+COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)
---+TITLE I GENERAL PRINCIPLE
------+Article 1 Overall risk profile and complexity
---+TITLE II FURTHER HARMONISATION OF ICT RISK MANAGEMENT TOOLS, METHODS, PROCESSES, AND POLICIES IN ACCORDANCE WITH ARTICLE 15 OF REGULATION (EU) 2022/2554
------+CHAPTER I ICT Security policies, procedures, protocols, and tools
---------+Section 1
------------+Article 2 General elements of ICT security policies, procedures, protocols, and tools
---------------+Article 2 1.
---------------+Article 2 2.
---------+Section 2
------------+Article 3 ICT risk management
---------+Section 3 ICT asset management
------------+Article 4 ICT asset management policy
---------------+Article 4 1.
---------------+Article 4 2.
------------+Article 5 ICT asset management procedure
---------------+Article 5 1.
---------------+Article 5 2.
---------+Section 4 Encryption and cryptography
------------+Article 6 Encryption and cryptographic controls
---------------+Article 6 1.
---------------+Article 6 2.
---------------+Article 6 3.
---------------+Article 6 4.
---------------+Article 6 5.
------------+Article 7 Cryptographic key management
---------------+Article 7 1.
---------------+Article 7 2.
---------------+Article 7 3.
---------------+Article 7 4.
---------------+Article 7 5.
---------+Section 5 ICT operations security
------------+Article 8 Policies and procedures for ICT operations
---------------+Article 8 1.
---------------+Article 8 2.
------------+Article 9 Capacity and performance management
---------------+Article 9 1.
---------------+Article 9 2.
------------+Article 10 Vulnerability and patch management
---------------+Article 10 1.
---------------+Article 10 2.
---------------+Article 10 3.
---------------+Article 10 4.
------------+Article 11 Data and system security
---------------+Article 11 1.
---------------+Article 11 2.
------------+Article 12 Logging
---------------+Article 12 1.
---------------+Article 12 2.
---------+Section 6 Network security
------------+Article 13 Network security management
------------+Article 14 Securing information in transit
---------------+Article 14 1.
---------------+Article 14 2.
---------+Section 7 ICT project and change management
------------+Article 15 ICT project management
---------------+Article 15 1.
---------------+Article 15 2.
---------------+Article 15 3.
---------------+Article 15 4.
---------------+Article 15 5.
------------+Article 16 ICT systems acquisition, development, and maintenance
---------------+Article 16 1.
---------------+Article 16 2.
---------------+Article 16 3.
---------------+Article 16 4.
---------------+Article 16 5.
---------------+Article 16 6.
---------------+Article 16 7.
---------------+Article 16 8.
---------------+Article 16 9.
------------+Article 17 ICT change management
---------------+Article 17 1.
---------------+Article 17 2.
---------+Section 8
------------+Article 18 Physical and environmental security
---------------+Article 18 1.
---------------+Article 18 2.
------+CHAPTER II Human resources policy and access control
---------+Article 19 Human resources policy
---------+Article 20 Identity management
------------+Article 20 1.
------------+Article 20 2.
---------+Article 21 Access control
------+CHAPTER III ICT-related incident detection and response
---------+Article 22 ICT-related incident management policy
---------+Article 23 Anomalous activities detection and criteria for ICT-related incidents detection and response
------------+Article 23 1.
------------+Article 23 2.
------------+Article 23 3.
------------+Article 23 4.
------------+Article 23 5.
------------+Article 23 6.
------+CHAPTER IV ICT business continuity management
---------+Article 24 Components of the ICT business continuity policy
------------+Article 24 1.
------------+Article 24 2.
------------+Article 24 3.
------------+Article 24 4.
---------+Article 25 Testing of the ICT business continuity plans
------------+Article 25 1.
------------+Article 25 2.
------------+Article 25 3.
------------+Article 25 4.
------------+Article 25 5.
---------+Article 26 ICT response and recovery plans
------------+Article 26 1.
------------+Article 26 2.
------------+Article 26 3.
------------+Article 26 4.
------+CHAPTER V Report on the ICT risk management framework review
---------+Article 27 Format and content of the report on the review of the ICT risk management framework
------------+Article 27 1.
------------+Article 27 2.
---+TITLE III SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK FOR FINANCIAL ENTITIES REFERRED TO IN ARTICLE 16(1) OF REGULATION (EU) 2022/2554
------+CHAPTER I Simplified ICT risk management framework
---------+Article 28 Governance and organisation
------------+Article 28 1.
------------+Article 28 2.
------------+Article 28 3.
------------+Article 28 4.
------------+Article 28 5.
------------+Article 28 6.
---------+Article 29 Information security policy and measures
------------+Article 29 1.
------------+Article 29 2.
---------+Article 30 Classification of information assets and ICT assets
------------+Article 30 1.
------------+Article 30 2.
---------+Article 31 ICT risk management
------------+Article 31 1.
------------+Article 31 2.
------------+Article 31 3.
------------+Article 31 4.
---------+Article 32 Physical and environmental security
------------+Article 32 1.
------------+Article 32 2.
------------+Article 32 3.
------+CHAPTER II Further elements of systems, protocols, and tools to minimise the impact of ICT risk
---------+Article 33 Access Control
---------+Article 34 ICT operations security
---------+Article 35 Data, system and network security
---------+Article 36 ICT security testing
------------+Article 36 1.
------------+Article 36 2.
------------+Article 36 3.
---------+Article 37 ICT systems acquisition, development, and maintenance
---------+Article 38 ICT project and change management
------------+Article 38 1.
------------+Article 38 2.
------+CHAPTER III ICT business continuity management
---------+Article 39 Components of the ICT business continuity plan
------------+Article 39 1.
------------+Article 39 2.
---------+Article 40 Testing of business continuity plans
------------+Article 40 1.
------------+Article 40 2.
------------+Article 40 3.
------+CHAPTER IV Report on the review of the simplified ICT risk management framework
---------+Article 41 Format and content of the report on the review of the simplified ICT risk management framework
------------+Article 41 1.
------------+Article 41 2.
---+TITLE IV FINAL PROVISIONS
------+Article 42 Entry into force
 English - European Union - Financial Industry - DORA -

COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)

COMMISSION DELEGATED REGULATION (EU) 2024/1774

of 13 March 2024

supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework

(Text with EEA relevance)

This Regulation shall be binding in its entirety and directly applicable in all Member States.

1. Overview

,
TITLE I GENERAL PRINCIPLE TITLE I GENERAL PRINCIPLE
TITLE II FURTHER HARMONISATION OF ICT RISK MANAGEMENT TOOLS, METHODS, PROCESSES, AND POLICIES IN ACCORDANCE WITH ARTICLE 15 OF REGULATION (EU) 2022/2554 TITLE II FURTHER HARMONISATION OF ICT RISK MANAGEMENT TOOLS, METHODS, PROCESSES, AND POLICIES IN ACCORDANCE WITH ARTICLE 15 OF REGULATION (EU) 2022/2554
TITLE III SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK FOR FINANCIAL ENTITIES REFERRED TO IN ARTICLE 16(1) OF REGULATION (EU) 2022/2554 TITLE III SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK FOR FINANCIAL ENTITIES REFERRED TO IN ARTICLE 16(1) OF REGULATION (EU) 2022/2554
TITLE IV FINAL PROVISIONS TITLE IV FINAL PROVISIONS

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards

Linked Issues

Issuelinks
is related to New version: Delegierte Verordnung (EU) 2024/1774 (RTS IKT-Risikomanagement) (CELEX:32024R1774) – 176 new, 12 changed, 100 removed, 1 assignments
is related to New version: Delegierte Verordnung (EU) 2024/1774 (RTS IKT-Risikomanagement) (CELEX:02024R1774-20240625) – 0 new, 112 changed, 176 removed
is related to Assignments added: Delegierte Verordnung (EU) 2024/1774 (RTS IKT-Risikomanagement) (CELEX:02024R1774-20240625) – 1 assignments