Article 2 2.

are aligned to the financial entity’s information security objectives included in the digital operational resilience strategy referred to in Article 6(8) of Regulation (EU) 2022/2554;

indicate the date of the formal approval of the ICT security policies by the management body;

contain indicators and measures to:

specify the responsibilities of staff at all levels to ensure the financial entity’s ICT security;

specify the consequences of non-compliance by staff of the financial entity with the ICT security policies, where provisions to that effect are not laid down in other policies of the financial entity;

list the documentation to be maintained;

specify the segregation of duties arrangements in the context of the three lines of defence model or other internal risk management and control model, as applicable, to avoid conflicts of interest;

consider leading practices and, where applicable, standards as defined in Article 2, point (1), of Regulation (EU) No 1025/2012;

identify the roles and responsibilities for the development, implementation and maintenance of ICT security policies, procedures, protocols, and tools;

are reviewed in accordance with Article 6(5) of Regulation (EU) 2022/2554;

take into account material changes concerning the financial entity, including material changes to the activities or processes of the financial entity, to the cyber threat landscape, or to applicable legal obligations.