Simplified ICT risk management framework

Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firmsan investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 of the European Parliament and of the Council, payment institutionsa payment institution as defined in Article 4, point (4), of Directive (EU) 2015/2366 exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EUan entity as referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutionsan electronic money institution as defined in Article 2, point (1), of Directive 2009/110/EC of the European Parliament and of the Council exempted pursuant to Directive 2009/110/EC; and small institutions for occupational retirement provisionan institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total.

Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:

1. put in place and maintain a sound and documented ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment, including for the protection of relevant physical components and infrastructures;

2. continuously monitor the security and functioning of all ICT systems;

3. minimise the impact of ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systemsa network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555;

4. allow sources of ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment and anomalies in the network and information systemsa network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555 to be promptly identified and detected and ICT-related incidentsa single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity to be swiftly handled;

5. identify key dependencies on ICT third-party service providersan undertaking providing ICT services;

6. ensure the continuity of critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;

7. test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c);

8. implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from post-incident analysis into the ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment assessment process and develop, according to needs and ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment profile, ICT security awareness programmes and digital operational resiliencethe ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions training for staff and management.