Operational & Technology Risk Controls

Building Operational Resilience

Operational and technology risk controls provide the oversight and processes needed to manage risks that could impact business operations, technology platforms, cybersecurity or critical market services.

These controls promote operational resilience by helping DTCC prepare for disruptions, reinforce response capabilities and maintain the availability of key services under a wide range of conditions. They also help inform risk management, business planning and governance decisions across the enterprise.

Technology risk management supports this framework through information security oversight, risk assessments, threat monitoring and stakeholder engagement, helping promote resilience across DTCC and the markets we serve.

Operational Risk Management

Managing Risks Across Day-to-Day Operations

DTCC's operational risk management program helps identify, assess, monitor and manage risks that arise through day-to-day business activities.

The program enables a consistent approach for evaluating operational risks, understanding their potential impact and developing plans to mitigate or reduce exposure where appropriate.

Risk assessments, business planning activities and scenario analysis help DTCC identify potential vulnerabilities, enhance operational resilience and support informed decision-making across the enterprise

How We Strengthen Technology Risk Controls

Information security governance and oversight
Threat intelligence monitoring and response
Risk and control assessments
Technology risk reporting and management
Ongoing evaluation of emerging threats and vulnerabilities
Regulatory and client engagement

Emerging & Systemic Risk

Monitoring Emerging Threats and Interconnected Risks

DTCC's Emerging and Systemic Risk function helps identify and evaluate risks that could affect DTCC, its participants or the broader financial system.

As a designated Systemically Important Financial Market Utility (SIFMU), DTCC continually assesses external and internal developments, emerging trends and interconnected risks that could impact market stability or critical infrastructure.

This work helps DTCC better understand evolving risks and enhance preparedness across the organization and the markets it supports.

Systemic Risk Barometer

White Papers

Press Releases

DTCC Identifies Key Systemic Threats That Require Close Monitoring Amid Rapidly-Evolving Risk Landscape

Business Continuity

Supporting Continuity During Disruptions

Business continuity planning helps DTCC maintain the availability of critical services and help maintain the continued functioning of financial markets during disruptive events.

DTCC takes a coordinated approach across its global operations to promote preparedness, response and recovery activities. This includes ongoing testing, employee training, crisis management planning and collaboration across the financial services sector.

These efforts help promote operational resilience and support the continued availability of critical market infrastructure.

For further information, please visit Operational Resilience at DTCC.

Cybersecurity Risk

Maintaining Cyber Resilience

Cybersecurity risk management helps DTCC identify, monitor and respond to evolving cyber threats while protecting the security and resilience of critical financial market infrastructure.

DTCC's approach combines technology controls, threat intelligence, risk monitoring and industry collaboration to help protect systems, data and market operations. The program also enhances cyber resilience across the broader financial ecosystem through information sharing, client engagement and alignment with recognized security frameworks.

As technology and threat landscapes continue to evolve, DTCC remains focused on reducing cyber risk while supporting secure innovation and operational resilience.

Key Focus Areas

Threat monitoring and intelligence
Vulnerability and patch management
Identity and access management
Network security and segmentation
Cyber resilience and incident response
Industry collaboration and information sharing

Industry Resources

The internationally recognized standard “ISO/IEC 27001:2013 – Information technology – Security techniques – Information security management systems – requirements”.
The FFIEC Information Technology (IT) Examination Handbook, which is comprised of several booklets covering a variety of technology and technology-related risk management guidance for financial institutions and examiners.
The NIST Cybersecurity Framework (NIST CSF) consisting of standards, guidelines, and practices to promote the protection of critical infrastructure.
The Cyber Risk Institute Cybersecurity Profile, which is a scalable and extensible assessment that financial institutions of all types can use for cyber risk management assessment and as a mechanism to evidence compliance with various regulatory frameworks.

Post-Quantum Security Considerations for the Financial Industry brings this near-term risk into focus for the financial industry, to identify initial steps financial institutions can take, and to provoke a more intentional dialog about how the industry can act now to ward off post-quantum risk.

Managing Risks Across Day-to-Day Operations

DTCC's operational risk management program helps identify, assess, monitor and manage risks that arise through day-to-day business activities.

The program enables a consistent approach for evaluating operational risks, understanding their potential impact and developing plans to mitigate or reduce exposure where appropriate.

How We Strengthen Technology Risk Controls

Information security governance and oversight
Threat intelligence monitoring and response
Risk and control assessments
Technology risk reporting and management
Ongoing evaluation of emerging threats and vulnerabilities
Regulatory and client engagement

Operational & Technology Risk Controls

Operational & Technology Risk Management

Building Operational Resilience

Managing Risks Across Day-to-Day Operations

How We Strengthen Technology Risk Controls