DORA

Requirements and controls

• Chapter II ICT risk management

  • Art. 5 Governance and organisation

    • Art. 5(1) ICT governance and internal control framework

      The entity runs an internal governance and control framework that manages ICT risk effectively and prudently, so that it reaches a high level of digital operational resilience.

      • Security Governance Program
      • Assigned Security & Privacy Responsibilities
      • Security & Privacy Program Review
      • Risk Framing
      • Information Security & Privacy Policies

    • Art. 5(2) Management body accountability for ICT risk

      The management body defines, approves and oversees the ICT risk management arrangements and keeps final responsibility for them, including the resilience strategy and risk tolerance, continuity and audit plans, the ICT budget, the third-party policy and reporting lines on ICT providers and major incidents.

      • Security & Privacy Program Review
      • Management Review of Policies
      • Management Review of Risks
      • Management Review of Third-Party Risks
      • Assigned Security & Privacy Responsibilities

    • Art. 5(3) Role overseeing ICT third-party arrangements

      Except for microenterprises, the entity sets up a role to monitor its arrangements with ICT third-party service providers, or makes a member of senior management responsible for the related risk exposure and documentation.

      • Vendor Management Policy & Procedure
      • Management Review of Third-Party Risks
      • Third-Party Criticality Assessments
      • Register of ICT Third-Party Arrangements

    • Art. 5(4) ICT risk knowledge of the management body

      Members of the management body keep their knowledge and skills on ICT risk up to date, including through regular training proportionate to the risk being managed.

      • Periodic Security & Privacy Training
      • New Hire Security & Privacy Training
      • Security & Privacy Awareness

  • Art. 6 ICT risk management framework

    • Art. 6(1) Documented ICT risk management framework

      A sound, comprehensive and documented ICT risk management framework forms part of the overall risk management system and lets the entity deal with ICT risk quickly and thoroughly.

      • Security Governance Program
      • Risk Assessment Policy & Procedure
      • Risk Framing
      • Information Security & Privacy Policies
      • ISMS Manual

    • Art. 6(2) Protection of information and ICT assets

      The framework contains the strategies, policies, procedures, protocols and tools needed to protect all information and ICT assets, including software, hardware, servers and physical sites such as premises and data centres, from damage and unauthorised access or use.

      • Information Security & Privacy Policies
      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Physical Protection Policy & Procedure
      • Access Control Policy & Procedure

    • Art. 6(3) Minimising ICT risk and informing authorities

      The entity deploys the strategies and tools of its framework to limit the impact of ICT risk, and gives its competent authority complete and current information on ICT risk and on the framework when asked.

      • Risk Assessment
      • Risk Framing
      • Statutory, Regulatory & Contractual Compliance

    • Art. 6(4) Independent ICT risk control function

      Except for microenterprises, managing and overseeing ICT risk is assigned to a control function with appropriate independence, and ICT risk management, control and internal audit functions are kept separate, for example under the three lines of defence model.

      • Assigned Security & Privacy Responsibilities
      • Segregation of Duties
      • Internal Audit
      • Roles & Responsibilities

    • Art. 6(5) Yearly review of the framework

      The framework is reviewed at least once a year (periodically for microenterprises), after major ICT-related incidents and after supervisory instructions or testing and audit conclusions, it is improved from lessons learned, and a review report is available to the authority on request.

      • Management Review of Policies
      • Security & Privacy Program Review
      • Management Review of Risks
      • Information Security & Privacy Policies

    • Art. 6(6) Internal audit of the framework

      Except for microenterprises, auditors with ICT risk expertise and appropriate independence audit the framework regularly under the audit plan, with frequency and focus matched to the entity's ICT risk.

      • Internal Audit
      • Security & Privacy Program Review

    • Art. 6(7) Follow-up of ICT audit findings

      A formal follow-up process, with rules for verifying and remediating critical ICT audit findings in good time, acts on the conclusions of internal audit.

      • Internal Audit
      • Security & Privacy Program Review

    • Art. 6(8) Digital operational resilience strategy

      The framework includes a resilience strategy explaining how ICT risk management supports business objectives, setting the ICT risk tolerance and impact tolerance for disruptions, defining security objectives with indicators, and covering reference architecture, incident detection, resilience testing and incident communication.

      • Risk Framing
      • Security Governance Program
      • Security & Privacy Program Review
      • Business Continuity Policy & Procedure

  • Art. 7 ICT systems, protocols and tools

    The ICT systems, protocols and tools used are kept up to date, reliable, sized to process the data the business needs including peak volumes, and resilient enough to cope with stressed market conditions.

    • Capacity & Performance Management
    • Impact Analysis
    • Vulnerability Remediation Process
    • Data Backups

  • Art. 8 Identification

    • Art. 8(1) Identification and classification of functions and assets

      All ICT-supported business functions, roles and responsibilities, and the information and ICT assets supporting them, are identified, classified and documented with their dependencies, and the classification is reviewed at least once a year.

      • Inventory of Infrastructure Assets
      • Data Classification Labels
      • Impact Analysis
      • Roles & Responsibilities
      • Data Classification Policy

    • Art. 8(2) Continuous identification of ICT risk sources

      Sources of ICT risk, including exposure to and from other financial entities, relevant cyber threats and vulnerabilities, are identified on an ongoing basis, and the risk scenarios affecting the entity are reviewed at least once a year.

      • Risk Assessment
      • Risk Framing
      • Vulnerability Remediation Process
      • Anomalous Behavior Detection
      • Management Review of Risks

    • Art. 8(3) Risk assessment on major changes

      Except for microenterprises, a risk assessment is carried out whenever the network and information system infrastructure, or a process affecting ICT-supported functions or assets, changes significantly.

      • Risk Assessment
      • Risk Framing
      • Change Management Policy & Procedure

    • Art. 8(4) Asset inventory and configuration mapping

      All information and ICT assets, including those on remote sites, network resources and hardware, are identified, the critical ones are mapped, and their configuration, links and interdependencies are documented.

      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Network & Data Flow Diagrams
      • Asset Inventory Updates
      • Asset Ownership Assignment

    • Art. 8(5) Dependencies on ICT third-party providers

      Processes that depend on ICT third-party service providers are identified and documented, together with the interconnections to providers supporting critical or important functions.

      • Register of ICT Third-Party Arrangements
      • Third-Party Criticality Assessments
      • Network & Data Flow Diagrams
      • Subservice Organization Evaluation

    • Art. 8(6) Maintenance of inventories

      The inventories of functions, assets and third-party dependencies are kept current, updated periodically and after every major change.

      • Asset Inventory Updates
      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Register of ICT Third-Party Arrangements

    • Art. 8(7) Risk assessment of legacy ICT systems

      Except for microenterprises, a specific ICT risk assessment covers all legacy systems at least once a year and before and after connecting new technologies, applications or systems.

      • Risk Assessment
      • Risk Framing
      • Vulnerability Remediation Process

  • Art. 9 Protection and prevention

    • Art. 9(1) Continuous monitoring of ICT security

      The security and functioning of ICT systems and tools are monitored and controlled continuously, with security tools, policies and procedures that limit the impact of ICT risk.

      • Anomalous Behavior Detection
      • Centralized Security Logging
      • Capacity & Performance Management
      • Unauthorized Activity Monitoring

    • Art. 9(2) Security policies for availability, integrity and confidentiality

      ICT security policies, procedures, protocols and tools keep ICT systems resilient and available, especially those supporting critical or important functions, and protect data at rest, in use and in transit.

      • Information Security & Privacy Policies
      • Encryption of Data at Rest
      • Transmission Confidentiality
      • Data Backups
      • Encryption Policy & Procedure

    • Art. 9(3) Secure data transfer and handling

      The ICT solutions in use secure data transfers, reduce the risk of data corruption or loss, unauthorised access and technical flaws, and protect data from poor administration, processing risks and human error.

      • Transmission Confidentiality
      • Encryption of Data at Rest
      • Data Backups
      • Production Database Access Restriction

    • Art. 9(4)(a) Information security policy

      A documented information security policy sets the rules for protecting the availability, authenticity, integrity and confidentiality of data and of information and ICT assets, including customer data.

      • Security Governance Program
      • Information Security & Privacy Policies
      • Management Review of Policies

    • Art. 9(4)(b) Network and infrastructure management

      Networks and infrastructure are managed with a risk-based structure that can isolate affected assets during a cyber-attack, and network connections are designed so they can be cut or segmented immediately to stop contagion.

      • External System Connections
      • Limit Network Connections
      • Network Security Policy & Procedure
      • Network & Data Flow Diagrams

    • Art. 9(4)(c) Restriction of access

      Physical and logical access to information and ICT assets is limited to what legitimate, approved activities need, through policies, procedures and controls that manage access rights soundly.

      • Access Control Policy & Procedure
      • Identity Validation
      • Production Database Access Restriction
      • User Privilege Reviews
      • User Access Reviews
      • Physical Protection Policy & Procedure

    • Art. 9(4)(d) Strong authentication and protection of keys

      Strong authentication based on recognised standards is in place, cryptographic keys are protected, and encryption is applied according to data classification and ICT risk assessment results.

      • Multi-Factor Authentication
      • Encryption Policy & Procedure
      • Encryption of Data at Rest
      • Data Classification Labels

    • Art. 9(4)(e) ICT change management

      Documented, risk-based change management approved by the appropriate management ensures every change to software, hardware, firmware, systems or security settings is recorded, tested, assessed, approved, implemented and verified in a controlled way.

      • Change Management Policy & Procedure
      • Approval of Changes
      • Secure System Modification
      • Regression Testing

    • Art. 9(4)(f) Patch and update policies

      Documented policies set out how patches and updates are managed and applied.

      • Vulnerability Management Policy & Procedure
      • Vulnerability Remediation Process
      • Endpoint Security Validation
      • Centralized Flaw Remediation

  • Art. 10 Detection

    • Art. 10(1) Detection of anomalous activities

      Mechanisms promptly detect anomalous activity, network performance problems and ICT-related incidents, identify material single points of failure, and are tested regularly.

      • Anomalous Behavior Detection
      • Centralized Security Logging
      • Capacity & Performance Management
      • Impact Analysis

    • Art. 10(2) Alert thresholds and escalation

      Detection uses several layers of control with defined alert thresholds and criteria that start incident response, including automatic alerts to the staff in charge of it.

      • Automated Incident Reporting
      • Capacity & Performance Management
      • Anomalous Behavior Detection
      • Incident Management Policy & Procedure

    • Art. 10(3) Resources for monitoring

      Enough resources and capabilities are dedicated to monitoring user activity, ICT anomalies and incidents, in particular cyber-attacks.

      • Unauthorized Activity Monitoring
      • Centralized Security Logging
      • Anomalous Behavior Detection
      • Assigned Security & Privacy Responsibilities

  • Art. 11 Response and recovery

    • Art. 11(1) ICT business continuity policy

      A comprehensive ICT business continuity policy, based on the identification work under Article 8, is part of the entity's overall business continuity policy.

      • Business Continuity Policy & Procedure
      • Disaster Recovery Policy
      • Data Backup Policy

    • Art. 11(2) Continuity arrangements

      Documented arrangements, plans and procedures keep critical or important functions running, respond to and resolve incidents in a way that limits damage, activate containment without delay, estimate impacts and losses, and manage crisis communication and reporting.

      • Business Continuity Policy & Procedure
      • Incident Management Policy & Procedure
      • Incident Tracking
      • Disaster Recovery Policy

    • Art. 11(3) ICT response and recovery plans

      ICT response and recovery plans are in place and, except for microenterprises, are subject to independent internal audit review.

      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure
      • Internal Audit

    • Art. 11(4) Continuity of outsourced functions

      ICT business continuity plans are maintained and tested periodically, in particular for critical or important functions outsourced or contracted to ICT third-party service providers.

      • Business Continuity Policy & Procedure
      • Disaster Recovery Testing
      • Subservice Organization Evaluation
      • ICT Concentration Risk & Exit Strategies

    • Art. 11(5) Business impact analysis

      A business impact analysis assesses exposure to severe disruptions with quantitative and qualitative criteria and scenarios, considering critical functions, supporting processes, third-party dependencies and information assets and how they depend on each other.

      • Impact Analysis
      • Business Continuity Policy & Procedure
      • Risk Assessment

    • Art. 11(6) Testing of continuity and recovery plans

      Continuity, response and recovery plans are tested at least once a year and after substantive changes to systems supporting critical functions, including cyber-attack and switchover scenarios except for microenterprises, crisis communication plans are tested too, and the plans are revised based on the results.

      • Disaster Recovery Testing
      • Backup Restoration Testing
      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure

    • Art. 11(7) Crisis management function

      Except for microenterprises, a crisis management function with clear procedures for internal and external crisis communication takes charge when continuity or recovery plans are activated.

      • Business Continuity Policy & Procedure
      • Incident Management Policy & Procedure
      • Cybersecurity Responsibilities

    • Art. 11(8) Records of disruption events

      Readily accessible records are kept of the activities carried out before and during a disruption when continuity or recovery plans are activated.

      • Incident Tracking
      • Centralized Security Logging
      • Business Continuity Policy & Procedure

    • Art. 11(10) Costs and losses of major incidents

      Except for microenterprises, the entity can give its competent authority, on request, an estimate of the total yearly costs and losses caused by major ICT-related incidents.

      • Incident Tracking
      • Major ICT-Related Incident Classification & Reporting

  • Art. 12 Backup, restoration and recovery

    • Art. 12(1) Backup policies and recovery procedures

      Documented backup policies set which data is backed up and how often, based on criticality and confidentiality, alongside documented restoration and recovery procedures.

      • Data Backup Policy
      • Data Backups
      • Disaster Recovery Policy

    • Art. 12(2) Backup systems and restoration testing

      Backup systems can be activated without endangering security or data, and backup, restoration and recovery procedures are tested periodically.

      • Data Backups
      • Backup Restoration Testing
      • Disaster Recovery Testing

    • Art. 12(3) Segregated restoration systems

      When data is restored on the entity's own systems, the systems used are physically and logically separate from the source and protected from unauthorised access or corruption.

      • Data Backup Policy
      • Data Backups
      • Backup Restoration Testing

    • Art. 12(4) Redundant ICT capacity

      Except for microenterprises, which only assess the need, the entity keeps redundant ICT capacity with enough resources and capabilities to meet business needs.

      • Data Backups
      • Capacity & Performance Management
      • Disaster Recovery Policy

    • Art. 12(6) Recovery time and point objectives

      Recovery time and recovery point objectives are set for each function according to its criticality and its impact on market efficiency, so that agreed service levels hold in extreme scenarios.

      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure
      • Impact Analysis

    • Art. 12(7) Data integrity checks after recovery

      Recovery from an incident includes the checks and reconciliations needed to keep data integrity as high as possible, including for data rebuilt from external stakeholders.

      • Backup Restoration Testing
      • Disaster Recovery Policy
      • Incident Management Policy & Procedure

  • Art. 13 Learning and evolving

    • Art. 13(1) Threat and vulnerability intelligence

      Capabilities and staff gather information on vulnerabilities, cyber threats and incidents, and analyse their likely effect on the entity's resilience.

      • Anomalous Behavior Detection
      • Vulnerability Remediation Process
      • Cybersecurity Responsibilities
      • Risk Assessment

    • Art. 13(2) Post-incident reviews

      After a major ICT-related incident disrupts core activities, a review analyses its causes, the speed of response and forensic analysis, escalation and communication, identifies improvements, and the resulting changes are shared with the authority on request.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Security & Privacy Program Review

    • Art. 13(3) Lessons learned in the risk assessment

      Lessons from resilience testing, real incidents, activations of continuity plans and information exchanged with peers feed continuously into the ICT risk assessment and the review of the framework.

      • Risk Assessment
      • Management Review of Risks
      • Management Review of Policies
      • Incident Management Policy & Procedure

    • Art. 13(4) Monitoring the resilience strategy

      The effectiveness of the resilience strategy is monitored by tracking how ICT risk evolves and analysing the frequency, types, size and patterns of incidents, especially cyber-attacks.

      • Management Review of Risks
      • Security & Privacy Program Review
      • Incident Tracking

    • Art. 13(5) Yearly reporting to the management body

      Senior ICT staff report at least once a year to the management body on these findings and make recommendations.

      • Security & Privacy Program Review
      • Management Review of Risks

    • Art. 13(6) Security awareness and resilience training

      ICT security awareness programmes and digital operational resilience training are compulsory for all employees and senior management at a level matching their role, and ICT providers are included where appropriate.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • Art. 13(7) Monitoring technological developments

      Except for microenterprises, the entity follows relevant technological developments and new forms of cyber-attack to understand their effect on ICT security and resilience.

      • Cybersecurity Responsibilities
      • Risk Assessment
      • Anomalous Behavior Detection

  • Art. 14 Communication

    • Art. 14(1) Crisis communication plans

      Crisis communication plans allow responsible disclosure of at least major ICT-related incidents or vulnerabilities to clients, counterparts and, where appropriate, the public.

      • Incident Management Policy & Procedure
      • Business Continuity Policy & Procedure
      • Major ICT-Related Incident Classification & Reporting

    • Art. 14(2) Internal and external communication policies

      Communication policies for staff and external stakeholders distinguish staff involved in ICT risk management and response from staff who only need to be informed.

      • Incident Management Policy & Procedure
      • Publishing Security & Privacy Documentation
      • Business Continuity Policy & Procedure

    • Art. 14(3) Person in charge of incident communication

      At least one person is tasked with carrying out the communication strategy for ICT-related incidents and handling public and media contact.

      • Incident Management Policy & Procedure
      • Cybersecurity Responsibilities
      • Roles & Responsibilities

  • Art. 16 Simplified ICT risk management framework

    • Art. 16(1) Simplified framework for small entities

      Small and non-interconnected investment firms, exempted payment, e-money and credit institutions and small occupational pension funds follow a simplified regime instead of Articles 5 to 15, keeping a documented ICT risk framework that covers monitoring, protection, detection, third-party dependencies, continuity with backups, regular testing and awareness training.

      • Security Governance Program
      • Risk Framing
      • Anomalous Behavior Detection
      • Business Continuity Policy & Procedure
      • Data Backups
      • Periodic Security & Privacy Training

    • Art. 16(2) Review of the simplified framework

      The simplified framework is documented, reviewed periodically and after major incidents, improved over time, and a review report is available to the authority on request.

      • Management Review of Policies
      • Security & Privacy Program Review
      • Information Security & Privacy Policies

• Chapter III ICT-related incident management, classification and reporting

  • Art. 17 ICT-related incident management process

    • Art. 17(1) Incident management process

      A defined and implemented process detects, manages and notifies ICT-related incidents.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Automated Incident Reporting

    • Art. 17(2) Recording incidents and root causes

      All ICT-related incidents and significant cyber threats are recorded and followed up consistently, with root causes identified, documented and addressed so the incidents do not recur.

      • Incident Tracking
      • Incident Management Policy & Procedure
      • Centralized Security Logging

    • Art. 17(3) Elements of the incident process

      The process sets early warning indicators, classification by priority, severity and service criticality, roles for each incident type, communication and escalation plans including customer complaints, reporting of major incidents to senior management and the management body, and response procedures.

      • Incident Management Policy & Procedure
      • Automated Incident Reporting
      • Incident Tracking
      • Incident Reporting Assistance
      • Security & Privacy Program Review

  • Art. 18 Classification of incidents and cyber threats

    • Art. 18(1) Classification of ICT-related incidents

      Incidents are classified and their impact assessed using the set criteria: clients and counterparts affected, duration and downtime, geographical spread, data losses, criticality of the services affected and economic impact.

      • Major ICT-Related Incident Classification & Reporting
      • Incident Management Policy & Procedure
      • Incident Tracking

    • Art. 18(2) Classification of significant cyber threats

      Cyber threats are classified as significant according to the criticality of the services at risk, the clients or counterparts targeted and the geographical spread of the areas at risk.

      • Major ICT-Related Incident Classification & Reporting
      • Anomalous Behavior Detection
      • Incident Management Policy & Procedure

  • Art. 19 Reporting of major incidents and notification of cyber threats

    • Art. 19(1) Reporting major incidents to the competent authority

      Major ICT-related incidents are reported to the relevant competent authority using the prescribed templates, with the information needed to judge their significance and possible cross-border impact.

      • Major ICT-Related Incident Classification & Reporting
      • Incident Management Policy & Procedure

    • Art. 19(2) Voluntary notification of significant cyber threats

      Significant cyber threats can be notified voluntarily to the competent authority when they matter for the financial system, service users or clients.

      • Major ICT-Related Incident Classification & Reporting
      • Cybersecurity Responsibilities

    • Art. 19(3) Informing affected clients

      When a major incident affects clients' financial interests, they are told without undue delay about the incident and the measures taken, and clients potentially affected by a significant cyber threat are told of protective steps they can take.

      • Major ICT-Related Incident Classification & Reporting
      • Incident Management Policy & Procedure
      • Business Continuity Policy & Procedure

    • Art. 19(4) Initial, intermediate and final reports

      Within the deadlines set by the technical standards, the entity submits an initial notification, intermediate reports when the situation changes significantly, and a final report once the root cause analysis is complete.

      • Major ICT-Related Incident Classification & Reporting
      • Incident Tracking

• Chapter IV Digital operational resilience testing

  • Art. 24 General requirements for resilience testing

    • Art. 24(1) Resilience testing programme

      Except for microenterprises, a risk-based digital operational resilience testing programme, part of the ICT risk framework, combines assessments, tests, methods and tools to find weaknesses and gaps and drive prompt corrective action.

      • Penetration Testing
      • Vulnerability Remediation Process
      • Disaster Recovery Testing
      • Backup Restoration Testing
      • Vulnerability Management Policy & Procedure

    • Art. 24(4) Independent testers

      Tests are carried out by independent internal or external parties, and internal testers are given enough resources and kept free of conflicts of interest.

      • Penetration Testing
      • Internal Audit

    • Art. 24(5) Remediation of test findings

      Procedures prioritise, classify and fix every issue the tests reveal, and internal validation confirms that each weakness or gap has been fully addressed.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation
      • Penetration Testing

    • Art. 24(6) Yearly testing of critical systems

      Appropriate tests are run at least once a year on all ICT systems and applications supporting critical or important functions.

      • Penetration Testing
      • Vulnerability Remediation Process
      • Disaster Recovery Testing

  • Art. 25 Testing of ICT tools and systems

    The testing programme includes suitable tests such as vulnerability scans, open-source and network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario, compatibility, performance and end-to-end tests, and penetration tests, with microenterprises planning tests on a risk basis.

    • Vulnerability Remediation Process
    • Penetration Testing
    • Regression Testing
    • Disaster Recovery Testing
    • Approval of Changes

  • Art. 26 Threat-led penetration testing

    • Art. 26(1) Threat-led penetration testing every three years

      Entities identified by their competent authority run threat-led penetration tests at least every three years on live production systems, covering several or all critical or important functions including outsourced ones, with the scope validated by the authority.

      • Threat-Led Penetration Testing
      • Penetration Testing

    • Art. 26(3) ICT providers within the test scope

      When ICT third-party providers fall within the test scope, the entity secures their participation and keeps full responsibility, and pooled testing may be agreed where direct participation would harm the provider's other customers.

      • Threat-Led Penetration Testing
      • ICT Service Contract Provisions

    • Art. 26(5) Risk controls during testing

      Together with providers and testers, the entity applies effective risk controls so the test does not damage data or assets or disrupt critical functions at the entity, its counterparts or the financial sector.

      • Threat-Led Penetration Testing
      • Risk Assessment

    • Art. 26(6) Test reporting and attestation

      After testing, a summary of findings, the remediation plans and documentation of the test are given to the designated authority, and the entity notifies its competent authority of the attestation it receives.

      • Threat-Led Penetration Testing

    • Art. 26(8) Use of internal and external testers

      Testers meet the requirements of Article 27; when internal testers are used, external testers are contracted every third test, and significant credit institutions use external testers only.

      • Threat-Led Penetration Testing

  • Art. 27 Requirements for testers

    • Art. 27(1) Qualifications of testers

      Threat-led testers are highly suitable and reputable, have proven expertise in threat intelligence, penetration and red team testing, are certified or follow formal codes of conduct, provide independent assurance on their risk management and hold professional indemnity insurance.

      • Threat-Led Penetration Testing
      • Third-Party Criticality Assessments

    • Art. 27(2) Conditions for internal testers

      Internal testers are used only with approval of the competent or designated authority, after it has checked resources and conflicts of interest, and with an external threat intelligence provider.

      • Threat-Led Penetration Testing

    • Art. 27(3) Handling of test results in tester contracts

      Contracts with external testers require sound management of test results so that storing, reporting or destroying them creates no risk for the entity.

      • Threat-Led Penetration Testing
      • Vendor Management Policy & Procedure

• Chapter V Managing of ICT third-party risk

  • Art. 28 General principles

    • Art. 28(1) Third-party risk within the ICT risk framework

      ICT third-party risk is managed as part of the ICT risk framework, in proportion to the dependencies and the criticality of the services used, and the entity stays fully responsible for its obligations when it relies on ICT services.

      • Vendor Management Policy & Procedure
      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Risk Assessment Policy & Procedure

    • Art. 28(2) Third-party risk strategy and policy

      Except for microenterprises and simplified-regime entities, a regularly reviewed strategy on ICT third-party risk includes a policy on ICT services supporting critical or important functions, and the management body reviews the related risks regularly.

      • Vendor Management Policy & Procedure
      • Management Review of Third-Party Risks
      • Management Review of Policies
      • ICT Concentration Risk & Exit Strategies

    • Art. 28(3) Register of information

      A register of information on all contractual arrangements for ICT services is kept at entity and group level, distinguishing those supporting critical or important functions; it is reported yearly in summary, given to the authority on request, and planned arrangements for critical functions are notified in time.

      • Register of ICT Third-Party Arrangements
      • Third-Party Criticality Assessments

    • Art. 28(4) Assessment and due diligence before contracting

      Before contracting, the entity checks whether the service supports a critical or important function and whether supervisory conditions are met, assesses the risks including concentration risk, carries out due diligence on the provider and identifies conflicts of interest.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation
      • Vendor Management Policy & Procedure
      • Risk Assessment

    • Art. 28(5) Security standards of providers

      Only ICT providers meeting appropriate information security standards are used, and for critical or important functions the most current, highest-quality standards are taken into account before contracting.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation

    • Art. 28(6) Audits and inspections of providers

      The frequency and areas of audits and inspections of providers are set in advance on a risk basis using recognised audit standards, and auditors have the skills that technically complex arrangements need.

      • Subservice Organization Evaluation
      • Management Review of Third-Party Risks
      • ICT Service Contract Provisions

    • Art. 28(7) Termination rights

      ICT service contracts can be ended for significant breaches by the provider, monitoring findings that may affect performance, evidenced weaknesses in the provider's ICT risk management, or when the authority can no longer supervise the entity effectively.

      • ICT Service Contract Provisions

    • Art. 28(8) Exit strategies

      Documented exit strategies and transition plans for services supporting critical or important functions, tested and reviewed periodically, allow exit without disruption, loss of compliance or harm to clients, with alternatives and contingency measures identified.

      • ICT Concentration Risk & Exit Strategies
      • Business Continuity Policy & Procedure

  • Art. 29 Concentration risk at entity level

    • Art. 29(1) ICT concentration risk

      Before contracting for critical or important functions, the entity considers whether the provider is hard to substitute and whether several arrangements would rest on the same or closely connected providers, and weighs alternatives.

      • ICT Concentration Risk & Exit Strategies
      • Third-Party Criticality Assessments
      • Risk Assessment

    • Art. 29(2) Subcontracting and third-country risks

      For critical or important functions, the entity weighs the risks of subcontracting chains and third-country subcontractors, insolvency law and data recovery constraints, and data protection and law enforcement in the provider's country.

      • ICT Concentration Risk & Exit Strategies
      • Subservice Organization Evaluation
      • Cross-Border Data Transfers

  • Art. 30 Key contractual provisions

    • Art. 30(1) Written contract with service levels

      The rights and obligations of the entity and the provider are set out in one written contract, including the service level agreements, available in a durable, accessible format.

      • ICT Service Contract Provisions
      • Vendor Management Policy & Procedure

    • Art. 30(2) Minimum contract terms

      Contracts describe the services and the conditions for subcontracting, the service and data locations, data protection and the return of data, service levels, assistance during incidents, cooperation with authorities, termination rights and participation in security awareness training.

      • ICT Service Contract Provisions
      • Processor Data Protection Agreements

    • Art. 30(3) Additional terms for critical or important functions

      Contracts for critical or important functions also contain precise quantitative service levels, notice and reporting duties, the provider's continuity plans and security measures, participation in threat-led testing, unrestricted access, inspection and audit rights, and exit strategies with a mandatory transition period.

      • ICT Service Contract Provisions
      • ICT Concentration Risk & Exit Strategies

    • Art. 30(4) Standard contractual clauses

      Standard contractual clauses developed by public authorities for specific services are considered when negotiating contracts.

      • ICT Service Contract Provisions

• Chapter VI Information-sharing arrangements

  • Art. 45 Sharing of cyber threat information and intelligence

    • Art. 45(1) Sharing within trusted communities

      Cyber threat information and intelligence may be exchanged within trusted communities of financial entities to strengthen resilience, under arrangements that protect sensitive information, business confidentiality and personal data.

      • Cybersecurity Responsibilities
      • Data Classification Labels

    • Art. 45(3) Notifying authorities of participation

      The competent authority is told when the entity's membership of an information-sharing arrangement is confirmed and when it ends.

      • Cybersecurity Responsibilities
      • Statutory, Regulatory & Contractual Compliance