关键词: 商业银行, 信息系统, 风险识别方法, 风险基础库, 风险特征

Abstract: Risk identification is the basis of the information system security risk management of the commercial Banks. The known risks can be managed effectively and efficiency. However, there is not a feasible risk identification method and lack of the common information system risk database in the banking industry. Because of that, it may lead to take the control as the core rather than the risk. Based on the industry standards and practices at home and abroad, and thorough analysis of a large number of information system security risk incidents, this essay established the risk factor model, risk identification method and risk database. Those unified risk perception; achieved effective information system security risk identification; clearly defined objectives and priorities of risk management and control; improved the level of bank information technology risk management; strengthened risk control ability; and offered support to the innovation and development of banking fintech.

Key words: commercial bank, information system, risk identification, risk database, risk features