RTS on ICT Risk Management (Final)

Abstract

Final draft Regulatory Technical Standards specifying detailed and harmonised requirements for ICT risk management frameworks under DORA, including ICT security policies, access controls, detection and response mechanisms, business continuity, recovery planning, and reporting, as well as a simplified framework for smaller financial entities.

Key Takeaways

• ✓
  Defines detailed ICT security policies, procedures and technical controls required under Articles 15 and 16(3) of DORA.
• ✓
  Introduces harmonised requirements for detection, incident response, business continuity, and recovery testing.
• ✓
  Establishes structured documentation and reporting for ICT risk management framework reviews.
• ✓
  Applies proportionally, with a simplified ICT risk framework for small and less complex entities.
• ✓
  Intended to apply from 17 January 2025 after Commission adoption.

Keywords