ICT Risk Management – RTS (EU) 2024/1774

Abstract

Regulatory Technical Standards under DORA specifying detailed ICT risk management tools, methods, processes and policies, including ICT security governance, asset management, encryption, operations security, vulnerability and patch management, network security, project and change management, access control, and a simplified ICT risk management framework for smaller entities.

Key Takeaways

• ✓
  Defines mandatory ICT security policies, procedures, protocols and tools under DORA Article 15.
• ✓
  Introduces prescriptive controls for asset management, encryption, logging, vulnerability and patch management, and network security.
• ✓
  Sets detailed requirements for ICT project management, system development lifecycle, and change management.
• ✓
  Establishes structured incident detection, logging, and response mechanisms.
• ✓
  Provides a simplified ICT risk management framework for smaller or less complex financial entities.

Keywords