RTS RTS on ICT risk management and on the simplified ICT risk management framework
This is the regulatory technical standard (RTS) on ICT risk management framework as adopted by the European Commission according to DORA Article 15 and 16 using the preliminary version published on EUR-Lex on 13 March 2024 as source.
This text is provided as-is and should not be relied upon as an authoritative source. Instead consult the Official Journal final version which is published on EUR-Lex as of 25 June 2024.
We are not aware of any material differences between the preliminary and authoritative versions but will make sure to update these pages to reflect the authoritative as soon as possible.
The full name of the RTS is Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework.
Our commitment is to continuously enhance this platform, improving readability and navigation for your convenience. Stay updated on our progress by following us on LinkedIn, where we announce new features. If you have any questions or suggestions, please feel free to reach out to us at dora@springflod.se.
Enjoy.
Table of Contents
Preamble
1 – 30
Recitals
Title I
General principle
Article 1
Overall risk profile and complexity
Title II
Further harmonisation of ICT risk management tools, methods, processes, and policies in accordance with article 15 of regulation (EU) 2022/2554
Chapter I
ICT security policies, procedures, protocols, and tools
Section I
Article 2
General elements of ICT security policies, procedures, protocols, and tools
Section II
Article 3
ICT risk management
Section III
ICT asset management
Article 4
ICT asset management policy
Article 5
ICT asset management procedure
Section IV
Encryption and cryptography
Article 6
Encryption and cryptographic controls
Article 7
Cryptographic key management
Section V
ICT operations security
Article 8
Policies and procedures for ICT operations
Article 9
Capacity and performance management
Article 10
Vulnerability and patch management
Article 11
Data and system security
Article 12
Logging
Section VI
Network security
Article 13
Network security management
Article 14
Securing information in transit
Section VII
ICT project and change management
Article 15
ICT project management
Article 16
ICT systems acquisition, development, and maintenance
Article 17
ICT change management
Section VIII
Article 18
Physical and environmental security
Chapter II
Human resources policy and access control
Article 19
Human resources policy
Article 20
Identity management
Article 21
Access control
Chapter III
ICT-related incident detection and response
Article 22
ICT-related incident management policy
Article 23
Anomalous activities detection and criteria for ICT-related incidents detection and response
Chapter IV
ICT business continuity management
Article 24
Components of the ICT business continuity policy
Article 25
Testing of the ICT business continuity plans
Article 26
ICT response and recovery plans
Chapter V
Report on the ICT risk management framework review
Article 27
Format and content of the report on the review of the ICT risk management framework
Title III
Simplified ICT risk management framework for financial entities referred to in article 16(1) of regulation (EU) 2022/2554
Chapter I
Simplified ICT risk management framework
Article 28
Governance and organisation
Article 29
Information security policy and measures
Article 30
Classification of information assets and ICT assets
Article 31
ICT risk management
Article 32
Physical and environmental security
Chapter II
Further elements of systems, protocols, and tools to minimise the impact of ICT risk
Article 33
Access Control
Article 34
ICT operations security
Article 35
Data, system and network security
Article 36
ICT security testing
Article 37
ICT systems acquisition, development, and maintenance
Article 38
ICT project and change management
Chapter III
ICT business continuity management
Article 39
Components of the ICT business continuity plan
Article 40
Testing of business continuity plans
Chapter IV
Report on the review of the simplified ICT risk management framework
Article 41
Format and content of the report on the review of the simplified ICT risk management framework
Title IV
Final provisions
Article 42
Entry into force