Source: OJ L, 2024/1774, 25.6.2024

RTS on ICT risk management framework

Commission Delegated Regulation (EU) 2024/1774

of 13 March 2024

supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council

with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework

Preamble

1 – 30Recitals

Title IGeneral principle
- Article 1Overall risk profile and complexity
Title IIFurther harmonisation of ICT risk management tools, methods, processes, and policies in accordance with Article 15 of Regulation (EU) 2022/2554
- Chapter IICT security policies, procedures, protocols, and tools
  - Section 1
    - Article 2General elements of ICT security policies, procedures, protocols, and tools
  - Section 2
    - Article 3ICT risk management
  - Section 3ICT asset management
    - Article 4ICT asset management policy
    - Article 5ICT asset management procedure
  - Section 4Encryption and cryptography
    - Article 6Encryption and cryptographic controls
    - Article 7Cryptographic key management
  - Section 5ICT operations security
  - Section 6Network security
    - Article 13Network security management
    - Article 14Securing information in transit
  - Section 7ICT project and change management
  - Section 8
    - Article 18Physical and environmental security
- Chapter IIHuman resources policy and access control
- Chapter IIIICT-related incident detection and response
  - Article 22ICT-related incident management policy
  - Article 23Anomalous activities detection and criteria for ICT-related incidents detection and response
- Chapter IVICT business continuity management
- Chapter VReport on the ICT risk management framework review
  - Article 27Format and content of the report on the review of the ICT risk management framework
Title IIISimplified ICT risk management framework for financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554
- Chapter ISimplified ICT risk management framework
- Chapter IIFurther elements of systems, protocols, and tools to minimise the impact of ICT risk
- Chapter IIIICT business continuity management
  - Article 39Components of the ICT business continuity plan
  - Article 40Testing of business continuity plans
- Chapter IVReport on the review of the simplified ICT risk management framework
  - Article 41Format and content of the report on the review of the simplified ICT risk management framework
Title IVFinal provisions
- Article 42Entry into force

Table of contents