Article 30 Classification of information assets and ICT assets

This article sits within the simplified ICT risk management framework applicable to a specific subset of financial entities under Article 16(1) of DORA.

It establishes the foundational mapping exercise those entities must carry out: identifying, classifying, and documenting their critical or important functions alongside the information and ICT assets that support them, including how those assets interrelate.

It also separately requires those same entities to identify which of their critical or important functions are supported by ICT third-party service providers.

This article effectively underpins much of what follows in the simplified framework, as knowing what you have and what depends on what is a prerequisite for managing risk.

Important points:

• Identify, classify, and document all critical or important functions, their supporting information and ICT assets, and the interdependencies between them, reviewing this as needed.
• Identify all critical or important functions that are supported by ICT third-party service providers.
• This obligation applies to financial entities operating under the simplified ICT risk management framework, not all financial entities covered by DORA.