+DORA Ch. II ICT risk management
---+DORA Ch. II Sec. I Art. 5 Governance and organisation
------+DORA Ch. II Sec. I Art. 5 1.
------+DORA Ch. II Sec. I Art. 5 2.
------+DORA Ch. II Sec. I Art. 5 3.
------+DORA Ch. II Sec. I Art. 5 4.
---+DORA Ch. II Sec. II Art. 6 ICT risk management framework
------+DORA Ch. II Sec. II Art. 6 1.
------+DORA Ch. II Sec. II Art. 6 2.
------+DORA Ch. II Sec. II Art. 6 3.
------+DORA Ch. II Sec. II Art. 6 4.
------+DORA Ch. II Sec. II Art. 6 5.
------+DORA Ch. II Sec. II Art. 6 6.
------+DORA Ch. II Sec. II Art. 6 7.
------+DORA Ch. II Sec. II Art. 6 8.
------+DORA Ch. II Sec. II Art. 6 9.
------+DORA Ch. II Sec. II Art. 6 10.
---+DORA Ch. II Sec. II Art. 7 ICT systems, protocols and tools
---+DORA Ch. II Sec. II Art. 8 Identification
------+DORA Ch. II Sec. II Art. 8 1.
------+DORA Ch. II Sec. II Art. 8 2.
------+DORA Ch. II Sec. II Art. 8 3.
------+DORA Ch. II Sec. II Art. 8 4.
------+DORA Ch. II Sec. II Art. 8 5.
------+DORA Ch. II Sec. II Art. 8 6.
------+DORA Ch. II Sec. II Art. 8 7.
---+DORA Ch. II Sec. II Art. 9 Protection and prevention
------+DORA Ch. II Sec. II Art. 9 1.
------+DORA Ch. II Sec. II Art. 9 2.
------+DORA Ch. II Sec. II Art. 9 3.
------+DORA Ch. II Sec. II Art. 9 4.
---+DORA Ch. II Sec. II Art. 10 Detection
------+DORA Ch. II Sec. II Art. 10 1.
------+DORA Ch. II Sec. II Art. 10 2.
------+DORA Ch. II Sec. II Art. 10 3.
------+DORA Ch. II Sec. II Art. 10 4.
---+DORA Ch. II Sec. II Art. 11 Response and recovery
------+DORA Ch. II Sec. II Art. 11 1.
------+DORA Ch. II Sec. II Art. 11 2.
------+DORA Ch. II Sec. II Art. 11 3.
------+DORA Ch. II Sec. II Art. 11 4.
------+DORA Ch. II Sec. II Art. 11 5.
------+DORA Ch. II Sec. II Art. 11 6.
------+DORA Ch. II Sec. II Art. 11 7.
------+DORA Ch. II Sec. II Art. 11 8.
------+DORA Ch. II Sec. II Art. 11 9.
------+DORA Ch. II Sec. II Art. 11 10.
------+DORA Ch. II Sec. II Art. 11 11.
---+DORA Ch. II Sec. II Art. 12 Backup policies and procedures, restoration and recovery procedures and methods
------+DORA Ch. II Sec. II Art. 12 1.
------+DORA Ch. II Sec. II Art. 12 2.
------+DORA Ch. II Sec. II Art. 12 3.
------+DORA Ch. II Sec. II Art. 12 4.
------+DORA Ch. II Sec. II Art. 12 5.
------+DORA Ch. II Sec. II Art. 12 6.
------+DORA Ch. II Sec. II Art. 12 7.
---+DORA Ch. II Sec. II Art. 13 Learning and evolving
------+DORA Ch. II Sec. II Art. 13 1.
------+DORA Ch. II Sec. II Art. 13 2.
------+DORA Ch. II Sec. II Art. 13 3.
------+DORA Ch. II Sec. II Art. 13 4.
------+DORA Ch. II Sec. II Art. 13 5.
------+DORA Ch. II Sec. II Art. 13 6.
------+DORA Ch. II Sec. II Art. 13 7.
---+DORA Ch. II Sec. II Art. 14 Communication
------+DORA Ch. II Sec. II Art. 14 1.
------+DORA Ch. II Sec. II Art. 14 2.
------+DORA Ch. II Sec. II Art. 14 3.
---+DORA Ch. II Sec. II Art. 15 Further harmonisation of ICT risk management tools, methods, processes and policies
---+DORA Ch. II Sec. II Art. 16 Simplified ICT risk management framework
------+DORA Ch. II Sec. II Art. 16 1.
------+DORA Ch. II Sec. II Art. 16 2.
------+DORA Ch. II Sec. II Art. 16 3.
---+DORA Ch. III ICT-related incident management, classification and reporting
------+DORA Ch. III Art. 17 ICT-related incident management process
---------+DORA Ch. III Art. 17 1.
---------+DORA Ch. III Art. 17 2.
---------+DORA Ch. III Art. 17 3.
------+DORA Ch. III Art. 18 Classification of ICT-related incidents and cyber threats
---------+DORA Ch. III Art. 18 1.
---------+DORA Ch. III Art. 18 2.
---------+DORA Ch. III Art. 18 3.
---------+DORA Ch. III Art. 18 4.
------+DORA Ch. III Art. 19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
---------+DORA Ch. III Art. 19 1.
---------+DORA Ch. III Art. 19 2.
---------+DORA Ch. III Art. 19 3.
---------+DORA Ch. III Art. 19 4.
---------+DORA Ch. III Art. 19 5.
---------+DORA Ch. III Art. 19 6.
---------+DORA Ch. III Art. 19 7.
---------+DORA Ch. III Art. 19 8.
------+DORA Ch. III Art. 20 Harmonisation of reporting content and templates
------+DORA Ch. III Art. 21 Centralisation of reporting of major ICT-related incidents
---------+DORA Ch. III Art. 21 1.
---------+DORA Ch. III Art. 21 2.
---------+DORA Ch. III Art. 21 3.
------+DORA Ch. III Art. 22 Supervisory feedback
---------+DORA Ch. III Art. 22 1.
---------+DORA Ch. III Art. 22 2.
------+DORA Ch. III Art. 23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
|
1. Overview
DORA Ch. II ICT risk management
ICT risk management
| Summary |
Regulation |
|
DORA Ch. II Sec. I Art. 5 Governance and organisation
|
Governance and organisation
|
|
DORA Ch. II Sec. II Art. 6 ICT risk management framework
|
ICT risk management framework
|
|
DORA Ch. II Sec. II Art. 7 ICT systems, protocols and tools
|
ICT systems, protocols and tools
In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are:
- (a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;
- (b) reliable;
- (c) equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and to deal with peak orders, message or transaction volumes, as needed, including where new technology is introduced;
- (d) technologically resilient in order to adequately deal with additional information processing needs as required under stressed market conditions or other adverse situations.
|
|
DORA Ch. II Sec. II Art. 8 Identification
|
Identification
|
|
DORA Ch. II Sec. II Art. 9 Protection and prevention
|
Protection and prevention
|
|
DORA Ch. II Sec. II Art. 10 Detection
|
Detection
|
|
DORA Ch. II Sec. II Art. 11 Response and recovery
|
Response and recovery
|
|
DORA Ch. II Sec. II Art. 12 Backup policies and procedures, restoration and recovery procedures and methods
|
Backup policies and procedures, restoration and recovery procedures and methods
|
|
DORA Ch. II Sec. II Art. 13 Learning and evolving
|
Learning and evolving
|
|
DORA Ch. II Sec. II Art. 14 Communication
|
Communication
|
|
DORA Ch. II Sec. II Art. 15 Further harmonisation of ICT risk management tools, methods, processes and policies
|
The ESAs shall, through the Joint Committee, in consultation with the European Union Agency on Cybersecurity (ENISA), develop common draft regulatory technical standards in order to:
- (a) specify further elements to be included in the ICT security policies, procedures, protocols and tools referred to in Article 9(2), with a view to ensuring the security of networks, enable adequate safeguards against intrusions and data misuse, preserve the availability, authenticity, integrity and confidentiality of data, including cryptographic techniques, and guarantee an accurate and prompt data transmission without major disruptions and undue delays;
- (b) develop further components of the controls of access management rights referred to in Article 9(4), point (c), and associated human resource policy specifying access rights, procedures for granting and revoking rights, monitoring anomalous behaviour in relation to ICT risk through appropriate indicators, including for network use patterns, hours, IT activity and unknown devices;
- (c) develop further the mechanisms specified in Article 10(1) enabling a prompt detection of anomalous activities and the criteria set out in Article 10(2) triggering ICT-related incident detection and response processes;
- (d) specify further the components of the ICT business continuity policy referred to in Article 11(1);
- (e) specify further the testing of ICT business continuity plans referred to in Article 11(6) to ensure that such testing duly takes into account scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails, and duly considers the potential impact of the insolvency, or other failures, of any relevant ICT third-party service provider and, where relevant, the political risks in the respective providers’ jurisdictions;
- (f) specify further the components of the ICT response and recovery plans referred to in Article 11(3);
- (g) specifying further the content and format of the report on the review of the ICT risk management framework referred to in Article 6(5);
When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations, while duly taking into consideration any specific feature arising from the distinct nature of activities across different financial services sectors.
The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.
Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first paragraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
|
|
DORA Ch. II Sec. II Art. 16 Simplified ICT risk management framework
|
Simplified ICT risk management framework
|
|
DORA Ch. III ICT-related incident management, classification and reporting
|
ICT-related incident management, classification and reporting
|
1.1 References
1.2 Identified Requirements
1.3 Related Standards
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Standards
Standards
| Source |
Requirement |
Linked Issues
|