View
224
Download
0
Category
Preview:
Citation preview
7/23/2019 Gesto de Riscos de TI - NBR 27005
1/156
Gksti jk
R`sdis jk Z@FBR 2788;
Kjsif Oiwnso Bkzkrrn
7/23/2019 Gesto de Riscos de TI - NBR 27005
2/156
N RFX Rkjk Fnd`ifna jk Kfs`fi
k Xksqu`sn quna`c`dnjn diei
uen Irgnf`zni Tid`na (IT),
skfji a`gnjn ni E`f`str`i jn
D`fd`n, Zkdfiaig`n k @fivni
( ED Z @ ) k rks pifs v k a pk a i
Xrigrnen @ftkre`f`stkr`na RFX,
quk diftn die n pnrt`d`pni jis
e`f`str`is jn Kjudni (EKD), jn
Tnjk (ET) k jn Duaturn (E`fD).
X`ifk`rn fi ndkssi @ftkrfkt fi
Brns`a, n RFX panfkmn k enfte nrkjk @p, n rkjk pt`dn fnd`ifna
ndnje`dn jk nati jkskepkfli.
Die Xiftis jk Xrkskfn fns
27 uf`jnjks jn ckjkrni, n rkjk
tke en`s jk
7/23/2019 Gesto de Riscos de TI - NBR 27005
3/156
Kjsif Oiwnso Bkzkrrn
Gksti jkR`sdis jk Z@FBR 2788;
7/23/2019 Gesto de Riscos de TI - NBR 27005
4/156
7/23/2019 Gesto de Riscos de TI - NBR 27005
5/156
Kjsif Oiwnso Bkzkrrn
R`i jk Mnfk`ri
Ksdian Tupkr`ir jk Rkjks
28>4
Gksti jkR`sdis jk Z@FBR 2788;
7/23/2019 Gesto de Riscos de TI - NBR 27005
6/156
Dipyr`glt 28>4 Rkjk Fnd`ifna jk Kfs`fi k Xksqu`sn RFX
Run Anuri Eaakr, >>3 snan >>84
22208-083 R`i jk Mnfk`ri, RM
J`rktir GkrnaFkasif T`eks
J`rktir jk Tkrv`is k TiauksMis Au`z R`bk`ri C`ali
Ksdian Tupkr`ir jk Rkjks
Diirjkfni
Au`z Dikali
Kj`i
Xkjri Tnfg`rnrj`
Diirjkfni Ndnje`dn jk Tkgurnfn k Givkrfnfn jk Z@
Kjsif Oiwnso Bkzkrrn
Kqu`pk KTR (ke irjke nacnbt`dn)
Dka`n End`ka, Dr`st`nfk Ia`vk`rn, Jkra`fn E`rnfjn, Ka`er`n Bnrbisn, Kvkaayf Ck`tisn,
Cka`pk Fnsd`ekfti, Aiurjks Tifd`f, Aud`nfn Bnt`stn, Au`z Dnrais Aibnti, Rkfnti Junrtk
k Pvk Nbka Enrd`na.
Dnpn, primkti v`suna k j`ngrneni
Zkdfijks`gf
Skrsi
2.8.>
Kstk entkr`na j`jt`di ci` kanbirnji die fs kjudnd`ifn`s. Tia`d`tneis quk qunaqukr krri kfdif-trnji iu jv`jn die rkani ni entkr`na iu sku usi skmn kfv`nji pnrn n kqu`pk jk kanbirni jk
diftkji jn Ksdian Tupkr`ir jk Rkjks, fi k-en`a `fciHksr.rfp.br. N Rkjk Fnd`ifna jk Kfs`fi kXksqu`sn k is nutirks fi nssueke qunaqukr rkspifsnb`a`jnjk pir kvkftun`s jnfis iu pkrjns, n
pkssins iu bkfs, ir`g`fnjis ji usi jkstk entkr`na.Ns enrdns rkg`strnjns ekfd`ifnjns fkstk entkr`na pkrtkfdke nis rkspkdt`vis t`tuanrks.
J`str`bu`i
Ksdian Tupkr`ir jk RkjksRun Anuri Eaakr, >>3 snan >>84
22208-083 R`i jk Mnfk`ri, RM
lttp=//ksr.rfp.br`fciHksr.rfp.br
Jnjis @ftkrfnd`ifn`s jk Dntnaigni fn Xuba`dni (D@X)
B;7:g Bkzkrrn, Kjsif Oiwnso
Gksti jk r`sdis jk Z@= FBR 2788; / Kjsif Oiwnso Bkzkrrn. R`i jk Mnfk`ri= RFX/KTR, 28>4. >4< p. = `a. ? 2< de.
B`ba`igrnn= p.>47.@TBF 07
7/23/2019 Gesto de Riscos de TI - NBR 27005
7/156
```
Tuer`i
Ksdian Tupkr`ir jk Rkjks
N ektijiaig`n jn KTR `x
Tibrk i dursi x
N quke sk jkst`fn x
Difvkfks ut`a`znjns fkstk a`vri x
Xkre`ssks jk usi x`
Tibrk i nutir x``
>. @ftrijui Gksti jk R`sdis
@ftrijui >
Kxkrdd`i jk f`vkanekfti > @ftrijui gksti jk r`sdis 2
Difdk`tis cufjnekftn`s 2
Kxkrdd`i jk xni > Difdk`tis cufjnekftn`s ;
Xr`fdp`is jn Gksti jk R`sdis ;
Firens jk gksti jk skgurnfn k jk r`sdis 7
Firen NBFZ FBR @TI/@KD 2788;=288< 0
S`si gkrna jn gksti jk r`sdis >8
Kxkrdd`i jk xni 2 S`si gkrna >2
Kxkrdd`i jk xni 4 XJDN >;
Cntirks drt`dis pnrn i sudkssi >;
rkns jk diflkd`ekfti fkdkssr`ns >3
7/23/2019 Gesto de Riscos de TI - NBR 27005
8/156
`v
Ritk`ri jk Nt`v`jnjks > >0
Nt`v`jnjk >.> Diflkdkfji is difdk`tis >0
Nt`v`jnjk >.2 Diflkdkfji n firen >0
Nt`v`jnjk >.4 @jkft`dnfji i pridkssi 28
Nt`v`jnjk >.: Cntirks drt`dis 28
2. Diftkxti jn gksti jk r`sdis
@ftrijui 2>
Kxkrdd`i jk f`vkanekfti > Diftkxti 2>
Xridkssi jk gksti jk r`sdis jk skgurnfn jn `fcireni 2>
Diftkxti 22
Kstnbkakd`ekfti ji diftkxti 24
Diftkxti jn firen NBFZ FBR @TI/@KD 2788; 24
Jkf`fji i diftkxti 2:
@tkfs pnrn jkft`dni 2:
Kxkrdd`i jk xni > Jkf`fji i diftkxti 2;
Jkf`fji ksdipi k a`e`tks 23
Kxkrdd`i jk xni 2 Jkf`fji i ksdipi k a`e`tks 27
Dr`tr`is pnrn nvna`ni jk r `sdis 2
Kxkrdd`i jk f`vkanekfti > @jkft`dni jis r`sdis :>
Xridkssi jk nfa`sk jk r`sdis jk skgurnfn jn `fcireni :>
@jkft`dni jk r`sdis :2
@jkft`dnfji is nt`vis :4
@jkft`dnfji is nt`vis pr`er`is :;
7/23/2019 Gesto de Riscos de TI - NBR 27005
9/156
v
@jkft`dnfji is nt`vis jk supirtk k `fcrnkstruturn :3
Kxkrdd`i jk xni > @jkft`dnfji is nt`vis :3
@jkft`dnfji ns neknns :7
Kxkrdd`i jk xni 2 @jkft`dnfji ns neknns :0
@jkft`dnfji is diftriaks kx`stkftks :0
Ritk`ri jk Nt`v`jnjks 4 ;4
Nfkxi B @fcrnkstruturn ;;
:. Nfa`sk jk r`sdis= Suafkrnb`a`jnjks k difskqufd`ns
@ftrijui ;0
Kxkrdd`i jk f`vkanekfti > Suafkrnb`a`jnjks k difskqufd`ns ;0
Xridkssi jk nfa`sk jk r`sdis jk skgurnfn jn `fcireni 38
@jkft`dnfji ns vuafkrnb`a`jnjks 38
Kxkrdd`i jk xni > @jkft`dnfji vuafkrnb`a`jnjks 34
@jkft`dni jns difskqufd`ns 34
Kxkrdd`i jk xni 2 @jkft`dnfji ns difskqufd`ns 3;
Ritk`ri jk Nt`v`jnjks : 37
Nfkxi D Xribakens rkantnjis 30
;. Nfa`sk jk R`sdis= Nvna`ni jns difskqufd`ns
@ftrijui Nvna`ni jns difskqufd`ns
7/23/2019 Gesto de Riscos de TI - NBR 27005
10/156
v`
3. Nfa`sk jk r`sdis= nvna`ni jn pribnb`a`jnjk
@ftrijui 0>
Kxkrdd`i jk f`vkanekfti > Nvna`ni jn pribnb`a`jnjk 0>
S`si gkrna ji pridkssi jk nvna`ni jk r`sdi 02
Nvna`ni jn pribnb`a`jnjk jk idirrfd`n jk fd`jkftks 02
Kxkrdd`i jk xni > Nvna`ni jn pribnb`a`jnjk 0:
Jktkre`fni ji fvka jk r`sdi 0:
Ritk`ri jk Nt`v`jnjks 3 07
7. Nvna`ni jk r`sdis
@ftrijui >8>
Kxkrdd`i jk f`vkanekfti > Nvna`ni jk r`sdis >8>
Xridkssi jk nvna`ni jk r`sdis jk skgurnfn jn fcireni >8>
Nvna`ni jk r`sdis jk skgurnfn jn fcireni >82
Kxkrdd`i jk xni > Nvna`ni jk r`sdi >84
Ritk`ri jk Nt`v`jnjks 7 >8;
87
Kxkrdd`i jk f`vkanekfti > Zrntnekfti k ndk`tni jis r`sdis >87
S`si gkrna ji pridkssi jk trntnekfti ji r`sdi >87
Zrntnekfti ji r`sdi >80
R`sdis rks`jun`s >>>
Eij`dni ji r`sdi >>>
Rktkfi ji r`sdi >>4
Ni jk kv`tnr i r`sdi >>4
Diepnrt`alnekfti ji r`sdi >>4
Kxkrdd`i jk xni > Zrntnekfti jk r`sdi >>:
S`si gkrna ji pridkssi jk ndk`tni ji r`sdi >>:
Ndk`tnfji i r`sdi >>;
Ritk`ri jk Nt`v`jnjks < >>7
7/23/2019 Gesto de Riscos de TI - NBR 27005
11/156
v``
0. Dieuf`dni k eif`tirnekfti jis r`sdis
@ftrijui >2>
Kxkrdd`i jk f`vkanekfti > Dieuf`dni k difsuatn jis r`sdis >2>
Xridkssi jk dieuf`dni k difsuatn ji r`sdi jk skgurnfn
jn `fcireni >22
Dieuf`dni k difsuatn ji r`sdi jk skgurnfn jn `fcireni >24
Kxkrdd`i jk xni > Dieuf`dni k difsuatn jis r`sdis >2:
Ritk`ri jk Nt`v`jnjks 0 >2;
>8.Eif`tirnekfti jis r`sdis
@ftrijui >27
Kxkrdd`i jk f`vkanekfti > Eif`tirnekfti jk r`sdis >27
Xridkssi jk eif`tirnekfti k nfa`sk drt`dn jk r`sdis jk
skgurnfn jn fcireni >27
Eif`tirnekfti k nfa`sk drt`dn jis cntirks jk r`sdi >20
Kxkrdd`i jk xni > Eif`tirnekfti k nfa`sk drt`dn jis r`sdis >48
Eif`tirnekfti, nfa`sk drt`dn k ekalir`n ji pridkssi jk
gksti jk r`sdis >48
Ritk`ri jk Nt`v`jnjks >8 >44
Difdausi >4;
B`ba`igrncn >47
7/23/2019 Gesto de Riscos de TI - NBR 27005
12/156
v```
7/23/2019 Gesto de Riscos de TI - NBR 27005
13/156
`x
N Ksdian Tupkr`ir jk Rkjks (KTR) n uf`jnjk jn Rkjk Fnd`ifna jk Kfs`fi k Xksqu`sn (RFX)
rkspifsvka pkan j`sske`fni ji diflkd`ekfti ke Zkdfiaig`ns jn @fcireni k Dieuf`dn-
i (Z@D). N KTR fnsdk die n pripistn jk skr n cirenjirn k j`sske`fnjirn jk diepktfd`ns
ke Z@D pnrn i dirpi tdf`di-nje`f`strnt`vi jns uf`vkrs`jnjks ckjkrn`s, ksdians tdf`dns k
uf`jnjks ckjkrn`s jk pksqu`sn. Tun e`ssi cufjnekftna rkna`znr n dnpnd`tni tdf`dn jidirpi cufd`ifna jns irgnf`znks usur`ns jn RFX, pnrn i kxkrdd`i jk diepktfd`ns npa`d-
vk`s ni usi kdnz k kd`kftk jns Z@D.
N KTR ickrkdk jkzkfns jk dursis j`str`bujis fns rkns tket`dns= Nje`f`strni k Xrimkti
jk Rkjks, Nje`f`strni jk T`stkens, Tkgurnfn, Ej`ns jk Tupirtk Dianbirni J`g`tna k
Givkrfnfn jk Z@.
N KTR tnebe pnrt`d`pn jk j`vkrsis primktis jk `ftkrkssk pba`di, diei n kanbirni k
kxkdui jk panfis jk dnpnd`tni pnrn cireni jk euat`pa`dnjirks pnrn primktis kju-
dnd`ifn`s diei= cireni fi usi jn difckrfd`n wkb pnrn n [f`vkrs`jnjk Nbkrtn ji Brns`a
([NB), cireni ji supirtk tdf`di jk anbirntr`is ji Xri`fci k dr`ni jk ue difmufti jk
dnrt`alns sibrk rkjks ske i pnrn i prigrnen [e Dieputnjir pir Naufi ([DN).
N ektijiaig`n jn KTR
N aisin pkjngg`dn k n ektijiaig`n quk ir`kftne is dursis jn KTR si bnsknjns fn
nprkfj`zngke diei difstrui ji diflkd`ekfti pir ek`i jn rksiaui jk pribakens tp`-
dis jn rkna`jnjk ji priss`ifna ke cireni. Is rksuatnjis ibt`jis fis dursis jk fnturkzn
tkr`di-prt`dn si it`e`znjis, pi`s i `fstrutir, nux`a`nji pkai entkr`na j`jt`di, ntun fi
npkfns diei kxpis`tir jk difdk`tis k `fcirenks, ens pr`fd`pnaekftk diei ir`kftnjir ji
naufi fn kxkdui jk nt`v`jnjks diftkxtuna`znjns fns s`tunks ji dit`j`nfi priss`ifna.
N nprkfj`zngke kftkfj`jn diei n rkspistn ji naufi ni jksni jk s`tunks-pribakenskekalnftks s kfdiftrnjns fn prt`dn priss`ifna, quk si supkrnjns pir ek`i jk nfa`sk,
sftksk, muagnekfti, pkfsnekfti drt`di k difstrui jk l`ptksks pnrn n rksiaui ji pri-
baken, ke nbirjngke ir`kftnjn ni jkskfviav`ekfti jk diepktfd`ns.
Jkssn ciren, i `fstrutir tke pnrt`d`pni nt`vn k j`nag`dn diei ir`kftnjir ji naufi pnrn ns
nt`v`jnjks ke anbirntr`i. Nt eksei n nprkskftni jn tkir`n fi `fd`i jn skssi jk nprkf -
j`zngke fi difs`jkrnjn uen s`epaks kxpis`i jk difdk`tis k `fcirenks. I `fstrutir
busdn `fdkft`vnr n pnrt`d`pni jis naufis dift`funekftk.
Ksdian Tupkr`ir jk Rkjks
7/23/2019 Gesto de Riscos de TI - NBR 27005
14/156
x
Ns skssks jk nprkfj`zngke ifjk sk ji n nprkskftni jis diftkjis k n rkna`zni jns
nt`v`jnjks prt`dns te cirenti prkskfd`na k ksskfd`naekftk prt`di, ut`a`znfji tdf`dns jk
kstuji j`r`g`ji `fj`v`juna, trnbnali ke kqu`pk k prt`dns ir`kftnjns pnrn i diftkxti jk ntun-
i ji cuturi kspkd`na`stn quk sk prktkfjk cirenr.
Ns skssks jk nprkfj`zngke jkskfviavke-sk ke trs ktnpns, die prkjie`ffd`n jk tkepi
pnrn ns nt`v`jnjks prt`dns, difcirek jksdr`i n skgu`r=
Xr`ek`rn ktnpn= nprkskftni jn tkir`n k ksdanrkd`ekfti jk jv`jns (jk 38 n 08 e`futis).
I `fstrutir nprkskftn, jk enfk`rn s`ftt`dn, is difdk`tis tkr`dis dirrkspifjkftks ni tken
jn skssi jk nprkfj`zngke, die nuxa`i jk sa`jks ke cirenti XiwkrXi`ft. I fstrutir akvnftn
qukstks sibrk i diftkji jis sa`jks ke vkz jk npkfns nprkskft-ais, difv`jnfji n turen
rkkxi k pnrt`d`pni. @ssi kv`tn quk ns nprkskftnks skmne eiftifns k quk i naufi sk
diaiquk ke pis`i jk pnss`v`jnjk, i quk rkjuz`r`n n nprkfj`zngke.
Tkgufjn ktnpn= nt`v`jnjks prt`dns jk nprkfj`zngke (jk >28 n >;8 e`futis).
Kstn ktnpn n kssfd`n jis dursis jn KTR. N en`ir`n jns nt`v`jnjks jis dursis nssfdrifn k
rkna`znjn ke jupans jk naufis, quk ndiepnflne i r`tei ji ritk`ri jk nt`v`jnjks pripisti fi
a`vri jk npi`i. @fstrutir k eif`tir d`rduane kftrk ns jupans pnrn siaud`ifnr jv`jns k ickrkdkr
kxpa`dnks diepakekftnrks.
Zkrdk`rn ktnpn= j`sdussi jns nt`v`jnjks rkna`znjns (48 e`futis).
I fstrutir diekftn dnjn nt`v`jnjk, nprkskftnfji uen jns siauks pissvk`s pnrn rksiav-an,
jkvkfji ntkr-sk qukans quk gkrne en`ir j`duajnjk k piae`dn. Is naufis si difv`jnjis n
diekftnr ns siauks kfdiftrnjns k i `fstrutir rktien tp`dis quk tkflne gkrnji jv`jns,
kst`euanfji n pnrt`d`pni jis naufis. I `fstrutir skeprk kst`euan is naufis n kfdiftrnrke
siauks natkrfnt`vns s sugkr`jns pir kak k pkais diakgns k, dnsi kx`stne, n diekft-ans.
Tibrk i dursi
I dursi nprkskftn is difdk`tis jk gksti jk r`sdis n pnrt`r jn firen FBR @TI 2788;.Jkfk difdk`tis k trnbnaln n diftkxtuna`zni ji neb`kftk, `jkft`dni k akvnftnekfti
jis r`sdis ntrnvs ji diflkd`ekfti jns neknns, nt`vis, vuafkrnb`a`jnjks, pribnb`a`jnjk
jk idirrfd`n k `epndtis. Ti rkna`znjis n kst`ent`vn k i daduai jk r`sdi k jkf`ji i
trntnekfti en`s njkqunji. Ziji i trnbnali bnsknji ke ue kstuji jk dnsi, v`snfji
difsia`jnr i diflkd`ekfti tkr`di. Ni fna ji dursi i pnrt`d`pnftk kstnr npti n rkna`znr
uen nfa`sk jk r`sdi quna`tnt`vn fi neb`kftk jn sun irgnf`zni.
N quke sk jkst`fn
Dursi j`rkd`ifnji n gkstirks, tdf`dis k priss`ifn`s jk `fciret`dn iu rkns nfs, quk
ksti ke busdn ji jkskfviav`ekfti jk diepktfd`ns fn rkna`zni jk gksti k nfa`sk
jk r`sdis fi neb`kftk jk tkdfiaig`ns jn `fcireni k dieuf`dni (Z@D). Xriss`ifn`s jk
iutrns rkns pijke pnrt`d`pnr jksjk quk pissune diflkd`ekftis jk Z@D, skgurnfn jn
`fcireni k firens @TI 2788> k 27882.
Difvkfks ut`a`znjns fkstk a`vri
Ns skgu`ftks difvkfks t`pigrdns si usnjns fkstk a`vri=
@ta`di
@fj`dn fieks jk nrqu`vis k rkckrfd`ns b`ba`igrdns rkand`ifnjns ni aifgi ji tkxti.
7/23/2019 Gesto de Riscos de TI - NBR 27005
15/156
x`
Anrgurn difstnftk
@fj`dn dienfjis k suns ipks, vnr`vk`s k ntr`butis, diftkji jk nrqu`vis k rksuatnji jn snjn
jk dienfjis. Dienfjis quk skri j`g`tnjis pkai usur`i si gr`cnjis ke fkgr`ti k pissuke
i prkxi ji neb`kftk ke usi (fi A`fux firenaekftk # iu $, kfqunfti fi W`fjiws D=Q).
Diftkji jk sa`jk@fj`dn i diftkji jis sa`jks rkckrkftks ni dursi nprkskftnjis ke snan jk nuan.
Tebiai
@fj`dn rkckrfd`n diepakekftnr j`spifvka ke s`tk iu pg`fn fn `ftkrfkt.
Tebiai
@fj`dn ue jiduekfti diei rkckrfd`n diepakekftnr.
Tebiai
@fj`dn ue vjki diei rkckrfd`n diepakekftnr.
Tebiai
@fj`dn ue nrqu`vi jk nj`i diei rkckrfd`n diepakekftnr.
Tebiai
@fj`dn ue nv`si iu prkdnui n skr difs`jkrnjn.
Tebiai
@fj`dn qukst`ifnekftis quk kst`euane n rkkxi iu nprkskftn diftkji jk npi`i ni
kftkfj`ekfti ji tken ke quksti.
Tebiai@fj`dn fitns k `fcirenks diepakekftnrks diei j`dns, sugkstks jk ak`turn nj`d`ifna iu
eksei uen ibskrvni.
Xkre`ssks jk usi
Zijis is j`rk`tis rkskrvnjis RFX.
Ngrnjkdkeis skeprk d`tnr kstn ciftk qunfji `fdau`r pnrtk jkstk a`vri ke iutrn ibrn.
Kxkepai jk d`tni= BK]KRRN, K. O. Gksti jk R`sdis jk Z@ FBR 2788;. R`i jk Mnfk`ri= Ksdian
Tupkr`ir jk Rkjks, RFX, 28>4.
Diekftr`is k pkrguftnsXnrn kfv`nr diekftr`is k pkrguftns sibrk kstn puba`dni=
Ksdian Tupkr`ir jk Rkjks RFX
Kfjkrki= Nv. Anuri Eaakr >>3 snan >>84 Bitncigi
R`i jk Mnfk`ri RM 22208-083
K-en`a= `fciHksr.rfp.br
7/23/2019 Gesto de Riscos de TI - NBR 27005
16/156
x``
Tibrk i nutir
Kjsif Oiwnso Bkzkrrn priss`ifna jn rkn jk skgurnfn jn `fcireni k givkrfnfn
l en`s jk qu`fzk nfis, ntunfji diei nuj`tir ajkr, pksqu`snjir, gkrkftk jk primkti k
gkrkftk tdf`di, ke `fekris primktis jk gksti jk r`sdis, gksti jk skgurnfn jn `fcir-
eni, dift`fu`jnjk jk fkgd`is, XD@, nuj`tir`n k rkdupkrni jk jksnstrks ke keprksns
jk grnfjk pirtk ji sktir jk tkakdieuf`dnks, fnfdk`ri, kfkrg`n, `fjstr`n k givkrfi.
Die vnstn kxpkr`fd`n fis tkens jk skgurnfn k givkrfnfn, tke ntunji tnebe diei
pnakstrnftk fis pr`fd`pn`s kvkftis ji Brns`a k n`fjn diei `fstrutir jk trk`fnekftis cidnjis
ke skgurnfn k givkrfnfn. prickssir k diirjkfnjir jk dursis jk ps-grnjuni fn rkn
jk skgurnfn jn `fcireni, gksti `ftkgrnjn, `fivni k tkdfiaig`ns wkb. Limk ntun diei
Diirjkfnjir Ndnje`di jk Tkgurnfn k Givkrfnfn jk Z@ jn Ksdian Tupkr`ir jk Rkjks. Xis-
su` n dkrt`dni DR@TD jn @TNDN, nae jk j`vkrsns iutrns ke skgurnfn k givkrfnfn.
7/23/2019 Gesto de Riscos de TI - NBR 27005
17/156
>
Dnptuai
>-@ftrijuiGkstijkR`sdis
ibmkt`vis
dif
dk`tis
>@ftrijui Gksti jk R`sdis
Difdk`tunr k dieprkkfjkr neknns, vuafkrnb`a`jnjks, pribnb`a`jnjk k r`sdis?
diflkdkr k ut`a`znr n firen jk gksti jk r`sdis? `jkft`dnr ns nt`v`jnjks ji
pridkssi jk gksti jk r`sdis k is cntirks drt`dis pnrn i sudkssi? `jkft`dnr
k jkf`r ns rkns fkdkssr`ns pnrn n gksti jk r `sdis.
Neknns, vuafkrnb`a`jnjks, pribnb`a`jnjk, r`sdis, skgurnfn jn `fcireni k gkstijk r`sdis.
@ftrijui
q> N ni k `ftkrni jis ibmkt`vis die ns `fdkrtkzns ir`g`fne i r `sdi, quk sk nprkskftnfi j`n n j`n jk tijn k qunaqukr nt`v`jnjk.
> Eu`tns vkzks, i r`sdi fi sk nprkskftn v`svka, skfji fkdkssr`ns nks pnrn jkft`d-ai.
> Iutrns vkzks, i r`sdi cruti jk nks rkpkft`fns quk cigke ni diftriak luenfi,diei ke kvkftis jk dnusns fnturn`s.
Fns cnsks ji d`dai jk v`jn jk qunaqukr nt`v`jnjk luenfn panfkmnjn, difv`vkeis die juns dkr-
tkzns bs`dns= jnqu`ai quk jkvk ndiftkdkr (is ibmkt`vis) k i quk pijk ndiftkdkr (ns `fdkrtkzns).
N ni k `ftkrni jis ibmkt`vis die ns `fdkrtkzns ji ir`gke ni r`sdi, quk sk nprkskftn fi
j`n n j`n jk tijn k qunaqukr nt`v`jnjk jkskfviav`jn. Eu`tns vkzks, i r`sdi fi sk nprkskftn
v`svka, skfji fkdkssr`ns nks pnrn `jkft`d-ai? ke iutrns s`tunks i r`sdi privkf`kftk
jk nks rkpkft`fns quk cigke ni diftriak ji skr luenfi, diei fi dnsi jk kvkftis jk
dnusns fnturn`s.
J`nr`nekftk vkeis enfdlktks ke puba`dnks jns en`s j`vkrsns rkns quk jkstndne, die
fcnsk, is pribakens rkand`ifnjis nis r`sdis tkdfiag`dis jk skgurnfn jn `fcireni= riubis
jk ej`ns jk bndoup k jk fitkbiios, vnznekfti jk fekris jk dnrtks jk drj`ti, enfusk`i
`eprpr`i jk rkg`stris kaktrf`dis, riubi jk jkft`jnjk k qukbrn jk pripr`kjnjk ftkakdtuna.
Kstk dnptuai nbirjnr is difdk`tis cufjnekftn`s pnrn n Gksti jk R `sdis k nprkskftnr n
firen NBFZ FBR @TI/@KD 2788;=288< - Zkdfiaig`n jn @fcireni Zdf`dns jk skgurnfn
Gksti jk r`sdis jk skgurnfn jn `fcireni.
7/23/2019 Gesto de Riscos de TI - NBR 27005
18/156
2
Gksti
jkR`sdisjkZ@FBR
2788;
Kxkrdd`i jk f`vkanekfti >k@ftrijui gksti jk r`sdis
Diei vid nvna`n fn sun irgnf`zni i pridkssi jk gksti jk r`sdis9
Kx`stke r`sdis pnrn is trnbnalis k nt`v`jnjks jn sun irgnf`zni9
Difdk`tis cufjnekftn`s
q> Firen @TI Gu`jk 74=2880 Gksti jk r`sdis Sidnbuar`i2 Rkdiekfjnks pnrn usi ke firens.
2 Nprkskftn ns pr`fd`pn`s tkre`fiaig`ns pnrn usi fns nt`v`jnjks jk gksti jk r`sdis.
> Kstn tkre`fiaig`n jkvk skr dieb`fnjn die is tkreis nprkskftnjis fns firens=
2 NBFZ FBR @TI/@KD 2788>.
2 NBFZ @TI/@KD 27882.
> Zkreis nprkskftnjis fns firens=
2 Tkgurnfn jn @fcireni.
2 Neknn.
2 Suafkrnb`a`jnjk.
2 R`sdi.
2 R`sdis jk skgurnfn jn `fcireni.2 @jkft`dni jk r`sdis.
2 @epndti.
2 Kst`ent`vn jk r`sdis.2 Eij`dni ji r`sdi.
2 Dieuf`dni ji r`sdi.
2 Ni jk kv`tnr i r`sdi.
2 Rktkfi ji r`sdi.
2 Diepnrt`alnekfti ji r`sdi.
`epirtnftk tkr skeprk ke ekftk is skgu`ftks difdk`tis=
Tkgurnfn jn @fcireni n pritki jn `fcireni jk vr `is t`pis jk neknns, v`snfji
gnrnft`r n dift`fu`jnjk ji fkgd`i, e`f`e`znr is r `sdis quk pissne diepriekt-ai,
enx`e`znr i rktirfi sibrk is `fvkst`ekftis k ns ipirtuf`jnjks jk fkgd`i. N skgurnfn
jn `fcireni ibt`jn diei rksuatnji jn `epakekftni jk ue difmufti jk diftriaks,
dieprkkfjkfji piat`dns, pridkssis, pridkj`ekftis, kstruturns irgnf`znd`ifn`s k cufks
jk lnrjwnrk k sictwnrk.
N skgurnfn jn `fcireni ibt`jn die n `epakekftni jk diftriaks quk jkvkri skr
eif`tirnjis, nfna`snjis k dift`funekftk ekalirnjis, die i ftu`ti jk ntkfjkr nis
7/23/2019 Gesto de Riscos de TI - NBR 27005
19/156
4
Dnptuai
>-@ftrijuiGkstijkR`sdis
ibmkt`vis ji fkgd`i, e`t`gnfji is r`sdis k gnrnft`fji is prkdk`tis jk skgurnfn jn irgnf`-
zni= Difjkfd`na`jnjk, @ftkgr`jnjk, J`spif`b`a`jnjk k Nutkft`d`jnjk (D@JN).
q> Neknn tiji k qunaqukr kvkfti quk pissn kxpairnr vuafkrnb`a`jnjks.> Dnusn pitkfd`na jk ue `fd`jkftk `fjkskmnji, quk pijk rksuatnr ke jnfi pnrn is
s`stkens, pkssins iu n prpr`n irgnf`zni.
> Ns neknns pijke skr danss`dnjns ke=2 Neknns ftkfd`ifn`s.
2 Neknns jn ni jn fnturkzn.
2 Neknns fi ftkfd`ifn`s.
Ti kxkepais jk neknns=
> Krris luenfis?> Cnalns jk lnrjwnrk?
> Cnalns jk sictwnrk?
> Nks jn fnturkzn?> Zkrrir`sei?
> Snfjna`sei, kftrk iutrns.
Suafkrnb`a`jnjk qunaqukr crnqukzn quk pissn skr kxpairnjn pnrn diepriektkr n skgu-
rnfn jk s`stkens iu `fcirenks. Crng`a`jnjk jk ue nt`vi iu grupi jk nt`vis quk pijk skr
kxpairnjn pir uen iu en`s neknns.
Xnrn pkfsnr
Neknn vkrsusSuafkrnb`a`jnjk
Kftkfjk-sk quk n neknn i kvkfti iu `fd`jkftk, kfqunfti n vuafkrnb`a`jnjk
n crng`a`jnjk quk skr kxpairnjn pnrn quk n neknn sk tirfk difdrktn. Neknns
pijke nssue`r j`vkrsns cirens, diei curti jk kqu`pnekftis, ej`n k jidu-
ekftis, ksdutn fi nutir`znjn, `fdfj`i, `fufjni k rnj`ni kaktriengft`dn,
nt ckfekfis da`et`dis k sse`dis. Xir kxkepai, ue dieputnjir dumn skfln skmn
ji diflkd`ekfti jk tijis, sicrk neknns diei riubi, jkstru`i iu natkrni jk
`fcirenks? n vuafkrnb`a`jnjk quk pkre`tk quk kstns neknns sk difdrkt`zke
mustnekftk n skfln skr diflkd`jn k diepnrt`alnjn pir tijis.
Suafkrnb`a`jnjk Neknn
Cnatn jk trk`fnekfti jk cufd`ifr`is Krris luenfis
@ftkrrupi fi skrv`jir pir quk`en jn ciftk Cnaln jk lnrjwnrk
T`stken npa`dnt`vi ndk`tn qunaqukr vnair fis skus dnepis Cnaln jk sictwnrk
@fufjni jn snan ke v`rtujk jns cirtks dluvns Nks jn fnturkzn
Kxpaisi prividnjn ftkfd`ifnaekftk fi tkre`fna jk f`bus Zkrrir`sei
Equ`fn NZE v`rnjn k p`dlnjn Snfjna`sei
Znbkan >.>
Kxkepais jk
vuafkrnb`a`jnjks
k neknns.
7/23/2019 Gesto de Riscos de TI - NBR 27005
20/156
:
Gksti
jkR`sdisjkZ@FBR
2788;
Is difdk`tis n skgu`r j`zke rkspk`ti s nt`v`jnjks nps n `jkft`dni jis r`sdis k rkand`i-
fnjns ni sku trntnekfti.
> R`sdi= dieb`fni jn pribnb`a`jnjk (dlnfdk jn neknn sk difdrkt`znr) jk ue kvkfti`fjkskmnji idirrkr k jk suns difskqufd`ns pnrn n irgnf`zni. n `fdkrtkzn rksuatnftk
jn dieb`fni jn pribnb`a`jnjk jk idirrfd`n jk ue kvkfti k suns difskqufd`ns.
N pkrguftn ^una i r`sdi9 akvnftn jv`jns n rkspk`ti jn idirrfd`n jk nagi `fdkrti iu
`fkspkrnji. Ke skgurnfn jn `fcireni, kstn `fdkrtkzn rks`jk fis nspkdtis tkdfi-ag`dis kfviav`jis, fis pridkssis kxkdutnjis k, pr`fd`pnaekftk, fns pkssins quk ke
nague eiekfti ftkrngke die n tkdfiaig`n k sk kfviavke die is pridkssis.
> R`sdis jk skgurnfn jn `fcireni= piss`b`a`jnjk jk uen jktkre`fnjn neknn kxpairnrvuafkrnb`a`jnjks jk ue nt`vi iu jk ue difmufti jk nt`vis, nss`e prkmuj`dnfji n irgnf`zni.
> @jkft`dni jk r`sdis= pridkssi pnrn aidna`znr, a`stnr k dnrndtkr`znr kakekftis jk r `sdi.Xir ekfir quk skmn n pribnb`a`jnjk jk idirrfd`n jk ue r`sdi, pijk skr quk jktkre`fnjn
`fdkrtkzn idirrn k kxpairk uen vuafkrnb`a`jnjk, difdrkt`znfji uen neknn. Xnrn sk prk-
pnrnr pnrn `ssi fkdkssr`i diflkdkr is r`sdis jk tiji i neb`kftk, ntrnvs jn rkna`zni
jk ue pridkssi cirena`znji jk `jkft`dni jk r`sdis.
> @epndti= eujnfn njvkrsn fi fvka ibt`ji jis ibmkt`vis jk fkgd`is. Difskqufd`n nvn-a`njn jis rksuatnjis die n idirrfd`n jk ue kvkfti ke pnrt`duanr, ke quk jktkre`fnjn
vuafkrnb`a`jnjk ci` kxpairnjn, uen neknn idirrku k i r`sdi sk difdrkt`ziu. ^una ci` i
`epndti jkstk kvkfti fis fkgd`is9 unfti sk pkrjku9 N irgnf`zni skr rkspifsnb`a`-
znjn9 Lnvkr euatns9 Nks akgn`s skri `epktrnjns9 Lnvkr jnfis jk `engke9
@eng`fk ns skgu`ftks s`tunks l`pitt`dns=
>. Ke uen cnduajnjk, ue usur`i die ndkssi s `fcirenks jis naufis jk`xiu sun skfln
ksdr`tn fue pnpka nps rkfiv-an. I quk pijk idirrkr9 ^una i `epndti9
2. Ke pakfn prkpnrni pnrn i vkst`buanr jk uen jktkre`fnjn `fst`tu`i, ns privns
vnznrne. ^una i `epndti sk kstk vnznekfti idirrku sk`s eksks nftks jn rkna`zni jivkst`buanr9 K sk idirrku fns :< lirns quk nftkdkjke n rkna`zni ji vkst`buanr9
Kxkepais jk `epndtis= pkrjns fnfdk`rns, pnrna`sni jk skrv`is ksskfd`n`s, pkrjn jk
difnfn jis da`kftks, pnfk fi cirfkd`ekfti jk kfkrg`n k cnalns jk tkakdieuf`dnks,
kftrk tnftis iutris.
> Kst`ent`vn jk r`sdis= pridkssi ut`a`znji pnrn ntr`bu`r vnairks pribnb`a`jnjk k difsk-qufd`ns jk ue r`sdi. N kst`ent`vn jk r`sdis pkre`tk qunft`dnr iu jksdrkvkr jk ciren
quna`tnt`vn ue r`sdi, pkre`t`fji s irgnf`znks pr`ir`znr is r `sdis jk ndirji die is
dr`tr`is kstnbkakd`jis.
> Nks jk eij`dni ji r`sdi= nks tienjns pnrn rkjuz`r n pribnb`a`jnjk, ns difsk-qufd`ns fkgnt`vns, iu nebns, nssid`njns n ue r`sdi.
> Dieuf`dni ji r`sdi= tridn iu diepnrt`alnekfti jk `fcirenks sibrk i r`sdi kftrk itienjir jk jkd`si k iutrns pnrtks `ftkrkssnjns.
> Ni jk kv`tnr i r`sdi= jkd`si jk fi sk kfviavkr iu ng`r jk ciren n e`t`gnr uens`tuni jk r`sdi.
> Rktkfi ji r`sdi= ndk`tni ji fus jn pkrjn iu ji bkfkcd`i ji gnfli nssid`nji n uejktkre`fnji r`sdi.
> Diepnrt`alnekfti ji r`sdi= diepnrt`alnekfti die iutrn kft`jnjk ji fus jn pkrjniu ji bkfkcd`i ji gnfli nssid`nji n ue r`sdi.
7/23/2019 Gesto de Riscos de TI - NBR 27005
21/156
;
Dnptuai
>-@ftrijuiGkstijkR`sdis
Kxkrdd`i jk c`xni >kDifdk`tis cufjnekftn`s
Jurnftk uen nprkskftni sibrk is difdk`tis jk gksti jk r`sdis pnrn n natn j`rki jn sun
irgnf`zni, vid ci` qukst`ifnji sibrk juns pissvk`s neknns kx`stkftks k skus r`sdis.
Diei vid rkspifjkr`n9
Ke cufi jn sun rkspistn pnrn n natn j`rki, alk pkj`rne pnrn kxpa`dnr is pissvk`s
`epndtis rkand`ifnjis n kstks r`sdis. Diei vid rkspifjkr`n9
Xr`fdp`is jn Gksti jk R`sdis
qXr`fdp`is jn gksti jk r`sdis=> N gksti jk r`sdis dr`n k pritkgk vnair.
> N gksti jk r `sdis pnrtk `ftkgrnftk jk tijis is pridkssis irgnf`znd`ifn`s.> N gksti jk r `sdis pnrtk jn tienjn jk jkd`sks.
> N gksti jk r `sdis nbirjn kxpa`d`tnekftk n `fdkrtkzn.> N gksti jk r`sdis s`stket`dn, kstruturnjn k ipirtufn.
> N gksti jk r `sdis bnsk`n-sk fns ekalirks `fcirenks j`spifvk`s.
> N gksti jk r `sdis ck`tn sib ekj`jn.
> N gksti jk r `sdis difs`jkrn cntirks luenfis k duaturn`s.
> N gksti jk r `sdis trnfspnrkftk k `fdaus`vn.
> N gksti jk r `sdis j`fe`dn, `tkrnt`vn k dnpnz jk rkng`r n eujnfns.> N gksti jk r `sdis cnd`a`tn n ekalir`n diftfun jn irgnf`zni.
Xnrn n gksti jk r`sdis skr kdnz, difve quk uen irgnf`zni, ke tijis is fvk`s, ntkfjn
nis pr`fdp`is jksdr`tis n skgu`r.
n. N gksti jk r`sdis dr`n k pritkgk vnair.
N gksti jk r `sdis diftr`bu` pnrn n rkna`zni jkeifstrvka jis ibmkt`vis k pnrn n ekalir`n
ji jkskepkfli, rkckrkftk skgurnfn k snjk jns pkssins, difcire`jnjk akgna k rkguan-
tr`n, ndk`tni pba`dn, pritki ji ek`i neb`kftk, quna`jnjk ji prijuti, ni gkrkf-
d`nekfti jk primktis, kd`fd`n fns ipkrnks, givkrfnfn k rkputni.
7/23/2019 Gesto de Riscos de TI - NBR 27005
22/156
3
Gksti
jkR`sdisjkZ@FBR
2788;
b. N gksti jk r`sdis pnrtk ftkgrnftk jk tijis is pridkssis irgnf`znd`ifn`s.
N gksti jk r `sdis fi uen nt`v`jnjk nutfien skpnrnjn jns pr`fd`pn`s nt`v`jnjks k
pridkssis jn irgnf`zni. N gksti jk r`sdis cnz pnrtk jns rkspifsnb`a`jnjks jn nje`f`s-
trni k pnrtk `ftkgrnftk jk tijis is pridkssis irgnf`znd`ifn`s, `fdau`fji i panfkmnekfti
kstrntg`di k tijis is pridkssis jk gksti jk primktis k gksti jk eujnfns.
d. N gksti jk r`sdis pnrtk jn tienjn jk jkd`sks.
N gksti jk r`sdis nux`a`n is tienjirks jk jkd`si n cnzkr ksdialns difsd`kftks, pr`ir`znr
nks k j`st`fgu`r kftrk cirens natkrfnt`vns jk ni.
j. N gksti jk r`sdis nbirjn kxpa`d`tnekftk n fdkrtkzn.
N gksti jk r`sdis kxpa`d`tnekftk akvn ke difs`jkrni n `fdkrtkzn, n fnturkzn jkssn `fdkr-
tkzn, k diei kan pijk skr trntnjn.
k. N gksti jk r`sdis s`stket`dn, kstruturnjn k ipirtufn.
[en nbirjngke s`stket`dn, ipirtufn k kstruturnjn pnrn n gksti jk r`sdis diftr`bu` pnrn
n kd`fd`n k pnrn is rksuatnjis difs`stkftks, diepnrvk`s k difvk`s.
c. N gksti jk r`sdis bnsk`n-sk fns ekalirks fcirenks j`spifvk`s.
Ns kftrnjns pnrn i pridkssi jk gkrkfd`nr r`sdis si bnsknjns ke ciftks jk `fcireni, tn`s
diei jnjis l`str`dis, kxpkr`fd`ns, rktrina`ekftni jns pnrtks `ftkrkssnjns, ibskr-
vnks, prkv`sks k ip`f`ks jk kspkd`na`stns. Kftrktnfti, difve quk is tienjirks jk
jkd`si sk `fcireke k akvke ke difs`jkrni qun`squkr a`e`tnks jis jnjis iu eijk-
angke ut`a`znjis, iu n piss`b`a`jnjk jk j`vkrgfd`ns kftrk kspkd`na`stns.
g. N gksti jk r`sdis ck`tn sib ekj`jn.
N gksti jk r`sdis kst na`flnjn die i diftkxti `ftkrfi k kxtkrfi jn irgnf`zni k die i
pkra ji r`sdi.
l. N gksti jk r`sdis difs`jkrn cntirks luenfis k duaturn`s.
N gksti jk r`sdis rkdiflkdk ns dnpnd`jnjks, pkrdkpks k `ftkfks ji pkssina `ftkrfi k
kxtkrfi, quk pijke cnd`a`tnr iu j`duatnr n rkna`zni jis ibmkt`vis jn irgnf`zni.
`. N gksti jk r`sdis trnfspnrkftk k fdaus`vn.
I kfviav`ekfti npripr`nji k ipirtufi jk pnrtks `ftkrkssnjns k, ke pnrt`duanr, jis tien-
jirks jk jkd`si ke tijis is fvk`s jn irgnf`zni nsskgurn quk n gksti jk r`sdis pkren-
fkn pkrt`fkftk k ntuna`znjn. I kfviav`ekfti tnebe pkre`tk quk ns pnrtks `ftkrkssnjns
skmne jkv`jnekftk rkprkskftnjns k tkflne suns ip`f`ks akvnjns ke difs`jkrni fn
jktkre`fni jis dr`tr`is jk r`sdi.
m. N gksti jk r`sdis j`fe`dn, `tkrnt`vn k dnpnz jk rkng`r n eujnfns.
N gksti jk r`sdis dift`funekftk pkrdkbk k rkngk s eujnfns. ekj`jn quk ndiftkdke
kvkftis kxtkrfis k `ftkrfis, i diftkxti k i diflkd`ekfti eij`dne-sk, i eif`tirnekfti
k n nfa`sk drt`dn jk r`sdis si rkna`znjis, fivis r`sdis surgke, nagufs sk eij`dne k
iutris jksnpnrkdke.
7/23/2019 Gesto de Riscos de TI - NBR 27005
23/156
7
Dnptuai
>-@ftrijuiGkstijkR`sdis
o. N gksti jk r`sdis cnd`a`tn n ekalir`n diftfun jn irgnf`zni.
Difve quk ns irgnf`znks jkskfviavne k `epakekftke kstrntg`ns pnrn ekalirnr n sun
entur`jnjk fn gksti jk r`sdis, muftnekftk die tijis is jken`s nspkdtis jn sun irgnf`zni.
Kstks pr`fdp`is jn gksti jis r`sdis jkvke skr is firtknjirks jkstn fibrk nt`v`-
jnjk fi j`n n j`n jns irgnf`znks.
Firens jk gksti jk skgurnfn k jk r`sdis
q> Firen NBFZ FBR @TI/@KD 2788>=2883> Firen NBFZ FBR @TI/@KD 27882=288;
N rkn jk skgurnfn jn `fcireni pissu` ue difmufti jk firens pnrn skrke ut`a`znjns
fns en`s j`vkrsns irgnf`znks, n e jk pkre`t`r uen pnjrif`zni jis rkqu`s`tis k pridk-
j`ekftis pnrn n `epakekftni jk ue TGT@.
Firen NBFZFBR @TI/@KD 2788>=2883
2 Zkdfiaig`n jn @fcireni Zdf`dns jk skgurnfn T`stkens jk gksti jk skgurnfnjn fcireni Rkqu`s`tis
2 Nprkskftn k jksdrkvk is rkqu`s`tis quk jkvke skr `epakekftnjis fi kstnbkakd`-ekfti jk ue T`stken jk Gksti jk Tkgurnfn jn @fcireni (TGT@).
> Firen NBFZ FBR @TI/@KD 27882=288;2 Zkdfiaig`n jn fcireni Zdf`dns jk skgurnfn Dj`gi jk prt`dn pnrn n gksti
jk skgurnfn jn `fcireni
2 Nprkskftn ns ekalirks prt`dns pnrn uen gksti njkqunjn jn skgurnfn jn `fcireni.
Xijkfji skr npa`dnjns n qunaqukr neb`kftk jk uen irgnf`zni (pnrt`duanrekftk ni neb`kftkjk Z@), kstns firens jkstndne n fkdkss`jnjk jns irgnf`znks jk pissurke uen gksti jk
r`sdis kstruturnjn, die n pnjrif`zni jk pridkssis k rkqu`s`tis jk gksti jk r`sdis.
Ke >00;, n die`ssi jk pnjrif`zni jn Nustra`n k Fivn ]kafj`n anfiu n pr`ek`rn
firen trntnfji ji tken= NT/F]T :438 Gksti jk R`sdi. Gkfr`dn, n firen kstnbkakdk ue
pridkssi jk gksti jk r`sdis nepanekftk ndk`ti, tkfji s`ji ntuna`znjn ke >000 (NT/F]T
:438=>000). Ke >003, n @ftkrfnt`ifna Irgnf`znt`if cir Ttnfjnrj`znt`if (@TI) dr`iu ue grupi
jk trnbnali bnsknji fn NT/F]T :438 pnrn dr`nr ue primkti jk gksti jk r`sdi, quk pnssiu
pir j`vkrsis pribakens k s ci` difdauji ke 2880.
qNBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rktr`zks=> Firen quk cirfkdk is pr`fdp`is k j`rktr`zks gkfr`dns pnrn qunaqukr `fjstr`n iu sktir.> Dr`njn pnrn skr npa`dnjn n qunaqukr neb`kftk iu irgnf`zni.
NBFZ @TI G[@JK 74=2880 Gksti jk R `sdis Sidnbuar`i=
> Firen quk nprkskftn ns jkf`ks jk tkreis gkfr`dis rkant`vis gksti jk r`sdis.> Rkckrfd`n jk difdk`tis a`gnjis gksti jk r`sdi.
NBFZ
Cufjnjn ke >0:8, n
Nssid`ni Brns`ak`rn
jk Firens Zdf`dns i
rgi rkspifsvka pkan
firena`zni tdf`dn
fi pns, cirfkdkfjin bnsk fkdkssr`n ni
jkskfviav`ekfti tkdfi-
ag`di brns`ak`ri. uenkft`jnjk pr`vnjn, ske
c`fs audrnt`vis.
Tn`bn en`s
Ns firens jksdr`tns
nd`en si nprkskftnjns
fi dursi Gksti jk Tkgu-
rnfn jn @fcireni
FBR 2788> k 27882,
ickrkd`ji pkan Ksdian
Tupkr`ir jk Rkjks.
a
7/23/2019 Gesto de Riscos de TI - NBR 27005
24/156
8>8=2880 Gksti jk r`sdis Zdf`dns jk nvna`ni jk r`sdis=> Firen quk jkvk skr trnbnalnjn ke npi`i firen NBFZ FBR @TI 4>888=2880 Gksti
jk R`sdis Xr `fdp`is k j`rktr`zks.
> Jksdrkvk ns j`vkrsns tdf`dns k ckrrnekftns jk nfa`sk jk r`sdi, k fi ci` n`fjn trnju-z`jn pkan NBFZ.
Ke 2880 anfnjn pkan @TI k `ekj`ntnekftk pkan Nssid`ni Brns`ak`rn jk Firens Zd-f`dns (NBFZ) n firen NBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rktr`zks.
Kstn firen cirfkdk is pr`fdp`is k j`rktr`zks gkfr`dns pnrn qunaqukr `fjstr`n iu sktir.
Fi eksei nfi ci` anfnjn n firen NBFZ @TI G[@JK 74=2880 Gksti jk R`sdis Sidnbu-
ar`i. Kan nprkskftn ns jkf`ks jk tkreis gkfr`dis rkant`vis gksti jk r`sdis. ^unfji
sk prktkfjk cnzkr rkckrfd`n n ue difdk`ti jk gksti jk r`sdis, jkvk skr ut`a`znjn n jk-
f`i jn firen NBFZ @TI G[@JK 74=2880 Gksti jk R`sdis Sidnbuar`i. Tkgufji n NBFZ=
Kstk gu`n cirfkdk ns jkf`ks jk tkreis gkfr`dis rkant`vis gksti jk r`sdis. Jkst`fn-sk
n fdkft`vnr uen dieprkkfsi etun k difs`stkftk, uen nbirjngke dikrkftk fn jksdr`i
jns nt`v`jnjks rkant`vns gksti jk r`sdis k n ut`a`zni jk tkre`fiaig`n uf`cirek jk gksti
jk r`sdis ke pridkssis k kstruturns pnrn gkrkfd`nr r`sdis.
Ke 28>2, ci` anfnjn ke pirtugus n firen NBFZ FBR @TI/@KD 4>8>8=28>2 Gksti jk r`sdis
Zdf`dns pnrn i pridkssi jk nvna`ni jk r`sdis jkvk skr trnbnalnjn ke npi`i firen
NBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rktr`zks. N firen jksdrkvk ns
j`vkrsns tdf`dns k ckrrnekftns jk nfa`sk jk r `sdi, cirfkdkfji ir`kftnks sibrk n skaki
k npa`dni jk tdf`dns s`stket`dns pnrn i pridkssi jk nvna`ni jk r`sdis.
Kstk grupi jk firens jn sr`k 4>888 v`sn ntkfjkr n qunaqukr t`pi jk neb`kftk jk uen
irgnf`zni. Xripird`ifne, pirtnfti, uen difdkpi nepan k gkfr`dn jn gksti jk r`sdis,
skfji npa`dnjns pnrn nvna`nr k trntnr qunaqukr t`pi jk r`sdi dirpirnt`vi. Jurnftk i jkskf-
viav`ekfti jkstns firens, ci` puba`dnjn ke 288888=2880, k pirtnfti ntkfjk nis skus
rkqu`s`tis k ni sku pridkssi jk gksti jk r `sdi. N @TI/@KD 2788; cnz pnrtk ji difmufti jk
firens jn sr`k jk 27888, sibrk i T`stken jk Gksti jk Tkgurnfn jn @fcireni (TGT@),
ifjk si `fdaujns n`fjn ns firens @TI/@KD 2788> k @TI/@KD 27882. Kstn firen nprkskftn ns
ekalirks prt`dns k piss`b`a`tn i npricufjnekfti ke nspkdtis kxdaus`vis jn skgurnfn jn
`fcireni, kfqunfti n @TI 4>888 en`s gkfr`dn k diftkepan tijis is sktirks.
I kfciquk jkstk dursi kst fn firen NBFZ FBR @TI/@KD 2788;= 288< Zkdfiaig`n
jn @fcireni Zdf`dns jk Tkgurnfn Gksti jk r`sdis jk skgurnfn jn `fcir-eni. Is difdk`tis, pridkssis k nt`v`jnjks nprkskftnjis sk njkqune ni quk
pripk n firen NBFZ FBR @TI 4>888=2880 Gksti jk R`sdis Xr`fdp`is k j`rk-
tr`zks, pijkfji skr npa`dnjis ke qunaqukr iutrn rkn quk fi n jk Z@.
7/23/2019 Gesto de Riscos de TI - NBR 27005
25/156
0
Dnptuai
>-@ftrijuiGkstijkR`sdis
I qunjri nbn`xi nprkskftn ue rksuei diepnrnt`vi kftrk kstns firens=
Firen Ztuai Ibmkt`vi Ibskrvni
2788> Zkdfiaig`n jn fcir-eni Zdf`dns jkskgurnfn T`stkensjk gksti jk skgu-rnfn jn fcireni Rkqu`s`tis
Kspkd`c`dn is rkqu`s`tis pnrn kstnbkakdkr,`epakekftnr, ipkrnr, eif`tirnr, nfna`snr dr`t`-dnekftk, enftkr k ekalirnr ue TGT@ jidu-ekftnji fi diftkxti jis r`sdis jk fkgd`igaibn`s jn irgnf`zni. Kspkd`c`dn rkqu`s`tispnrn n `epakekftni jk diftriaks jk skgu-rnfn pkrsifna`znjis pnrn ns fkdkss`jnjks`fj`v`jun`s jk irgnf`znks iu jk suns pnrtks.Dibrk tijis is t`pis jk irgnf`zni (keprk-kfj`ekftis diekrd`n`s, ngfd`ns givkrfnekf-tn`s, irgnf`znks ske c`fs audrnt`vis, kftrkj`vkrsns iutrns).
Zrntn en`s kspkd`c`dn-ekftk jk j`rktr`zksk pr`fdp`is pnrn ues`stken jk gksti jkskgurnfn jn fcir-eni.
27882 Zkdfiaig`n jn fcir-eni Zdf`dns jkskgurnfn Dj`gi jkprt`dn pnrn n gkstijk skgurnfn jn fcir-eni
Kstnbkakdk j`rktr`zks k pr`fdp`is gkrn`s pnrn`f`d`nr, `epakekftnr, enftkr k ekalirnr ngksti jk skgurnfn jn `fcireni. Is ibmk-t`vis jkc`f`jis fkstn firen kstnbkakdke j`rk-tr`zks gkrn`s pnrn ns ektns k ekalirks prt`dnspnrn n gksti jn skgurnfn jn `fcireni.
Siatnjn pnrn diftriaksjk skgurnfn.
2788; Zkdfiaig`n jn fcir-eni Zdf`dns jkskgurnfn Gkstijk r`sdis jk skgu-rnfn jn `fcireni
Nprkskftn ue s`stken jk gksti jk r`sdis jkskgurnfn jn `fcireni die cidi ke tkdfi-aig`n jn fcireni.
Ksdanrkdk diei gkrkf-d`nr r`sdis jk skgu-rnfn jn fcireni.
4>888 Gksti jk r`sdis Xr`fdp`is k j`rktr`zks
Firen quk nprkskftn pr`fdp`is k j`rktr`zksbs`dns pnrn n gksti jk r`sdis ke gkrna kequnaqukr t`pi jk neb`kftk.
Kj`tnjn ke2880, jkstk nfi kej`nftk ns jken`sfirens jk gksti jkr`sdis jkvke kstnrna`flnjns n kan.
4>8>8 Gksti jk r`sdis Zdf`dns pnrn ipridkssi jk nvna`nijk r`sdis
Jksdrkvk ns j`vkrsns tdf`dns k ckrrnekftnsjk nfa`sk jk r`sdis.
Kj`tnjn ke 28>2.
G[@JK 74 Gksti jk r`sis Sidnbuar`i
Nprkskftn ns jkc `f`ks jk tkreis gkfr`disrkant`vis gksti jk r`sdis.
Kj`tnjn ke 2880.
Firen NBFZ FBR @TI/@KD 2788;=288 Nprkskftn ns j`rktr`zks pnrn i gkrkfd`nekfti jis r`sdis jk skgurnfn jn `fcireni.
> Keprkgn is difdk`tis jn firen NBFZ FBR @TI 2788>=288;.
N firen NBFZ FBR @TI/@KD 2788;=288< Zkdfiaig`n jn @fcireni Zdf`dns jk Tkgu-
rnfn Gksti jk r`sdis jk skgurnfn jn `fcireni ci` puba`dnjn ke muali jk 288< k
nprkskftn ns j`rktr`zks pnrn i gkrkfd`nekfti jis r`sdis jk skgurnfn jn fcireni.
Keprkgn is difdk`tis jn firen NBFZ FBR @TI 2788>=288;, quk kspkd`dn is rkqu`s`tis jk
s`stkens jk gksti jn skgurnfn jn `fcireni.
Znbkan >.2
Rksuei
diepnrnt`vi kftrk
ns firens.
http://www.qsp.org.br/siso_27000.shtmlhttp://www.qsp.org.br/siso_27000.shtml7/23/2019 Gesto de Riscos de TI - NBR 27005
26/156
>8
Gksti
jkR`sdisjkZ@FBR
2788;
Kstn firen jksdrkvk tiji i pridkssi fkdkssr`i pnrn n gksti jk r`sdis jk skgurnfn jn
`fcireni k ns nt`v`jnjks fkdkssr`ns pnrn n pkrck`tn kxkdui jn gksti. Nprkskftn pr-
t`dns pnrn gksti jk r`sdis jn skgurnfn jn `fcireni. Ns tdf`dns fkan jksdr`tns skguke
i difdk`ti, is eijkais k is pridkssis gaibn`s kspkd`dnjis fn firen NBFZ FBR @TI/@KD
2788>, nae jk nprkskftnr n ektijiaig`n jk nvna`ni k trntnekfti jis r`sdis rkqukr`jis
pkan eksen firen.
Xnrt`fji ji pr`fdp`i jk quk n gksti jk r`sdis ue pridkssi dda`di k diftfui, n firenkst j`v`j`jn ke skssks k nfkxis. Ns skssks difte ns `fcirenks ji pridkssi k jns
nt`v`jnjks fkdkssr`ns pnrn n sun kxkdui. Kx`stke >2 skssks ni tiji= ns skssks jk >
n : trntne jns rkckrfd`ns k jn kstruturn jn firen, k ns skssks ; k 3 nprkskftne n v`si
gkrna ji pridkssi jk gksti jk r`sdis. Ns skssks n pnrt`r jn 7 trntne kspkd`dnekftk ji
pridkssi jk gksti jk r`sdis. Is sk`s nfkxis si `jkft`dnjis jk N n C k trnzke `fcirenks
nj`d`ifn`s k kxkepais.
Fns skssks jk 7 n >2 ns nt`v`jnjks jk gksti si nprkskftnjns jk ndirji die n
skgu`ftk kstruturn=
> Kftrnjn= rkckrk-sk nis `fsueis k prke`ssns fkdkssr`ns pnrn n rkna`zni jn nt`v`jnjk.
> Ni= jksdr`i jn nt`v`jnjk, skeprk ndiepnflnjn ji difve.
> J`rktr`zks pnrn epakekftni= j`rktr`zks fkdkssr`ns pnrn n rkna`zni jn ni, `sti ,i jktnalnekfti jk diei n ni pijk skr rkna`znjn. Kstns j`rktr`zks jkvke skr njnptnjns
n dnjn t`pi jk irgnf`zni. Znebe ksti ndiepnflnjns ji difve.
> Tnjn= nprkskftn is rksuatnjis quk jkvke skr nadnfnjis k quk vi skrv`r pnrn gkrnr kv`jfd`ns.
Kstk dursi ut`a`zn i pridkssi jk gksti jk r`sdis firent`znji dift`ji fn firen NBFZ FBR
@TI/@KD 2788;.
S`si gkrna jn gksti jk r`sdis
q> fkdkssr`n uen nbirjngke s`stket`dn jk gksti jk r`sdis quk vnr`n jk irgnf`-
zni pnrn irgnf`zni nss`e diei i fvka jk r`sdi ndk`tvka jk dnjn uen.
> R`sdi ndk`tvka i grnu jk r`sdi quk n irgnf`zni kst j`spistn n ndk`tnr pnrn dif-drkt`znr is skus ibmkt`vis.
> Fkdkss`jnjk jk nuekftnr n dnpnd`jnjk jk gkr`r i r`sdi k it`e`znr i rktirfi.
> N nbirjngke jk gksti jk r`sdis jk skgurnfn jn `fcireni jkvk skr=
2 Diftfun.
2 Rkna`znjn fi tkepi npripr`nji.
2 Rkpkt`t`vn.2 Xrpr`n ni neb`kftk jn irgnf`zni.
2 Nmustnjn ni pridkssi jk gksti jk r`sdis dirpirnt`vis.
2 Na`flnjn die is rkqu`s`tis jk fkgd`is.
2 Npi`njn pkan natn j`rki.
Gksti jk r`sdis si nt`v `jnjks cirena`znjns k diirjkfnjns pnrn diftrianr k j`r`g`r ue dif-
mufti jk `fstnanks k pkssins die rkanks k rkspifsnb`a`jnjks, kftrk s` k kxtkrfnekftk,
fi quk sk rkckrk n r`sdis fis fkgd`is sib n t`dn jn skgurnfn jn `fcireni.
7/23/2019 Gesto de Riscos de TI - NBR 27005
27/156
>>
Dnptuai
>-@ftrijuiGkstijkR`sdis
Jkf`i ji diftkxti?
> Nfa`sk/Nvna`ni jk r`sdis?
> Zrntnekfti ji r`sdi?
> Ndk`tni ji r`sdi?
> Dieuf`dni ji r`sdi?
> Eif`tirnekfti k nfa`sk drt`dn?> D`dai jk ekalir`n diftfun XJDN.
N Znbkan >.4 eistrn ns pr`fd`pn`s nt`v`jnjks jk gksti jk r`sdis jn skgurnfn jn fcireni.
Xridkssi ji TGT@ Xridkssi jk gksti jk r`sdis jk skgurnfn jn fcireni
XANFKMNR
>Jkc`f`i ji diftkxti>Nfa`sk/Nvna`ni jk r`sdis>Jkc`f`i ji panfi jk trntnekfti ji r `sdi>Ndk`tni ji r`sdi
K\KD[ZNR @epakekftni ji panfi jk trntnekfti ji r`sdi
SKR@C@DNR Eif`tirnekfti diftfui k nfa`sk drt`dn jk r`sdis
NG@REnfutkfi k ekalir`n ji pridkssi jk gksti jk r `sdis jk skgu-rnfn jn `fcireni
Ke sku a`vri Jksni nis jkusks= n cnsd`fnftk l`str`n ji r`sdi, Xktkr Bkrfstk`f fis prk-
skftk`n die uen jktnalnjn nfa`sk l`str`dn jn kviaui ji diftriak k prkv`si jis r`sdis
pkan luenf`jnjk, jksjk n Grd`n nft`gn. Tkgufji i nutir, sieis pissu`jirks jk kakvnji
pitkfd`na tdf`di pnrn n prkvkfi jns pkrjns k gnflis, eksei quk i diepirtnekfti jis
ngkftks skmn eprkv`svka. Fns suns pnanvrns= ... ndiftkn i quk ndiftkdkr k npksnr jk tijis
is fissis ksciris, is skrks luenfis fi pissuke i diflkd`ekfti diepakti sibrk ns ak`s
quk jkfke n irjke ji eufji ibmkt`vnekftk kx`stkftk. Xirtnfti, i nutir fis jksquna`-
dn diei prkv`sirks pkrck`tis ji cuturi.
Bkrfstk`f j`z n`fjn quk ^unfji `fvkst`jirks dieprne nks, d`rurg`ks rkna`zne ipkrn-
ks, kfgkflk`ris primktne piftks, keprksr`is nbrke skus fkgd`is k piat`dis difdirrke
n dnrgis kakt`vis, i r`sdi ue pnrdk`ri `fkv`tvka. Diftuji, suns nks rkvkane quk i r`sdi
fi prkd`sn skr ti tke`ji= nje`f`strnr i r`sdi s`ff`ei jk jksni k ipirtuf`jnjk.
I r`sdi cnz pnrtk jk fissi dit`j`nfi, jk eiji quk prkd`sneis diflkd-ai pnrn pijkr trnt-
-ai k jkak kxtrn`r fivns ipirtuf`jnjks.
`fqukst`ifvka n `epirtfd`n ji pnpka quk n tkdfiaig`n jn `fcireni kxkrdk fn sid`k-
jnjk pnrn quk kstn nadnfdk skus ibmkt`vis. N `ftkgrni ji neb`kftk tkdfiag`di, dnrndtk-r`znji pkan diepakx`jnjk k `ftkrjkpkfjfd`n, prijuz diftkxtis eu`tns vkzks list`s quk
prip`d`ne ntnquks dnjn vkz en`s crkqukftks skgurnfn jn `fcireni, kx`g`fji rkspistns
dnjn vkz en`s rp`jns jns irgnf`znks. N kstk qunjri ve sienr-sk fivns ibr`gnks
akgn`s, jk pritki jk pr`vnd`jnjk k givkrfnfn dirpirnt`vn, gkrnfji n fkdkss`jnjk jns
irgnf`znks gkrkfd`nrke en`s kckt`vnekftk sun `fcrnkstruturn jk tkdfiaig`n.
Xnrn kfcrkftnr kstns fivns neknns k jkenfjns ns irgnf`znks jkvke jkskfviavkr uen
nt`tujk print`vn, nftkd`pnfji-sk ke diflkdkr suns crnqukzns k vuafkrnb`a`jnjks. @sti pijk
skr ibt`ji ntrnvs jn njii jk ue pridkssi cirena jk gkrkfd`nekfti jk r`sdis jk skgu-
rnfn jn `fcireni, quk pkre`tn irgnf`zni kstnbkakdkr ue fvka ndk`tvka jk r`sdi.
Znbkan >.4
Xr`fd`pn`s
nt`v`jnjks jk
gksti jk r`sdis
jn skgurnfn jn
`fcireni.
Tn`bn en`s
J`dn jk ak`turn=
BKRFTZK@F, Xktkr.Jksni nis jkusks= n cns-
d`fnftk l`str`n ji r`sdi.Kj`tirn Dnepus, >007.
a
7/23/2019 Gesto de Riscos de TI - NBR 27005
28/156
>2
Gksti
jkR`sdisjkZ@FBR
2788;
Xnrn `ssi fkdkssr`n uen nbirjngke s`stket`dn jk gksti jk r`sdis, quk `r vnr `nr jk
ndirji die i fkgd`i jk dnjn irgnf`zni, nss`e diei i fvka jk r`sdi ndk`tvka kstnbkak-
d`ji pkan j`rki jk dnjn irgnf`zni.
R`sdindk`tvka i grnu jk r`sdi quk n irgnf`zni kst j`spistn n ndk`tnr pnrn n
difdrkt`zni jis skus ibmkt`vis kstrntg`dis.
Kxkrdd`i jk c`xni 2kS`si gkrna
Fn sun irgnf`zni, quna skr`n i r`sdi ndk`tvka fn rkna`zni jns suns nt`v`jnjks9 Kxpa`quk.
Nuekftnr n dnpnd`jnjk jk gkr`r i r `sdi k it`e`znr i rktirfi si nks `ftkgrnftks jk uen
nbirjngke s`ste`dn, quk pripird`ifn ue pridkssi cirena pnrn n ekalir`n jn dnpnd`jnjk
jk `jkft`dnik nvna`ni jis r`sdis. Kstn nbirjngke jkvk kstnr jk ndirji die is ibmk-
t`vis jn irgnf`zni, ntkfjkfji s suns fkdkss`jnjks kspkddns jk ndirji die is rkqu`-
s`tis jk skgurnfn jn `fcireni. Xnrn `ssi, n nbirjngke jk gksti jk r`sdis jk skgurnfn
jn `fcireni jkvk skr=
> Diftfun?
> Rkna`znjn fi tkepi npripr`nji?
> Rkpkt`t`vn?
> Jk ndirji die i neb`kftk jn irgnf`zni?
> Nmustnjn ni pridkssi jk gksti jk r`sdis dirpirnt`vis?> Na`flnjn die is rkqu`s`tis jk fkgd`is?
> Npi`njn pkan natn j`rki.
Xnrt`fji ji difdk`ti nepai jk quk i pridkssi jk gksti diepisti jk nt`v`jnjks diirjkfnjns
k cirena`znjns pnrn diftrianr k j`r`g`r uen irgnf`zni cirenjn pir suns `fstnanks k pkssina,
die rkanks k rkspifsnb`a`jnjks kftrk s` k die ngkftks kxtkrfis , pijk-sk `fckr`r quk n gksti
jk r`sdis diepistn jk nt`v`jnjks cirena`znjns k diirjkfnjns pnrn diftrianr k j`r`g`r ue
difmufti jk `fstnanks k pkssins die rkanks k rkspifsnb`a`jnjks, kftrk s` k die i neb`kftk
kxtkrfi, fi quk sk rkckrk n r`sdis fis fkgd`is sib n t`dn jn skgurnfn jn `fcireni.
http://pt.shvoong.com/tags/risco/http://pt.shvoong.com/tags/identificar/http://pt.shvoong.com/tags/identificar/http://pt.shvoong.com/tags/risco/7/23/2019 Gesto de Riscos de TI - NBR 27005
29/156
>4
Dnptuai
>-@ftrijuiGkstijkR`sdis
N C`gurn >.> nprkskftn uen v`si ji pridkssi jk gksti jk r`sdis jk skgurnfn jn fcir-
eni skgufji n firen NBFZ FBR @TI/@KD 2788;.
@JKFZ@C@DNI JK R@TDIT
NFA@TK JK R@TDIT
NDK@ZNI JI R@TDI
C@E JN XR@EK@RN I[ JNT JKEN@T @ZKRNKT
DIE[F@DN
IKDIFT[AZNJIR@TDI
EIF@ZIRNEKFZI
KNFA@TKDRZ@DNJKR@TDIT
XIFZI JK JKD@TI 2
Zrntnekfti snt`scntr`i
XIFZI JK JKD@TI >
Nvna`ni snt`scntr`n
Fi
T`e
Fi
T`e
XRIDKTTI JK NSNA@NI JK R@TDIT
ZRNZNEKFZI JI R@TDI
NSNA@NI JK R@TDIT
JKC@F@I JI DIFZK\ZI
I pridkssi tke sk`s grnfjks grupis jk nt`v `jnjks=
> Jkf`i ji diftkxti?
> Nfa`sk/Nvna`ni jk r`sdis?
> Zrntnekfti ji r`sdi?
> Ndk`tni ji r`sdi?
> Dieuf`dni ji r`sdi?
> Eif`tirnekfti k nfa`sk drt`dn.
Diei pijk skr v`sti fn C`gurn >.>, i d`dai jk v`jn jn gksti jk r`sdis jk skgurnfn jn `fcir-
eni `tkrnt`vi, ifjk n gksti sk jkskfviavk jk enfk`rn `fdrkekftna, ntrnvs jk uen
sudkssi jk `tkrnks, k dnjn `tkrni a`bkrn uen kftrkgn (snjn) pnrn n skgu`ftk, e`f`e`-
znfji tkepi k ksciri.
Jkc`f`i ji diftkxti
Jkftri ji pridkssi, n jkf`i ji diftkxti rkspifsvka pkan jkf`i ji neb`kftk,
ksdipi, dr`tr`is jk nvna`ni, kftrk iutrns jkf`ks.
C`gurn >.>
Xridkssi jk
gksti jk r`sdis
jk skgurnfn jn
`fcireni.
7/23/2019 Gesto de Riscos de TI - NBR 27005
30/156
>:
Gksti
jkR`sdisjkZ@FBR
2788;
Kstn ktnpn ksskfd`na pnrn n kqu`pk quk rkna`zn n gksti jk r `sdi diflkdkr tijns ns `fcir-
enks sibrk n irgnf`zni.
Nfa`sk/Nvna`ni jk r`sdis
N prx`en `tkrni jk nfa`sk k nvna`ni jk r`sdi, quk pkre`t`r n `jkft`dni jis r`sdis
k n jktkre`fni jns nks fkdkssr`ns pnrn rkjuz`r i r`sdi n ue fvka ndk`tvka.
Zrntnekfti ji r`sdi
N pnrt`r jis rksuatnjis ibt`jis fn nfa`sk k nvna`ni ji r`sdi si jkf`jis is diftriaks
fkdkssr`is pnrn i trntnekfti ji r`sdi. N firen NBFZ FBR @TI/@KD 2788> kspkd`dn is
diftriaks quk jkvkri skr `epakekftnjis.
Ndk`tni ji r`sdi
Nsskgurn is r`sdis ndk`tis pkan irgnf`zni, iu skmn, is r`sdis quk pir nague eit`vi fi
skri trntnjis iu skri trntnjis pnrd`naekftk. Ti is dlnenjis r`sdis rks`jun`s, dumi
kfqunjrnekfti fkstn dntkgir`n jkvkr skr must`dnji.
Dieuf`dni ji r`sdi
Fkstn ktnpn ck`tn n dieuf`dni ji r`sdi k jn ciren diei skr trntnji, pnrn tijns ns
rkns ipkrnd`ifn`s k skus gkstirks.
Eif`tirnekfti k nfa`sk drt`dn
Ti ns nt`v`jnjks jk ndiepnflnekfti jis rksuatnjis, `epakekftni jis diftriaks k jk
nfa`sk drt`dn pnrn n ekalir`n diftfun ji pridkssi jk gksti jk r `sdis.
Zijns kstns ktnpns skri jktnalnjns fns prx`ens skssks.
N firen NBFZ FBR @TI/@KD 2788> kspkd`dn quk is diftriaks `epakekftnjis fi ksdipi,
a`e`tks k diftkxti ji T`stken jk Gksti jk Tkgurnfn jn @fcireni (TGT@) jkvke kstnr
bnsknjis fi r`sdi. Kstk rkqu`s`ti jkvk skr ntkfj`ji ntrnvs jn npa`dni ji pridkssi jk
gksti jk r`sdis jk skgurnfn jn `fcireni.
Fi neb`kftk jk ue TGT@, n jkf`i ji diftkxti, n nfa`sk k nvna`ni jk r`sdis, i jkskf-
viav`ekfti ji panfi jk trntnekfti ji r`sdi k n ndk`tni ji r`sdi cnzke pnrtk jn cnsk Xan-
fkmnr ji d`dai jk ekalir`n diftfun XJDN. M n cnsk Kxkdutnr ji TGT@ n `epakekftni
jk diftriaks pnrn difjuz`r is r`sdis ni fvka ndk`tvka pkan irgnf`zni. N cnsk Skr`dnr
ji TGT@, pir sun vkz , `fdau` ns nks jk rkv`si. C`fnaekftk, n cnsk Ng`r dieprkkfjk ns
nks fkdkssr`ns pnrn kxkdui, `fdau`fji n rknpa`dni ji pridkssi jk gksti jk r`sdis jk
skgurnfn jn `fcireni.
Xijkeis rksue`r jn skgu`ftk ciren ns pr`fd`pn`s nt`v`jnjks jk Gksti jk r`sdis jk skgu-rnfn jn fcireni=
Xridkssi ji TGT@ Xridkssi jk gksti jk r`sdis jk skgurnfn jn fcireni
XANFKMNR
Jkc`f`i ji diftkxti
Nfa`sk/Nvna`ni jk r`sdis
Jkc`f`i ji panfi jk trntnekfti ji r `sdi
Ndk`tni ji r`sdi
K\KD[ZNR @epakekftni ji panfi jk trntnekfti ji r`sdi
7/23/2019 Gesto de Riscos de TI - NBR 27005
31/156
>;
Dnptuai
>-@ftrijuiGkstijkR`sdis
Xridkssi ji TGT@ Xridkssi jk gksti jk r`sdis jk skgurnfn jn fcireni
SKR@C@DNR Eif`tirnekfti diftfui k nfa`sk drt`dn jk r`sdis
NG@REnfutkfi k ekalir`n i pridkssi jk Gksti jk R`sdis jk Tkgu-rnfn jn @fcireni
Enfutkfik ekalir`nji pridkssi
Eif`tirnekftik nfa`skdrt`dn
@epakekftnri panfi jktrntnekfti
Ndk`tniji r`sdi
Jkf`iji panfi jktrntnekfti
Nfa`sk/Nvna`nijk r`sdis
Jkf`iji diftkxti
NG@R
XANFKMNR
XANFK
MNR
XA
NFKMN
R
XANFKMNR
K\KD
[ZNR
SKR
@C
@DNR
Kxkrdd`i jk c`xni 4kXJDN
Kxpa`quk diei n cnsk panfkmnr (XJDN) ji pridkssi ji TGT@ kxkdutnji fi pridkssi jk
gksti jk r`sdis jk skgurnfn jn `fcireni.
Cntirks drt`dis pnrn i sudkssi
q>Rkjui jns surprksns ipkrnd`ifn`s k prkmuzis.
> @jkft`dni jk ipirtuf`jnjks jk drksd`ekfti k ekalir`ns.
> Rnd`ifna`zni ji dnp`tna kstnbkakdkfji uen irjke jk pr`ir`jnjks jk `fvkst`ekfti.
> Xr-nt`v`jnjk die i usi jis rkdursis dieputnd`ifn`s fis fkgd`is.
> Kfviav`ekfti k pnrt`d`pni jn natn j`rki fi pridkssi.> Dieuf`dni k trk`fnekfti.
> Jkf`i jk ibmkt`vis.
> Xnp`s k rkspifsnb`a`jnjks jkf`jis.
> @ftkgrni die ns nt`v`jnjks jk gksti jk skgurnfn jn `fcireni.
C`gurn >.2
Xridkssi jk gksti
jk r`sdis k i
eijkai XJDN.
7/23/2019 Gesto de Riscos de TI - NBR 27005
32/156
>3
Gksti
jkR`sdisjkZ@FBR
2788;
N gksti jk r `sdis jk skgurnfn jn `fcireni `epakekftnjn pkans irgnf`znks fn
busdn pir vnftngkfs diepkt`t`vns pnrn is fkgd`is. cufjnekftna jkeifstrnr, pnrn ns
pnrtks `ftkrkssnjns, uen pisturn jk skgurnfn fn gksti jis r`sdis rkand`ifnjis pri-
tki jis nt`vis k `fcirenks.
Is cntirks drt`dis pnrn i sudkssi ksti rkand`ifnjis nis bkfkcd`is quk jkvke skr nadnf-
njis pkans irgnf`znks, n jkpkfjkr jn fnturkzn jk dnjn irgnf`zni. Xnrn nt`fg`r tn`s
bkfkcd`is prkd`si rkna`znr ns ktnpns quk kfviavke is cntirks drt`dis pnrn i sudkssi.Diei kxkepais jkstks cntirks pijkeis ekfd`ifnr is a`stnjis n skgu`r.
Kfviav`ekfti k pnrt`d`pni jn natn j`rki fi pridkssi
ksskfd`na pnrn i sudkssi jk qunaqukr primkti quk n j`rki kstkmn kfviav`jn k diepriekt`jn
die i sku jkskfviav`ekfti k sudkssi jk ndirji die is ibmkt`vis kstrntg`dis jkf`jis.
Dieuf`dni k trk`fnekfti
Ziji i pridkssi prkd`sn skr dieuf`dnji n tijns ns pnrtks kfviav`jns nftks ji sku fd`i,
jurnftk i sku jkskfviav`ekfti k nps sun difdausi, die n nprkskftni jis rksuatnjis
nadnfnjis k ektns nt`fg`jns. Ke ue pridkssi jk gksti jk r `sdis tijis is pnrt`d`pnftks
jkvke skr kfviav`jis, k pnrn `ssi fkdkssr`n n rkna`zni jk dnepnflns jk difsd`kft`-
zni k trk`fnekftis.
Jkc`f`i jk ibmkt`vis
I kstnbkakd`ekfti jk ibmkt`vis diftr`bu` jkd`s`vnekftk die i nadnfdk jns ektns jn gksti
jk r`sdis.
Xnp`s k rkspifsnb`a`jnjks jkc`f`jns
Zijis is `ftkgrnftks jns pnrtks kfviav`jns jkvke diflkdkr ns suns ntr`bu`ks k rkspifsn-
b`a`jnjks jurnftk tiji i pridkssi jk gksti jk r`sdis jk skgurnfn jn `fcireni.
@ftkgrni die n gksti jk skgurnfn jn `fcireni
Ns nt`v`jnjks jk gksti jk r`sdis jkvke kstnr titnaekftk `ftkgrnjns s nt`v`jnjks ji TGT@.
Fi jkskfviav`ekfti jkstk dursi skri kxpairnjis is cntirks dr t`dis jk sudkssi pkrtkf-
dkftks n dnjn ktnpn jn gksti jk r`sdis jk skgurnfn jn `fcireni.
rkns jk diflkd`ekfti fkdkssr`ns
qIs priss`ifn`s kfviav`jis fns nt`v`jnjks jk nfa`sk jk r`sdi pissuke ue pkra diediflkd`ekfti ke j`vkrsns rkns=
> Zdf`di.
> Fkgd`is.
> Akg`sani.
> Xridkssis.
Xnrn n ekalir npa`dni ji pridkssi jk gksti jk r`sdis, `epirtnftk quk is priss`ifn`s
kfviav`jis pissune ue pkra die diflkd`ekfti jk rkns j`vkrsns, pkre`t`fji n `jkft`-
dni jns neknns k vuafkrnb`a`jnjks ke qunaqukr neb`kftk irgnf`znd`ifna.
Fn kqu`pk kfdnrrkgnjn jn rkna`zni jn nfa`sk jk r`sdi prkckrkfd`naekftk jkvke skr
kfdiftrnjis is skgu`ftks pkrs=
7/23/2019 Gesto de Riscos de TI - NBR 27005
33/156
>7
Dnptuai
>-@ftrijuiGkstijkR`sdis
> Zdf`di= diftr`bu` fi ntkfj`ekfti jns jkenfjns jns j`vkrsns rkns tdf`dns jn irgnf`-zni, `fdau`fji ns rkns jk lnrjwnrk, sictwnrk, s`stkens ipkrnd`ifn`s, `fcrnkstruturn k
npa`dnks wkb, kftrk iutrns.
> Fkgd`is= nux`a`n n kqu`pk fi kftkfj`ekfti prkd`si jis fkgd`is jn irgnf`zni k skuseat`pais pridkssis, nae jk tkr `epirtfd`n fi daduai jis `epndtis.
> Akg`sani= pkra viatnji ni kftkfj`ekfti jis nspkdtis akgn`s k firent`vis die isqun`s n irgnf`zni nfna`snjn fkdkss`tn sk na`flnr.
> Xridkssis= pkre`tk n dieprkkfsi jis pridkssis k ntrnvs jk sun nfa`sk `jkft`dn pis-svk`s neknns k vuafkrnb`a`jnjks, diftr`bu`fji die n kanbirni jk panfis jk gksti k
trntnekfti jk r`sdis.
Kstks si nagufs kxkepais jk pkrs iu diflkd`ekftis fkdkssr`is pnrn n nfa`sk jk r`sdi.
I t`pi jn irgnf`zni k skus ibmkt`vis jk fkgd`is `fj`dnri is pkrs rknaekftk `epirtnftks
pnrn diepir n kqu`pk jk trnbnali. Fi kx`stk n fkdkss`jnjk jk ue priss`ifna pnrn dnjn
pkra d`tnji, pi`s is diflkd`ekftis pijke skr kfdiftrnjis ke ue eksei priss`ifna.
N qunft`jnjk jk priss`ifn`s naidnjis skr jktkre`fnjn pkai ksdipi jn nfa`sk k prnzi.
Ak`turn diepakekftnr
> Tkssks :, ; k 3 jn firen NBFZ FBR @TI/@KD 2788;.
> @tke : jn Firen Diepakekftnr Gksti jk R`sdis jk Tkgurnfn jn @fcireni k Dieuf`-dnks GRT@D, ji JT@D/GT@/XR= lttp=//js`d.panfnati.giv.br/jiduekftis/fdY8:Ygrs`d.pjc
> Kftkrpr`sk R`so Enfngkekft= Xnst, Xrkskft nfj Cuturk=lttp=//www.dnsndt.irg/kjudnt`if/kre/288:/lnfjiuts/oaienf.pjc
> @ftkrj`sd`pa`fnry R`so Enfngkekft=lttp=//www.r`so`fci.die/rer/rermuf8;.lte
> ^untri j`dns pnrn uen gksti jk r `sdis kd`kftk=lttp=//d`i.uia.die.br/gkstni/2880/87/84/quntri-j`dns-pnrn-n-bin-gkstni-jk-r`sdis/
> NT/F]T :438=lttp=//www.stnfjnrjs.irg.nu/
> L`str`n jn NT/F]T :438=lttp=//www.r`so`fci.die/rer/rerskpt88.lte
http://dsic.planalto.gov.br/documentos/nc_04_grsic.pdfhttp://www.casact.org/education/erm/2004/handouts/kloman.pdfhttp://www.riskinfo.com/rmr/rmrjun05.htmhttp://cio.uol.com.br/gestao/2009/07/03/quatro-dicas-para-a-boa-gestao-de-riscos/http://www.riskinfo.com/rmr/rmrsept00.htmhttp://www.riskinfo.com/rmr/rmrsept00.htmhttp://cio.uol.com.br/gestao/2009/07/03/quatro-dicas-para-a-boa-gestao-de-riscos/http://www.riskinfo.com/rmr/rmrjun05.htmhttp://www.casact.org/education/erm/2004/handouts/kloman.pdfhttp://dsic.planalto.gov.br/documentos/nc_04_grsic.pdf7/23/2019 Gesto de Riscos de TI - NBR 27005
34/156
>0
Dnptuai
>-Ritk`rijkNt`v`jnjks
Ritk`ri jk Nt`v`jnjks >
Nt`v`jnjk >.> Diflkdkfji is difdk`tis
Xnrn dnjn difdk`ti n skgu`r, kxpa`quk k nprkskftk ue kxkepai bnsknji fn irgnf`zni kequk vid trnbnaln. Must`quk sun rkspistn=
Difdk`ti Jkc`f`i Kxkepai Must`c`dnt`vn
R`sdis jk skgurnfnjn `fcireni
@jkft`c`dni jk r`sdis
@epndti
Diepnrt`alnekfti jir`sdi
Kv`tnr i r`sdi
Dieuf`dni ji r`sdi
Kst`ent`vn ji r`sdi
Zrntnekfti ji r`sdi
Ndk`tni ji r`sdi
Nt`v`jnjk >.2 Diflkdkfji n firen
Jksdrkvn diei kst irgnf`znjn n firen NBFZ FBR @TI/@KD 2788;, d`tnfji suns skssks.
Kxpa`quk diei ksti kstruturnjns ns nt`v `jnjks jns skssks 7 n >2 jn firen
NBFZ FBR @TI/@KD 2788;.
7/23/2019 Gesto de Riscos de TI - NBR 27005
36/156
28
Gksti
jkR`sdisjkZ@FBR
2788;
Nt`v`jnjk >.4 @jkft`c`dnfji i pridkssi
Jksdrkvn n skqufd`n jns ktnpns ji pridkssi jk gksti jk r`sdis.
Nt`v`jnjk >.: Cntirks drt`dis
I quk n gksti jk r`sdis jk skgurnfn jn `fcireni k diei kan sk npa`dn fn sun irgnf`zni9
^un`s si is cntirks dr t`dis jk sudkssi9 J kxkepais bnsknjis fn sun irgnf`zni.
Ke sun ip`f`i quna n `epirtfd`n jk kftkfjkreis n gksti jk r`sdi pnrn i kxkrdd`i jns
fissns nt`v`jnjks dit`j`nfns9
I quk ci` nprkfj`ji
q> Difdk`ti jk gksti jk r`sdi.> S`si gkrna jn gksti jk r`sdi.> Cntirks drt`dis jk sudkssi.
7/23/2019 Gesto de Riscos de TI - NBR 27005
37/156
2>
Dnptuai
2-Diftkxtijngkstijkr`sd
is
ibmkt`vis
difdk`tis
2Diftkxti jn gksti jk r`sdis
Difdk`tunr k jkf`r i diftkxti ji neb`kftk jn gksti jk r`sdis? `jkft`dnr i ksdipi
k ns nt`v`jnjks jk jkf`i jk dr`tr`is fi pridkssi jk gksti jk r`sdis.
Diftkxti, ksdipi, a`e`tks k dr`tr`is.
@ftrijui
Ni `f`d`nr qunaqukr t`pi jk trnbnali, n pr`ek`rn nt`v`jnjk n skr ck`tn diflkdkr i neb`kftk ke
quk i trnbnali skr jkskfviav`ji, ns pkssins quk jk naguen ciren `ri `ftkrng`r, i quk skr
jkskfviav`ji? ke rksuei, diflkdkr i tkrrkfi pnrn snbkr difjuz`r i nfjnekfti jis trnbnalis.
Fns nt`v`jnjks quk kfviavke gksti jk r`sdis jk skgurnfn jn `fcireni n jkf`i ji dif-
tkxti n pnrtk `f`d`na k tke diei ibmkt`vi pkre`t`r i diflkd`ekfti ji neb`kftk jn irgnf`zni.
Kxkrdd`i jk f`vkanekfti >kDiftkxtiFi sku kftkfj`ekfti quna i diftkxti ntuna jn sun irgnf`zni9
Xridkssi jk gksti jk r`sdis jk skgurnfn jn `fcireni q> Diflkdkr n skqufd`n jns cnsks jn gksti jk r`sdis.> Zkr ndkssi n tijn n jiduekftni jn irgnf`zni.
Fn skssi nftkr`ir ci` nprkskftnjn n v`si gkrna ji pridkssi jk gksti jk r`sdis. fkdks-
sr`i quk i diflkd`ekfti jn skqufd`n jns cnsks ji pridkssi cnn pnrtk ji j`n n j`n jis
priss`ifn`s kfviav`jis die n gksti jk r`sdis.
7/23/2019 Gesto de Riscos de TI - NBR 27005
38/156
22
Gksti
jkR`sdisjkZ@FBR
2788;
@JKFZ@C@DNI JK R@TDIT
NFA@TK JK R@TDIT
NDK@ZNI JI R@TDI
C@E JN XR@EK@RN I[ JNT JKEN@T @ZKRNKT
DI
E[F@DNIKDIFT[AZNJIR@TDI
EIF@Z
IRNEKFZIKNFA@TKDRZ@DNJKR@TDIT
XIFZI JK JKD@TI 2
Zrntnekfti snt`scntr`i
XIFZI JK JKD@TI >
Nvna`ni snt`scntr`n
Fi
T`e
Fi
T`e
XRIDKTTI JK NSNA@NI JK R@TDIT
ZRNZNEKFZI JI R@TDI
NSNA@NI JK R@TDIT
JKC@F@I JI DIFZK\ZI
Xnrn rkna`znr kstn nt`v`jnjk, is priss`ifn`s jkvkri tkr ndkssi n tijn jiduekftni sibrk n
irgnf`zni, pkre`t`fji nss`e i nepai diflkd`ekfti sibrk ns kspkd`d`jnjks jn irgnf`zni.
Diftkxti
fkdkssr`i kftkfjkr i s`gf`dnji difdk`tuna jk diftkxti k sun npa`dni fn gksti jk
r`sdis. Ni busdnr i sku s`gf`dnji fis j`d`ifr`is, kfdiftrn-sk, kftrk iutrns jkf`ks,
quk diftkxti ue substnft`vi ensdua`fi quk s`gf`dn `ftkr-rkani jk d`rdufstfd`ns quk
ndiepnflne ue cnti iu uen s`tuni.
Nss`e, ni fis rkckr`reis n diftkxti qukrkeis fn vkrjnjk trntnr jn titna`jnjk jk d`rdufstf-
d`ns quk piss`b`a`tne, difj`d`ifne iu jktkre`fne n rkna`zni jk ue tkxti, primkti, nt`v`-jnjk iu eksei jk ue kvkfti jk skgurnfn jn `fcireni. Ke iutrns pnanvrns, diftkxti i
difmufti jk d`rdufstfd`ns quk sk rkand`ifne jk naguen ciren die ue jktkre`fnji ndiftkd`-
ekfti. n s`tuni gkrna iu i neb`kftk n quk kst skfji rkckr`ji ue jktkre`fnji nssufti.
Dlneneis jk diftkxtuna`zni n nt`v`jnjk jk enpknr tiji i neb`kftk quk kfviavk
i kvkfti ke nfa`sk. Fi pridkssi jk gksti jk r`sdis kstn n pr`ek`rn nt`v`jnjk n
skr jkskepkflnjn.
C`gurn 2.>
Jkf`i jidiftkxti.
7/23/2019 Gesto de Riscos de TI - NBR 27005
39/156
24
Dnptuai
2-Diftkxtijngkstijkr`sd
is
Tkgufji n firen NBFZ FBR @TI 4>888=2880 i diftkxti pijk skr nfna`snji sib ji`s nspkdtis=
q> Diftkxti Kxtkrfi= i neb`kftk kxtkrfi fi quna n irgnf`zni sk s`tun k busdn nt`fg`rskus ibmkt`vis (neb`kftk duaturna, fnfdk`ri, rkguantr`is, tkdfiag`di, kdife`di,
diepkt`t`vi, kftrk iutris).
> Diftkxti @ftkrfi= i neb`kftk `ftkrfi fi quna n irgnf`zni busdn nt`fg`r skus
ibmkt`vis (givkrfnfn, kstruturn irgnf`znd`ifna, piat`dns, ibmkt`vis, dnpnd`jnjks,s`stkens jk `fcireni, duaturn irgnf`znd`ifna, firens, j`rktr`zks, kftrk iutrns).
Kstnbkakd`ekfti ji diftkxti
qJk ndirji die n firen NBFZ FBR @TI/@KD 4>888, fi eiekfti ke quk n irgnf`znikstnbkakdk sku diftkxti kan=
> Nrt`duan skus ibmkt`vis.
> Jkfk pnrektris `ftkrfis k kxtkrfis.
> Jkfk i ksdipi k is dr`tr`is jk r `sdi pnrn tiji i pridkssi jk gksti jk r`sdis.
Jk ndirji die n firen NBFZ FBR @TI/@KD 4>888, fi eiekfti quk n irgnf`zni kstnbk-akdk sku diftkxti kan nrt`duan skus ibmkt`vis, jkf`fji pnrektris `ftkrfis k kxtkrfis quk
jkvke skr akvnjis ke difs`jkrni pnrn gkrkfd`nr i r`sdi, k jkfk i ksdipi k is dr`tr`is
jk r`sdi pnrn tiji i pridkssi jk gksti jk r `sdis.
Diftkxti jn firen NBFZ FBR @TI/@KD 2788;
qTki 7 jn NBFZ FBR @TI/@KD 2788;= trntn ns nt`v`jnjks jkskfviav `jns jurnftk n cnskjk diftkxti jn gksti jk r`sdis.
> Nprkskftnks jn irgnf`zni.
> Kftrkv`stns.
> ^ukst`ifr`is=
2 Tki 7.> Difs`jkrnks `f`d`n`s.
2 Tki 7.2 Dr`tr`is bs`dis.
2 Tki 7.4 Ksdipi k a`e`tks.
2 Tki 7.: Irgnf`zni pnrn gksti jk r`sdis jk skgurnfn jn `fcireni.> Nfkxi N @fcirent`vi.
N ski 7 jn firen NBFZ FBR @TI/@KD 2788; trntn jns nt`v`jnjks quk jkvke skr jkskf-
viav`jns jurnftk n cnsk jk diftkxti jn gksti jk r`sdis. Kssns nt`v`jnjks jkvke skr
jkskfviav`jns pkan kqu`pk rkspifsvka pkan gksti jk r `sdis, skfji rkna`znjns pir ek`i jk`ftkrnks die is priss`ifn`s jn irgnf`zni nvna`njn ntrnvs jk=
> Nprkskftnks jn irgnf`zni?
> Kftrkv`stns die j`rktirks, gkrkftks, tdf`dis k usur`is?
> ^ukst`ifr`is.
N ski 7 jkstn firen kst irgnf`znjn jn skgu`ftk ciren=
> Tki 7.> Difs`jkrnks `f`d`n`s= fna`jnjk jk rkna`znr n diftkxtuna`zni?
> Tki 7.2 Dr`tr`is bs dis= dr`tr`is jk nvna`ni?
7/23/2019 Gesto de Riscos de TI - NBR 27005
40/156
2:
Gksti
jkR`sdisjkZ@FBR
2788;
> Tki 7.4 Ksdipi k a`e`tks= `epirtfd`n jn jkf`i ji ksdipi k is a`e`tks jn gkstijk r`sdis?
> Tki 7.: Irgnf`zni pnrn gksti jk r`sdis jk skgurnfn jn `fcireni= irgnf`znik rkspifsnb`a`jnjks ji pridkssi jk gksti jk r`sdis?
> Nfkxi N @fcirent`vi= jktnalks pnrn n jkf`i ji ksdipi k rkstr`ks quk pijke`epndtnr fis trnbnalis.
Jkc`f`fji i diftkxti
q> Tupirtk n TGT@.> Difcire`jnjk akgna.
> Xanfi jk dift`fu`jnjk jk fkgd`is.
> Xanfi jk rkspistn n `fd`jkftks.
Ni `f`d`nr i trnbnali jk gksti jk r`sdis jkvk-sk pr`ek`rnekftk cnzkr ue akvnftnekfti jk
tijns ns fcirenks rkakvnftks sibrk i neb`kftk ifjk skr kxkdutnjn n nfa`sk jk r`sdis.
Jkvk kstnr danri n`fjn i kftkfj`ekfti sibrk ns nt`v `jnjks jn irgnf`zni k is prips`tis
quk n akvnrne gksti jk r`sdis jk skgurnfn jn `fcireni.
Ti kxkepais jkstks prips`tis=
> Tupirtk n TGT@= n irgnf`zni iptiu pir `epakekftnr ue TGT@ k pnrn `ssi jkvk rkna`znrn gksti jk r`sdi jk skgurnfn jn `fcireni diei rkqu`s`ti ibr`gntr`i.
> Difcire`jnjk akgna= ntkfj`ekfti n uen jktkre`fni akgna iu firent`znjirn.Kx= bnfdis, ipkrnjirns jk dnrti jk drj`ti.
> Xanfi jk Dift`fu`jnjk jk Fkgd`is= fkdkssr`i pnrn n prkpnrni ji panfi quk v`snkstruturnr i eiji diei n irgnf`zni kfcrkftnr ue kvkfti dntnstrdi. Xnrn quk fi
idirrn ue `epndti s`gf`dnt`vi ni fkgd`i fkdkssr`n n rkna`zni ji pridkssi jk
gksti jk r`sdis.> Xanfi jk rkspistn n fd`jkftks= pnrn quk n irgnf`zni pissn tkr sku panfi jk rks-
pistns n `fd`jkftks fkdkssr`i i diflkd`ekfti jk skus r`sdis k vuafkrnb`a`jnjks.
Jk eiji gkrna, i kftkfj`ekfti jis prips`tis jn `epanftni jn gksti jk r`sdis piss`b`-
a`tn uen v`si jn `epirtfd`n jkstn nt`v`jnjk pnrn is fkgd`is jn irgnf`zni. Fn firen
NBFZ FBR @TI/@KD 2788; i prips`ti cnz pnrtk jns j`rktr`zks pnrn `epakekftni jn nt`v `-
jnjk jk jkf`i ji diftkxti= v`jk 7.> Difs`jkrnks gkrn`s.
@tkfs pnrn `jkft`c`dni
Ni nfna`snr i neb`kftk jn irgnf`zni, n kqu`pk jk nfna`stns jkvk `jkft`dnr is kakekftis
quk dnrndtkr`zne n irgnf`zni k diftr`buke pnrn i sku jkskfviav`ekfti. Fn nfa`sk jnirgnf`zni jkvke difstnr pkai ekfis is skgu`ftks `tkfs=
@tkfs pnrn jkft`c`dni Kxkepai jk qukst`ifnekftis
Xrips`ti pr`fd`pna jnirgnf`zni
^una n c`fna`jnjk jn keprksn9 un`s skus ibmkt`vis9
I fkgd`i ^una i sku fkgd`i9 ^una n c`fna`jnjk ji quk prijuz`ji / jkskfviav`ji9
N e`ssi ^una n sun e`ssi9 Xnrn quk kan kx`stk9 I quk kan sk pripk n cnzkr9 Xnrn quke9
Znbkan 2.>@tkfs pnrn nfa`sk
jn irgnf`zni.
7/23/2019 Gesto de Riscos de TI - NBR 27005
41/156
2;
Dnptuai
2-Diftkxtijngkstijkr`sd
is
@tkfs pnrn jkft c`dni Kxkepai jk qukst`ifnekftis
N v`si jk cuturi ^una sun v`si jk cuturi9 I quk sk kspkrn jkan fi tkepi9
Is vnairks ^un`s is skus vnairks9 Diei kaks si kv`jkfd`njis9
N kstruturn irgnf`znd`ifnaDiei kan kst irgnf`znjn k kstruturnjn9 K n skgurnfn jns `fcirenks9K ns rkspifsnb`a`jnjks pkan skgurnfn9
I irgnfigrnen^una i sku irgnfigrnen9 ^uke quke k ke quk sktir trnbnaln9L rkn jk skgurnfn jn `fcireni9
Ns kstrntg`ns ^un`s si ns suns pr`fd`pn`s kstrntg`ns jk fkgd`is9 K jk skgurnfn jn `fcireni9
Is prijutis ^un`s si is skus prijutis9 ^una i pr`fd`pna prijuti jk nanvnfdngke jis fkgd`is9
Is pnrdk`ris^uke si skus pnrdk`ris9 Diei si ksdial`jis9 Diei diftr`buke9 Diei irkand`ifnekfti jn skgurnfn jn fcireni die kaks9 un`s ns ibr`gnks jnskgurnfn jn fcireni9
Is tkrdk`ris^uke si is tkrdk`ris9 Diei si ksdial`jis9 Diei diftr`buke9 Diei i rkan -d`ifnekfti jn skgurnfn jn `fcireni die kaks9 Diei i diftrnti9 ^un`s nsibr`gnks jn skgurnfn jn fcireni9
Ns `fstnanksDiei kst j`v`j`jn n irgnf`zni9 Ifjk ksti is skrv`jirks9 L nague ekdnf`seijk prkvkfi jk `fdfj`i9 Diei ck`tn n pritki cs`dn9 Diei si is ndkssis9
Is cufd`ifr`isDiei si diftrntnjis9 L trk`fnekfti jk skgurnfn jn fcireni9Diei si diftrntnjis9
Kxkrdd`i jk c`xni >kJkc`f`fji i diftkxti
^una n fna`jnjk jn sun irgnf`zni9 Kxpa`quk.
^una jkvk skr ue jis prips`tis quk jkvke akvnr n gksti jk r`sdis jk skgurnfn jn `fcir-eni fn sun irgnf`zni9 Must`quk.
7/23/2019 Gesto de Riscos de TI - NBR 27005
42/156
23
Gksti
jkR`sdisjkZ@FBR
2788;
Jkc`f`fji ksdipi k a`e`tks
q> Ksdipi jksdr`i jis a`e`tks ji primkti, sun nbrnfgfd`n, skus rksuatnjis kkftrkgns. n fna`jnjk jn gksti jk r`sdis.
> Jkvke skr difs`jkrnjis=
2 Is ibmkt`vis k piat`dns jn irgnf`zni.2 Kstruturn k cufks jn irgnf`zni.
2 Xridkssis jk fkgd`is.
2 Nt`vis.
2 Kxpkdtnt`vns.
2 Rkstr`ks.
> Ns rkstr `ks ncktne n irgnf`zni k jktkre`fne i j`rkd`ifnekfti jn skgurnfnjn fcireni.
> Naguens jkstns rkstr `ks pijke dnusnr `epndtis fi ksdipi k n kqu`pk tke qukkstnr prkpnrnjn pnrn `jkft`d- ans k jktkre`fnr n `fufd`n quk tkri fi ksdipi.
Kxkepais jk rkstr`ks=
2 Rkstr`ks tdf`dns.
2 Rkstr`ks fnfdk`rns.
2 Rkstr`ks neb`kftn`s.
2 Rkstr`ks tkepirn`s (tkepi ue cntir jktkre`fnftk).
2 Rkstr`ks irgnf`znd`ifn`s.> I nfkxi N jn firen NBFZ FBR @TI/@KD 2788; nprkskftn k jktnaln kstns rkstr`ks.
> Kxkepais jk ksdipi k a`e`tks=
2 [en npa`dni jk Z@.
2 N `fcrnkstruturn jk Z@.
2 [e pridkssi jk fkgd`i.
2 I jkpnrtnekfti jk Z@.
2 [en a`na.
2 I s`stken jk `ftkrfkt bnfo`fg jk uen `fst `tu`i fnfdk`rn.
2 I skrv`i jk k-en`a jn irgnf`zni.
2 I pridkssi jk diftriak jk ndkssi cs`di jn irgnf`zni.
2 I jntndkftkr jn irgnf`zni.
2 N `fcrnkstruturn quk ntkfjk nis skrv `is NJTA jk uen ipkrnjirn.2 I skrv`i jk dnaadkftkr.
2 I s`stken aigst`di jk j`str`bu`i jk privns jk difdursi pba`di fnd`ifna.
2 N `ftrnfkt jn irgnf`zni.
Xnrn a`jnr die n diepakx`jnjk jn jkf`i ji ksdipi, rkdiekfjvka ksdrkv-an
pir tp`dis, tkfji n dkrtkzn jk quk tijis is piftis cirne `fdaujis k quk fi
kx`stke jv`jns, pr`fd`pnaekftk kftrk i kftkfj`ekfti jn kqu`pk jk gksti jk
r`sdis k n irgnf`zni.
7/23/2019 Gesto de Riscos de TI - NBR 27005
43/156
27
Dnptuai
2-Diftkxtijngkstijkr`sd
is
`epirtnftk quk n irgnf`zni jkfn i ksdipi k is a`e`tks jn gksti jk r`sdis jk skgurnfn
jn `fcireni. Ens i quk ksdipi9
Ksdipi n enfk`rn diei si jksdr `tis is a`e`tks ji primkti, sun nbrnfgfd`n, skus rksua-
tnjis k suns kftrkgns. n fna`jnjk, i navi, i `ftkfti iu prips`ti jn gksti jk r `sdis. Tk
i ksdipi cir fkbuaisi, iu jk`xnr enrgke pnrn `ftkrprktni, skr j`cd`a pnrn n kqu`pk jk
gksti jk r`sdis `jkft`dnr is a`e`tks ji sku trnbnali. Xirtnfti, i ksdipi jkvk skr danri,
bke jkf`ji k kftkfj`ji pkan kqu`pk jk trnbnali k pkan irgnf`zni. Jkstn ciren, diei ksdipi k is a`e`tks `jkft`dnjis, n kqu`pk jk nfa`sk k n irgnf`zni kstnri nptis n
akvnftnr is nt`vis, pkssins, pridkssis k `fstnanks quk skri kfviav`jns fn nt`v`jnjk jk
nfa`sk k nvna`ni jis r`sdis.
Ni jkf`r i ksdipi, n irgnf`zni jkvkr akvnr ke diftn is ibmkt`vis quk jkvke skr nadnfnjis
die n nfa`sk/nvna`ni (prips`tis). Xnrn ssi jkvke skr difs`jkrnjis=
> Is ibmkt`vis k piat`dns jn irgnf`zni?
> Kstruturn k cufks jn irgnf`zni?
> Xridkssis jk fkgd`is?
> Nt`vis?> Kxpkdtnt`vns?
> Rkstr`ks.
`epirtnftk difs`jkrnr ns rkstr`ks quk ncktne n irgnf`zni k jktkre`fne i j`rkd`ifn-
ekfti jn skgurnfn jn `fcireni. Naguens jkstns rkstr`ks pijke dnusnr `epndtis fi
ksdipi, jk eiji quk n kqu`pk prkd`sn kstnr prkpnrnjn pnrn `jkft`d-ans k jktkre`fnr n
`fufd`n quk tkri fi ksdipi. Nagufs kxkepais jk rkstr`ks=
> Rkstr`ks tdf`dns?
> Rkstr`ks fnfdk`rns?
> Rkstr`ks neb`kftn`s?> Rkstr`ks tkepirn`s (tkepi ue cntir jktkre`fnftk)?
> Rkstr`ks irgnf`znd`ifn`s.
Kx`stke eu`tns iutrns rkstr`ks, quk `ri vnr`nr ke cufi ji t`pi iu ji fkgd`i jn irgn-
f`zni, nss`e diei tnebe `r vnr`nr n `fufd`n jkstns rkstr`ks fn gksti jk r`sdis.
I nfkxi N jn firen NBFZ FBR @TI/@KD 2788;nprkskftnk jktnaln kstns rkstr`ks, skfji
uen ak`turn ibr`gntr`n pnrn ue ekalir kftkfj`ekfti. Kstks si npkfns nagufs kxkepais
bke ibmkt`vis. prkd`si nvna`nr n diepakx`jnjk ji ksdipi k cnzkr ue jktnalnekfti jis
skus ibmkt`vis, pnrn quk fi lnmn jv`jn n rkspk`ti jn sun nepa`tujk.
Kxkrdd`i jk c`xni 2kJkc`f`fji i ksdipi k a`e`tks
^un`s prips`tis jkvke skr difs`jkrnjis fn sun irgnf`zni pnrn jkf`i ji ksdipi9
Must`quk.
7/23/2019 Gesto de Riscos de TI - NBR 27005
44/156
2 Is dr`tr`is cnzke pnrtk ji etiji jn gksti jk r`sdis.> Is dr`tr`is si n ciren k i vnair (pksis) die quk is r`sdis k `epndtis skri vnairnjis.
N pnanvrn dr`tr`i, ji grkgi or`tr`ifpkai ant`e dr`tr`i, s`gf`dn kstnbkakdkr ue pnjri quk
skrvk jk bnsk pnrn quk di`sns k pkssins pissne skr diepnrnjns k muagnjns.
Is dr`tr`is pnrn nvna`ni jk r`sdis skrvke pnrn nvna`nr is r`sdis jk skgurnfn k
jkvke difs`jkrnr=
> I vnair kstrntg`di ji pridkssi?
> N dr`t`d`jnjk jis nt`vis?
> I l`str`di jk idirrfd`ns jk kvkftis jk skgurnfn?
> I vnair ji nt`vi pnrn i pridkssi?
> N pribnb`a`jnjk jk idirrfd`ns k iutris, jk ndirji die n irgnf`zni k ksdipi.
Is dr`tr`is tnebe skri ut`a`znjis pnrn jkf`r ns pr`ir`jnjks pnrn i trntnekfti jis r`sdis.
Kxkepai=
Ke ue neb`kftk quk pissu` uen snan usnjn diei jkps`ti jk pnpka k die ue prkdr`i
s`stken jk prkvkfi k diebntk n `fdfj`is, i r`sdi jk ue `fdfj`i pijk skr NAZI.
Fi jkskfviav`ekfti jis dr`tr`is `epirtnftk quk=
>. Jkf`r n qunft`jnjk jk fvk`s fkdkssr`is pnrn i dr`tr `i?
2. Jkf`r i fiek ji fvka?
4. Jkf`r is vnairks jk dnjn fvka?
:. Cnzkr uen jksdr`i jktnalnjn jk dnjn fvka. Diaidnr i ex`ei jk `fcirenks ji quk
nbrnfgk nqukak fvka n e jk pkre`t`r quk qunaqukr iutrn pkssin pissn kftkfjkr dnjn
fvka ji dr`tr`i k npa`dn-ai jk ciren `guna`tr`n k uf`cirek.
Dr`tr`is jk `epndti
@epndti n eujnfn njvkrsn fi fvka ibt`ji fis ibmkt`vis jk fkgd`is. Is dr`tr`is jk
`epndti skrvke pnrn ekfsurnr i eiftnftk jis jnfis iu dustis irgnf`zni dnusnjis
pkan idirrfd`n jk ue kvkfti jk skgurnfn jn `fcireni. Gkrnaekftk ksti rkand`ifnjis
n pkrjns fnfdk`rns. Jkvke difs`jkrnr, kftrk iutris=
> I diepriekt`ekfti jns ipkrnks?
> I jksduepr`ekfti jk prnzis?
> Is jnfis jk rkputni k `engke?
7/23/2019 Gesto de Riscos de TI - NBR 27005
45/156
20
Dnptuai
2-Diftkxtijngkstijkr`sd
is
> S`ianks jk rkqu`s`tis akgn`s k rkguantr`is?> Tkvkr`jnjk k dr`t`d`jnjk?> I diepriekt`ekfti jn difjkfd`na`jnjk, ftkgr`jnjk k j`spif`b`a`jnjk?
> Iutris, jk ndirji die n irgnf`zni k ksdipi.
Kxkepai
Tk fn idirrfd`n jk ue `fdfj`i is prkmuzis cirne npkfns aidn`s, rkstr`tis n uen snan, i`epndti pijk skr danss`dnji diei BN@\I. Fn s`tuni ji `fdfj`i tkr sk nanstrnji, k fi
tkr s`ji pissvka diftria-ai, jk eiji n tkr jkstruji j`vkrsns snans, kqu`pnekftis k jidu-
ekftis `epirtnftks, i `epndti pijk skr danss`dnji diei KAKSNJI.
Dr`tr`is pnrn ndk`tni ji r`sdi
Tkrvke pnrn n irgnf`zni jkf`r i sku fvka iu n sun ksdnan jk ndk`tni jis r `sdis.
Jkpkfjke jns piat`dns, ektns k ibmkt`vis jn irgnf`zni, skfji jkf`jis die n pnrt`d`-
pni jn natn j`rki jn irgnf`zni. Jkvke difs`jkrnr=
> Nspkdtis akgn`s k rkguantr`is?
> C`fnfns?
> Nspkdtis sid`n`s?
> Rkpkrdussi fn `engke?
> Nspkdtis ipkrnd`ifn`s?
> Fkgd`is?
> Zkdfiaig`ns.
> Iutris, jk ndirji die n irgnf`zni k panfkmnekfti cuturi jis fkgd`is.
Kxkepai=
N keprksn jkf`u quk tiji r`sdi E[@ZI BN@\I quk pissu`r @EXNDZI BN@\TT@EI iu quk
pissn dnusnr pkrjns fnfdk`rnsnbn`xi jk R$ >8 e`askr danss`dnji diei R@TDI NDK@ZSKA
k fi skr trntnji die pr`ir`jnjk.
Kxkepais jk dr`tr`is=
Fvka Jkc`f`i
Crkqukftk 6 8,02
Xrivvka 6 8,3; k 1 5 8,02
Idns`ifna 6 8,40 k 1 5 8,3;
Rkeiti 6 8,>; k 1 5 8,40
@eprivvka 6 5 8 k 1 58,>;
Snair Jkc`f`i
> Npkfns fn rkjk aidna.
2 Rkstr`fgk-sk ni sktir, jkpnrtnekfti iu gkrfd`n.
4 Nt`fgk pnrtk ji s`tk ifjk kst i nt`vi.
Znbkan 2.2
Kxkepai jk dr`tr`i
jk pribnb`a`jnjk.
Znbkan 2. 4
Kxkepai jk dr`tr`i
jk nbrnfgfd`n.
7/23/2019 Gesto de Riscos de TI - NBR 27005
46/156
48
Gksti
jkR`sdisjkZ@FBR
2788;
Snair Jkc`f`i
: Ns difskqufd`ns `fd`jke sibrk tiji i s`tk/c`a`na ifjk kst i nt`vi.
; I nt`vi tke difskqufd`ns sibrk tijn n irgnf`zni.
Fvka jk r`sdi Snair Jksdr`i
Kxtrkei ; Jk ndirji die n irgnf`zni
Natss`ei : Jk ndirji die n irgnf`zni
Nati 4 Jk ndirji die n irgnf`zni
Ej`i 2 Jk ndirji die n irgnf`zni
Bn`xi > Jk ndirji die n irgnf`zni
@rrkakvnftk 8,; Jk ndirji die n irgnf`zni
Iutri pifti `epirtnftk n jkf`i jis dr`tr`is (7.2 Dr`tr`is bs`dis). Is dr`tr`is cnzke
pnrtk ji etiji die i quna skr ck`tn n gksti jk r`sdis. Ke iutrns pnanvrns, is dr`tr`is si nciren k i vnair (pksis) die quk skri vnairnjis is r`sdis k is `epndtis. Xnrn `jkft`dnr i en`ir
iu ekfir r`sdi, k i en`s nati iu en`s bn`xi `epndti, prkd`si jkf`r is dr`tr`is. Dr`tr`i ue
pnjri quk skrvk jk bnsk pnrn quk di`sns k pkssins pissne skr diepnrnjns k muagnjns.
qN jkf`i jk dr`tr`is jk r `sdi kfviavk jkd`j`r sibrk=> N fnturkzn k is t`pis jk difskqufd`ns n skrke `fdaujis k n ciren diei skri
ekj`jis.
> N enfk`rn pkan quna ns pribnb`a`jnjks skri rkprkskftnjns.
> I eiji diei ue fvka jk r`sdi skr jktkre`fnji.
> Is dr`tr`is quk firtknri n jkd`si pkai trntnekfti ji r`sdi.> Is pnrektris pnrn jkf`r qunfji ue r`sdi ndk`tvka k/iu tiakrvka.
> Tk ns dieb`fnks jk r`sdis skri tienjns ke difs`jkrni.
Is dr`tr`is pijke skr bnsknjis ke ciftks diei=
> Is ibmkt`vis ndirjnjis ji pridkssi?
> Is dr`tr`is `jkft`dnjis fi dnjkrfi jk kfdnrgis?> Ns ciftks jk jnjis?
> Dr`tr`is gkrnaekftk ndk`tis pkan `fjstr`n, diei fvk`s jk `ftkgr`jnjk, skgurnfn(ekalirks prt`dns)?
> I npkt`tk jk r`sdi jn irgnf`zni?
> Is rkqu`s`tis akgn`s duepr`jis pkan irgnf`zni?
> Iutris ntrnvs jk `fcirenks tdf`dns jk kqu`pnekftis kspkddis iu npa`dnks.
Is dr`tr`is n skrke njitnjis jkvke skr jktkre`fnjis ke dieue ndirji kftrk n kqu`pk
jk gksti jk r`sdis k n irgnf`zni. Dnsi n irgnf`zni m pissun dr`tr`is pnrn iutris s`s-
tkens jk gksti, kstks pijkri skr njnptnjis n jkpkfjkr jn jkenfjn, cnd`a`tnfji i kftkf-
j`ekfti jis dr`tr`is jk gksti jk r `sdis pir pnrtk jn irgnf`zni, pi`s skri skekalnftks
nis m ut`a`znjis pir iutris s`stkens jk gksti `epakekftnjis.
C`gurn 2.:
Kxkepai jk dr`tr`i
jk fvka jk r`sdi.
7/23/2019 Gesto de Riscos de TI - NBR 27005
47/156
4>
Dnptuai
2-Diftkxtijngkstijkr`sd
is
Fvka jk r`sdi Snair Jksdr`i
Jksprkzvka >
>Fi idirrke aksks, eirtks fn cirn jk trnbnali k/iu jk pkssinskxtkrfns keprksn. Xijke idirrkr dnsis jk pr `ek`ris sidirris iutrntnekfti ej`di (ske ncnstnekfti).
> Tke jnfis iu die jnfis `fs`gf`c`dnftks nis kqu`pnekftis k/iu`fstnanks.
>Is s`stkens jk Z@ c `dnrne cirn jk ipkrni pir nt ; e`futis.
Akvkekftkprkmuj`d`na
2
> Aksks akvks fn cirn jk trnbnali, nusfd`n jk aksi.>Jnfis akvks nis kqu`pnekftis iu `fstnanks, diftriavk`s k/iu jk
bn`xi dusti jk rkpnri.
>Is s`stkens jk Z@ c `dnrne cirn jk ipkrni pir nt 48 e`futis.
Xrkmuj`d`na 4
> Aksks jk grnv`jnjk eijkrnjn fn cirn jk trnbnali iu ke pkssinskxtkrfns keprksn.
> Aksks akvks ke pkssins kxtkrfns keprksn. Jnfis skvkris nkqu`pnekftis k/iu fstnanks.
>Is s`stkens jk Z@ c `dnrne cirn jk ipkrni nd`en jk 48 e`futis.Ke`ssi jk fitn c`sdna pir s`stken natkrfnt`vi. Fkdkss`jnjk jk rkdu-pkrnr bndoup.
Kxtrkenekftkprkmuj`d`na
;
>Xrividn eirtk iu aksks grnvks ke uen iu en`s pkssins (fn cirn jk trnbnali k/iu ke pkssins kxtkrfns keprksn).
>Jnfis rrkpnrvk`s n kqu`pnekftis iu fstnanks (rkpnrni akftniu epissvka).
>Nd`ifnji s`tk natkrfnt`vi. Xkrjn jk jnjis k fcirenks. Da`kftks skentkfj`ekfti titna.
Dnbk rkssnatnr quk kstks kxkepais privnvkaekftk fi sk npa`dne n qunaqukr t`pi jk
irgnf`zni, ens qukans pnrn ns qun`s cirne jkskfviav`jis. Kftrktnfti, cirfkdke uen
`jk`n sibrk n dr`ni jk dr`tr`is npa`dnjis s nt`v`jnjks jk gksti jk r`sdis. Fi jkdirrkr
jkstk dursi skri jkskfviav`jis dr`tr `is jurnftk n rkna`zni jns nt`v`jnjks.
Kxkrdd`i jk c`xni 4kJkc`f`fji is dr`tr`is
^uk dr`tr`is m kx`stke ntunaekftk fn sun irgnf`zni9 Must`quk.
Difs`jkrnfji i neb`kftk jn sun irgnf`zni, cnn n jksdr`i jis fvk`s bn`xi k
natss`ei jn Znbkan 2.;9 Must`quk.
Znbkan 2.;
Kxkepais jk
dr`tr`is jk
`epndti.
7/23/2019 Gesto de Riscos de TI - NBR 27005
48/156
42
Gksti
jkR`sdisjkZ@FBR
2788;
Irgnf`zni pnrn n gksti jk r`sdis
q> N jkf`i jis pnp`s k rkspifsnb`a`jnjks `epirtnftk pnrn i sudkssi ji pridkssijk gksti jk r`sdis.
> Jkvke skr jkf`jis=
2 I pridkssi jk gksti jk r `sdi njkqunji irgnf`zni.2 Ns pnrtks `ftkrkssnjns.
2 Is pnp`s k rkspifsnb`a`jnjks jns pnrtks kfviav`jns, ftkrfns k kxtkrfns irgnf`zni.
2 Ns rkanks fkdkssr`ns kftrk n irgnf`zni, suns pnrtks `ftkrkssnjns kiutris primktis.
2 N dnjk`n jk dieuf`dni k jk jkd`sks.
2 Is rkg`stris quk jkvke skr enft`jis.
2 Iutris rkg`stris quk ntkfjne n pnrt`duanr`jnjks kspkddns jk dnjn t`pijk irgnf`zni.
> Zijns kstns nt`v`jnjks jkvke gkrnr kv`jfd`ns pnrn n npa`dni jis pridkssis jkgksti jk r`sdis.
N jkf`i jis pnp`s k rkspifsnb`a`jnjks ue cntir `epirtnftk pnrn i sudkssi ji
pridkssi jk gksti jk r`sdis. Xnrn tna `sti jkvk kstnr cirenaekftk jkf`jn, dieuf`dnjn,
jiduekftnjn k nprivnjn pkais gkstirks jn natn nje`f`strni.
Jkvk dnr danri pnrn tijis is kfviav`jis quk i difmufti jkstns nt`v`jnjks jkvk gkrnr
kv`jfd`ns quk nux`a`ke pnrn uen npa`dni njkqunjn jis pridkssis jk gksti jk r`sdis.
Tkfji nss`e, `epirtnftk quk tijns ns `fcirenks k jnjis skmne jiduekftnjis pnrn i
dnsi jk uen cuturn nuj`tir`n.
Ak`turn diepakekftnr
> Tkssi 7 jn firen NBFZ FBR @TI/@KD 2788;.> Tkssks ;, 3 k 7 jn firen NBFZ FBR @TI/@KD 27882.
> Dnptuai ; ji a`vri I r`sdi jk Z@ (Jkskfviavkfji i pridkssi jk givkrfnfn jk r`sdi), jkGkirgk Wkstkrenf k R`dlnrj Luftkr= Lnrvnrj Bus`fkss Tdliia Xrkss, 288
7/23/2019 Gesto de Riscos de TI - NBR 27005
49/156
44
Dnptuai
2-Ritk`rijkNt`v`jnjks
Ritk`ri jk Nt`v`jnjks 2
S`si gkrna jn nt`v`jnjk
Tkri rkna`znjns ns nt`v`jnjks fkdkssr`ns pnrn n Jkf`i ji diftkxti. N gurn n skgu`r
nprkskftn grndnekftk n aidna`zni jkstns nt`v`jnjks fi pridkssi jk gksti jk r`sdis.
@JKFZ@C@DNI JK R@TDIT
NFA@TK JK R@TDIT
NDK@ZNI JI R@TDI
C@E JN XR@EK@RN I[ JNT JKEN@T @ZKRNKT
DIE[F@DNIKDIFT[AZNJIR@TDI
EIF@ZIRNEKFZIKNFA@TKDRZ@DNJ
KR@TDIT
XIFZI JK JKD@TI 2
Zrntnekfti snt`scntr`i
XIFZI JK JKD@TI >
Nvna`ni snt`scntr`n
Fi
T`e
Fi
T`e
XRIDKTTI JK NSNA@NI JK R@TDIT
ZRNZNEKFZI JI R@TDI
NSNA@NI JK R@TDIT
JKC@F@I JI DIFZK\ZI
N rkna`zni jkstn nt`v`jnjk jkvk skr ndiepnflnjn jn ak`turn jn firen NBFZ FBR @TI/@KD
2788;, ji entkr`na jk npi`i cirfkd`ji k n`fjn pkan v`vfd`n k kxpkr`fd`n ke sun irgnf`zni.Xnrn kstn nt`v`jnjk, i naufi jkvk sk vnakr ji Nfkxi N (Jksdr`i jn Keprksn), quk pkre`t`r
n dr`ni jk uen keprksn dtd`n iu n`fjn nux`a`nr ke naguens ibskrvnks sibrk sun irgn -
f`zni. N panf`aln jkstn nt`v`jnjk diepistn jk pkrguftns bs`dns pnrn i kftkfj`ekfti
ji diftkxti irgnf`znd`ifna.
N skqufd`n jns nt`v`jnjks skr=
>. Ak`turn jn Tki 7 k ji Nfkxi N jn firen NBFZ FBR @TI/@KD 2788;?
2. Ak`turn ji Nfkxi N (Jksdr `i jn Keprksn) jkstk dnjkrfi jk nt`v`jnjks?
4. Kxpa`dni k jkeifstrni pkai `fstrutir jn panf`aln jk nfa`sk jk r`sdi.
C`gurn 2.2
Nt`v`jnjks pnrn
n Jkf`i jidiftkxti.
7/23/2019 Gesto de Riscos de TI - NBR 27005
50/156
4:
Gksti
jkR`sdisjkZ@FBR
2788;
:. Kxkdui jns nt`v`jnjks jn panf`aln=
n. Kxkrdd`is jn gu`n Jkf`r Diftkxti
I ibmkt`vi jkstn nt`v`jnjk , ntrnvs jk rkspistns n naguens pkrguftns, jkskfviavkr fi naufi
i kftkfj`ekfti ji quk jkvk skr pkfsnji, panfkmnji k vkr`dnji ni jkf`reis i diftkxti.
Jkvke skr rkspifj`jns ns pkrguftns quk pkre`t`ri quk n kqu`pk jk nfa`sk jk r`sdi `jkft`-
quk k dieprkkfjn i diftkxti ji neb`kftk ifjk skr jkskfviav`jn n nfa`sk.
Xnrn dnjn tp`di jkvkri skr diaidnjns j`rk`tn ns ibskrvnks iu must`dnt`vns dirrkspifjkftks.
T pnssk pnrn n gu`n skgu`ftk nps difdau`r.
b. Kxkrdd`is jn gu`n Rkstr`ks
Kstn nt`v`jnjk difjuz ni kftkfj`ekfti jn epirtfd`n jn jkft`dni jns rkstr`ks kx`stkftks.
Fkstn gu`n skri `fskr`jns ns rkstr `ks npa`dvk`s irgnf`zni, jk ndirji die i Nfkxi N
jn NBFZ FBR @TI/@KD 2788;.
N diaufn Rkstr`ks nprkskftn uen a`stn bnsknjn fn firen, dnbkfji ni naufi ksdialkr ns
quk sk npa`dne k ksdrkvkr n must`dnt`vn.
Kx`stke rkstr`ks quk ncktne n irgnf`zni k rkstr`ks quk ncktne i ksdipi jn gksti jk r`sdis.
T pnssk pnrn n gu`n skgu`ftk nps difdau`r.
n. Kxkrdd`is jn gu`n Ksdipi
I ibmkt`vi jkstn nt`v`jnjk , ntrnvs jk rkspistns n naguens pkrguftns, jkskfviavkr fi
naufi i kftkfj`ekfti ji quk jkvk skr pkfsnji, panfkmnji k vkr`dnji ni jkf`reis i
ksdipi k skus a`e`tks.
Kstn gu`n nprkskftn kxkrdd`is pnrn quk n kqu`pk jk nfa`sk tkfln ue pkrck`ti kftkfj`-
ekfti ji ksdipi k skus a`e`tks. Xnrn dnjn tp`di jkvkri skr diaidnjns j`rk`tn ns ibskrvn-
ks dirrkspifjkftks.
T pnssk pnrn n gu`n skgu`ftk nps difdau`r.
b. Kxkrdd`is jn gu`n Dr`tr`is
Kstn gu`n nprkskftn ue kxkrdd`i pnrn pkre`t`r n jkf`i jis dr`tr`is quk skri trnbn-
alnjis jurnftk tijn n nfa`sk jk r`sdi.
Nqu` n kqu`pk jk nfa`sk jk r`sdi jn irgnf`zni ifjk rkna`znji i trnbnali, jkf`r is dr` -
tr`is quk difjuz`ri is trnbnalis jurnftk tiji i pridkssi. `epirtnftk quk kstks dr`tr`is
skmne cndtvk`s k va`jis pnrn i neb`kftk ji ksdipi jn gksti jk r`sdis k pnrn n irgnf`zni.
C`gurn 2.4
Recommended