Cybersecurity at Davy

The protection of our clients’ data and assets is our highest priority and underpins the trust our clients place in us.

Cyber threats continue to evolve in scale and sophistication. We maintain a comprehensive cyber security and operational resilience programme designed to protect client information and the technology services we use to support our clients.

Our approach combines experienced people, established processes, external expertise and layered technology controls. As a member of the Bank of Ireland Group, Davy benefits from the Group’s scale, resources and expertise, while maintaining our own cyber security governance and control environment. We are also supported by leading global specialist firms that provide technology services, threat intelligence, security testing and independent assurance. We invest significantly in our cybersecurity and operational resilience programme which is senior management led and subject to Board oversight.

Our cybersecurity and operational resilience programme is built around eight core areas of protection:

1. Governance: Cybersecurity is overseen through established governance arrangements involving senior management and the Board, supported by policies, defined responsibilities, risk oversight and assurance. Our approach is aligned with applicable Irish and EU regulatory requirements and guidance.
2. Identification: We monitor the changing threat landscape, identify important services, information and technology assets, and use risk assessment, threat intelligence and security testing to guide priorities.
3. Protection: We apply layered administrative, technical and physical safeguards. These include access controls, authentication, device and network security, encryption, secure data handling and employee awareness.
4. Monitor: Our technology environment is monitored for suspicious activity, attacks and indicators of compromise. Security information is analysed to support timely investigation of potential events.
5. Response: We maintain a cyber-incident response programme with defined responsibilities, escalation and decision-making arrangements to investigate, contain and address threats and meet applicable obligations.
6. Resilience: Business continuity, backup, recovery and operational resilience arrangements support the restoration of important services. These arrangements are tested, reviewed and improved.
7. Technology partner oversight: We apply a risk-based approach to relevant technology partners, including security due diligence, contractual requirements, ongoing oversight and consideration of continuity and recovery arrangements.
8. Independent assurance: Our controls are subject to internal review and independent assessment, including security testing, control assurance and internal audit. As an Irish regulated financial services firm, Davy is also subject to regulatory oversight by the Central Bank of Ireland

Communication

Cybersecurity and operational resilience is embedded in our client engagements. Through our websites and myDavy portal, we keep clients apprised of our cybersecurity processes and protocols as well as emerging risks, lookouts and guidance for clients on identifying and mitigating risk.

Continuous monitoring

We continuously monitor the evolving threat environment and strengthen our cyber security and operational resilience capabilities accordingly. Ongoing investment, testing, independent assessment and lessons from exercises and industry developments help us keep our controls effective and aligned with emerging risks.