zni?

    > Is rkqu`s`tis akgn`s duepr`jis pkan irgnf`zni?

    > Iutris ntrnvs jk `fcirenks tdf`dns jk kqu`pnekftis kspkddis iu npa`dnks.

    Is dr`tr`is n skrke njitnjis jkvke skr jktkre`fnjis ke dieue ndirji kftrk n kqu`pk

    jk gksti jk r`sdis k n irgnf`zni. Dnsi n irgnf`zni m pissun dr`tr`is pnrn iutris s`s-

    tkens jk gksti, kstks pijkri skr njnptnjis n jkpkfjkr jn jkenfjn, cnd`a`tnfji i kftkf-

    j`ekfti jis dr`tr`is jk gksti jk r `sdis pir pnrtk jn irgnf`zni, pi`s skri skekalnftks

    nis m ut`a`znjis pir iutris s`stkens jk gksti `epakekftnjis.

    C`gurn 2.:

    Kxkepai jk dr`tr`i

    jk fvka jk r`sdi.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    47/156

    4>

    Dnptuai

    2-Diftkxtijngkstijkr`sd

    is

    Fvka jk r`sdi Snair Jksdr`i

    Jksprkzvka >

    >Fi idirrke aksks, eirtks fn cirn jk trnbnali k/iu jk pkssinskxtkrfns keprksn. Xijke idirrkr dnsis jk pr `ek`ris sidirris iutrntnekfti ej`di (ske ncnstnekfti).

    > Tke jnfis iu die jnfis `fs`gf`c`dnftks nis kqu`pnekftis k/iu`fstnanks.

    >Is s`stkens jk Z@ c `dnrne cirn jk ipkrni pir nt ; e`futis.

    Akvkekftkprkmuj`d`na

    2

    > Aksks akvks fn cirn jk trnbnali, nusfd`n jk aksi.>Jnfis akvks nis kqu`pnekftis iu `fstnanks, diftriavk`s k/iu jk

    bn`xi dusti jk rkpnri.

    >Is s`stkens jk Z@ c `dnrne cirn jk ipkrni pir nt 48 e`futis.

    Xrkmuj`d`na 4

    > Aksks jk grnv`jnjk eijkrnjn fn cirn jk trnbnali iu ke pkssinskxtkrfns keprksn.

    > Aksks akvks ke pkssins kxtkrfns keprksn. Jnfis skvkris nkqu`pnekftis k/iu fstnanks.

    >Is s`stkens jk Z@ c `dnrne cirn jk ipkrni nd`en jk 48 e`futis.Ke`ssi jk fitn c`sdna pir s`stken natkrfnt`vi. Fkdkss`jnjk jk rkdu-pkrnr bndoup.

    Kxtrkenekftkprkmuj`d`na

    ;

    >Xrividn eirtk iu aksks grnvks ke uen iu en`s pkssins (fn cirn jk trnbnali k/iu ke pkssins kxtkrfns keprksn).

    >Jnfis rrkpnrvk`s n kqu`pnekftis iu fstnanks (rkpnrni akftniu epissvka).

    >Nd`ifnji s`tk natkrfnt`vi. Xkrjn jk jnjis k fcirenks. Da`kftks skentkfj`ekfti titna.

    Dnbk rkssnatnr quk kstks kxkepais privnvkaekftk fi sk npa`dne n qunaqukr t`pi jk

    irgnf`zni, ens qukans pnrn ns qun`s cirne jkskfviav`jis. Kftrktnfti, cirfkdke uen

    `jk`n sibrk n dr`ni jk dr`tr`is npa`dnjis s nt`v`jnjks jk gksti jk r`sdis. Fi jkdirrkr

    jkstk dursi skri jkskfviav`jis dr`tr `is jurnftk n rkna`zni jns nt`v`jnjks.

    Kxkrdd`i jk c`xni 4kJkc`f`fji is dr`tr`is

    ^uk dr`tr`is m kx`stke ntunaekftk fn sun irgnf`zni9 Must`quk.

    Difs`jkrnfji i neb`kftk jn sun irgnf`zni, cnn n jksdr`i jis fvk`s bn`xi k

    natss`ei jn Znbkan 2.;9 Must`quk.

    Znbkan 2.;

    Kxkepais jk

    dr`tr`is jk

    `epndti.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    48/156

    42

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    Irgnf`zni pnrn n gksti jk r`sdis

    q> N jkf`i jis pnp`s k rkspifsnb`a`jnjks `epirtnftk pnrn i sudkssi ji pridkssijk gksti jk r`sdis.

    > Jkvke skr jkf`jis=

    2 I pridkssi jk gksti jk r `sdi njkqunji irgnf`zni.2 Ns pnrtks `ftkrkssnjns.

    2 Is pnp`s k rkspifsnb`a`jnjks jns pnrtks kfviav`jns, ftkrfns k kxtkrfns irgnf`zni.

    2 Ns rkanks fkdkssr`ns kftrk n irgnf`zni, suns pnrtks `ftkrkssnjns kiutris primktis.

    2 N dnjk`n jk dieuf`dni k jk jkd`sks.

    2 Is rkg`stris quk jkvke skr enft`jis.

    2 Iutris rkg`stris quk ntkfjne n pnrt`duanr`jnjks kspkddns jk dnjn t`pijk irgnf`zni.

    > Zijns kstns nt`v`jnjks jkvke gkrnr kv`jfd`ns pnrn n npa`dni jis pridkssis jkgksti jk r`sdis.

    N jkf`i jis pnp`s k rkspifsnb`a`jnjks ue cntir `epirtnftk pnrn i sudkssi ji

    pridkssi jk gksti jk r`sdis. Xnrn tna `sti jkvk kstnr cirenaekftk jkf`jn, dieuf`dnjn,

    jiduekftnjn k nprivnjn pkais gkstirks jn natn nje`f`strni.

    Jkvk dnr danri pnrn tijis is kfviav`jis quk i difmufti jkstns nt`v`jnjks jkvk gkrnr

    kv`jfd`ns quk nux`a`ke pnrn uen npa`dni njkqunjn jis pridkssis jk gksti jk r`sdis.

    Tkfji nss`e, `epirtnftk quk tijns ns `fcirenks k jnjis skmne jiduekftnjis pnrn i

    dnsi jk uen cuturn nuj`tir`n.

    Ak`turn diepakekftnr

    > Tkssi 7 jn firen NBFZ FBR @TI/@KD 2788;.> Tkssks ;, 3 k 7 jn firen NBFZ FBR @TI/@KD 27882.

    > Dnptuai ; ji a`vri I r`sdi jk Z@ (Jkskfviavkfji i pridkssi jk givkrfnfn jk r`sdi), jkGkirgk Wkstkrenf k R`dlnrj Luftkr= Lnrvnrj Bus`fkss Tdliia Xrkss, 288

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    49/156

    44

    Dnptuai

    2-Ritk`rijkNt`v`jnjks

    Ritk`ri jk Nt`v`jnjks 2

    S`si gkrna jn nt`v`jnjk

    Tkri rkna`znjns ns nt`v`jnjks fkdkssr`ns pnrn n Jkf`i ji diftkxti. N gurn n skgu`r

    nprkskftn grndnekftk n aidna`zni jkstns nt`v`jnjks fi pridkssi jk gksti jk r`sdis.

    @JKFZ@C@DNI JK R@TDIT

    NFA@TK JK R@TDIT

    NDK@ZNI JI R@TDI

    C@E JN XR@EK@RN I[ JNT JKEN@T @ZKRNKT

    DIE[F@DNIKDIFT[AZNJIR@TDI

    EIF@ZIRNEKFZIKNFA@TKDRZ@DNJ

    KR@TDIT

    XIFZI JK JKD@TI 2

    Zrntnekfti snt`scntr`i

    XIFZI JK JKD@TI >

    Nvna`ni snt`scntr`n

    Fi

    T`e

    Fi

    T`e

    XRIDKTTI JK NSNA@NI JK R@TDIT

    ZRNZNEKFZI JI R@TDI

    NSNA@NI JK R@TDIT

    JKC@F@I JI DIFZK\ZI

    N rkna`zni jkstn nt`v`jnjk jkvk skr ndiepnflnjn jn ak`turn jn firen NBFZ FBR @TI/@KD

    2788;, ji entkr`na jk npi`i cirfkd`ji k n`fjn pkan v`vfd`n k kxpkr`fd`n ke sun irgnf`zni.Xnrn kstn nt`v`jnjk, i naufi jkvk sk vnakr ji Nfkxi N (Jksdr`i jn Keprksn), quk pkre`t`r

    n dr`ni jk uen keprksn dtd`n iu n`fjn nux`a`nr ke naguens ibskrvnks sibrk sun irgn -

    f`zni. N panf`aln jkstn nt`v`jnjk diepistn jk pkrguftns bs`dns pnrn i kftkfj`ekfti

    ji diftkxti irgnf`znd`ifna.

    N skqufd`n jns nt`v`jnjks skr=

    >. Ak`turn jn Tki 7 k ji Nfkxi N jn firen NBFZ FBR @TI/@KD 2788;?

    2. Ak`turn ji Nfkxi N (Jksdr `i jn Keprksn) jkstk dnjkrfi jk nt`v`jnjks?

    4. Kxpa`dni k jkeifstrni pkai `fstrutir jn panf`aln jk nfa`sk jk r`sdi.

    C`gurn 2.2

    Nt`v`jnjks pnrn

    n Jkf`i jidiftkxti.

  • 7/23/2019 Gesto de Riscos de TI - NBR 27005

    50/156

    4:

    Gksti

    jkR`sdisjkZ@FBR

    2788;

    :. Kxkdui jns nt`v`jnjks jn panf`aln=

    n. Kxkrdd`is jn gu`n Jkf`r Diftkxti

    I ibmkt`vi jkstn nt`v`jnjk , ntrnvs jk rkspistns n naguens pkrguftns, jkskfviavkr fi naufi

    i kftkfj`ekfti ji quk jkvk skr pkfsnji, panfkmnji k vkr`dnji ni jkf`reis i diftkxti.

    Jkvke skr rkspifj`jns ns pkrguftns quk pkre`t`ri quk n kqu`pk jk nfa`sk jk r`sdi `jkft`-

    quk k dieprkkfjn i diftkxti ji neb`kftk ifjk skr jkskfviav`jn n nfa`sk.

    Xnrn dnjn tp`di jkvkri skr diaidnjns j`rk`tn ns ibskrvnks iu must`dnt`vns dirrkspifjkftks.

    T pnssk pnrn n gu`n skgu`ftk nps difdau`r.

    b. Kxkrdd`is jn gu`n Rkstr`ks

    Kstn nt`v`jnjk difjuz ni kftkfj`ekfti jn epirtfd`n jn jkft`dni jns rkstr`ks kx`stkftks.

    Fkstn gu`n skri `fskr`jns ns rkstr `ks npa`dvk`s irgnf`zni, jk ndirji die i Nfkxi N

    jn NBFZ FBR @TI/@KD 2788;.

    N diaufn Rkstr`ks nprkskftn uen a`stn bnsknjn fn firen, dnbkfji ni naufi ksdialkr ns

    quk sk npa`dne k ksdrkvkr n must`dnt`vn.

    Kx`stke rkstr`ks quk ncktne n irgnf`zni k rkstr`ks quk ncktne i ksdipi jn gksti jk r`sdis.

    T pnssk pnrn n gu`n skgu`ftk nps difdau`r.

    n. Kxkrdd`is jn gu`n Ksdipi

    I ibmkt`vi jkstn nt`v`jnjk , ntrnvs jk rkspistns n naguens pkrguftns, jkskfviavkr fi

    naufi i kftkfj`ekfti ji quk jkvk skr pkfsnji, panfkmnji k vkr`dnji ni jkf`reis i

    ksdipi k skus a`e`tks.

    Kstn gu`n nprkskftn kxkrdd`is pnrn quk n kqu`pk jk nfa`sk tkfln ue pkrck`ti kftkfj`-

    ekfti ji ksdipi k skus a`e`tks. Xnrn dnjn tp`di jkvkri skr diaidnjns j`rk`tn ns ibskrvn-

    ks dirrkspifjkftks.

    T pnssk pnrn n gu`n skgu`ftk nps difdau`r.

    b. Kxkrdd`is jn gu`n Dr`tr`is

    Kstn gu`n nprkskftn ue kxkrdd`i pnrn pkre`t`r n jkf`i jis dr`tr`is quk skri trnbn-

    alnjis jurnftk tijn n nfa`sk jk r`sdi.

    Nqu` n kqu`pk jk nfa`sk jk r`sdi jn irgnf`zni ifjk rkna`znji i trnbnali, jkf`r is dr` -

    tr`is quk difjuz`ri is trnbnalis jurnftk tiji i pridkssi. `epirtnftk quk kstks dr`tr`is

    skmne cndtvk`s k va`jis pnrn i neb`kftk ji ksdipi jn gksti jk r`sdis k pnrn n irgnf`zni.

    C`gurn 2.4