4.   As part of the ICT risk management framework referred to in Article 6(1), financial entities shall:

• (a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;
• (b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;
  • For the purposes of the first subparagraph, point (b), financial entities shall design the network connection infrastructure in a way that allows it to be instantaneously severed or segmented in order to minimise and prevent contagion, especially for interconnected financial processes.
• (c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;
• (d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;
• (e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;
  • For the purposes of the first subparagraph, point (e), the ICT change management process shall be approved by appropriate lines of management and shall have specific protocols in place.
• (f) have appropriate and comprehensive documented policies for patches and updates.

Financial entities shall, as part of the safeguards ensuring the security of networks against intrusions and data misuse, develop, document, and implement policies, procedures, protocols, and tools on network security management, including all of the following:

• (a) the segregation and segmentation of ICT systems and networks taking into account:
  • (i) the criticality or importance of the function those ICT systems and networks support;
  • (ii) the classification established in accordance with Article 8(1) of Regulation (EU) 2022/2554;
  • (iii) the overall risk profile of ICT assets using those ICT systems and networks;"
• (b) the documentation of all of the financial entity’s network connections and data flows;
• (c) the use of a separate and dedicated network for the administration of ICT assets;
• (d) the identification and implementation of network access controls to prevent and detect connections to the financial entity’s network by any unauthorised device or system, or any endpoint not meeting the financial entity’s security requirements;
• (e) the encryption of network connections passing over corporate networks, public networks, domestic networks, thirdparty networks, and wireless networks, for communication protocols used, taking into account the results of the approved data classification, the results of the ICT risk assessment and the encryption of network connections referred to in Article 6(2);
• (f) the design of networks in line with the ICT security requirements established by the financial entity, taking into account leading practices to ensure the confidentiality, integrity, and availability of the network;
• (g) the securing of network traffic between the internal networks and the internet and other external connections;
• (h) the identification of the roles and responsibilities and steps for the specification, implementation, approval, change, and review of firewall rules and connections filters;
  • For the purposes of point (h), financial entities shall perform the review of firewall rules and connections filters on a regular basis in accordance with the classification established in accordance with Article 8(1) of Regulation (EU) 2022/2554 and the overall risk profile of ICT systems involved. For ICT systems that support critical or important functions, financial entities shall verify the adequacy of the existing firewall rules and connection filters at least every 6 months.
• (i) the performance of reviews of the network architecture and of the network security design once a year, and periodically for microenterprises, to identify potential vulnerabilities;
• (j) the measures to temporarily isolate, where necessary, subnetworks, and network components and devices;
• (k) the implementation of a secure configuration baseline of all network components, and the hardening of the network and of network devices in line with any vendor instructions, where applicable standards, as defined in Article 2, point (1), of Regulation (EU) No 1025/2012, and leading practices;
• (l) the procedures to limit, lock, and terminate system and remote sessions after a specified period of inactivity;
• (m) for network services agreements:
  • (i) the identification and specification of ICT and information security measures, service levels, and management requirements of all network services;
  • (ii) whether those services are provided by an ICT intra-group service provider or by ICT third-party service providers.