Article 16 Simplified ICT risk management framework

TL;DR

This article of the Digital Operations Resilience Act from the EU establishes the requirements for small and non-interconnected investment firms, payment institutions, electronic money institutions and small institutions for occupational retirement provision. These entities must implement an ICT risk management framework, continuously monitor their ICT systems, minimize the impact of ICT risk through the use of robust protocols and tools and create business continuity plans. They must also test these plans and the effectiveness of their ICT controls and develop ICT security awareness programmes. The ESAs shall develop draft regulatory technical standards in order to specify the elements of the ICT risk management framework, systems, protocols and tools to minimise ICT risk and the components of the ICT business continuity plans. The Commission will supplement this Regulation by adopting these regulatory technical standards.

Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firmsmeans an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 of the European Parliament and of the Council (³³);, payment institutions exempted pursuant to Directive (EU) 2015/2366means a payment institution exempted pursuant to Article 32(1) of Directive (EU) 2015/2366;; institutions exempted pursuant to Directive 2013/36/EUmeans an entity as referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU; in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive 2009/110/ECmeans an electronic money institution benefitting from a waiver as referred to in Article 9(1) of Directive 2009/110/EC;; and small institutions for occupational retirement provisionmeans an institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total;.
Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:
1. put in place and maintain a sound and documented ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment;, including for the protection of relevant physical components and infrastructures;
2. continuously monitor the security and functioning of all ICT systems;
3. minimise the impact of ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systemsmeans a network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555;;
4. allow sources of ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; and anomalies in the network and information systemsmeans a network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555; to be promptly identified and detected and ICT-related incidentsmeans a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity; to be swiftly handled;
5. identify key dependencies on ICT third-party service providersmeans an undertaking providing ICT services;;
6. ensure the continuity of critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;
7. test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (b);
8. implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from post-incident analysis into the ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; assessment process and develop, according to needs and ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; profile, ICT security awareness programmes and digital operational resiliencemeans the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions; training for staff and management.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.

RTS Paragraph is expanded on in a regulatory technical standard.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.
The ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework referred to in paragraph 1, second subparagraph, point (a), shall be documented and reviewed periodically and upon the occurrence of major ICT-related incidentsmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; in compliance with supervisory instructions. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework shall be submitted to the competent authorityas defined in Article 46 upon its request.

RTS Paragraph is expanded on in a regulatory technical standard.

proportionality Paragraph allows for application of the proportionality principle according to Article 4.
The ESAsEuropean Supervisory Authority shall, through the Joint Committeemeans the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010;, in consultation with the ENISA, develop common draft regulatory technical standards in order to:
1. specify further the elements to be included in the ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework referred to in paragraph 1, second subparagraph, point (a);
2. specify further the elements in relation to systems, protocols and tools to minimise the impact of ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; referred to in paragraph 1, second subparagraph, point (c), with a view to ensuring the security of networks, enabling adequate safeguards against intrusions and data misuse and preserving the availability, authenticity, integrity and confidentiality of data;
3. specify further the components of the ICT business continuity plans referred to in paragraph 1, second subparagraph, point (f);
4. specify further the rules on the testing of business continuity plans and ensure the effectiveness of the controls referred to in paragraph 1, second subparagraph, point (g) and ensure that such testing duly takes into account scenarios in which the quality of the provision of a critical or important functionmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; deteriorates to an unacceptable level or fails;
5. specify further the content and format of the report on the review of the ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework referred to in paragraph 2.
When developing those draft regulatory technical standards, the ESAsEuropean Supervisory Authority shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations.

The ESAsEuropean Supervisory Authority shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

proportionality Paragraph allows for application of the proportionality principle according to Article 4.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.

Table of contents