Art. 19 Human resources policy | RTS on ICT risk management framework | DORA

Financial entitiesas defined in Article 2, points (a) to (t) shall include in their human resource policy or other relevant policies all of the following ICT security related elements:

the identification and assignment of any specific ICT security responsibilities;
requirements for staff of the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; and of the ICT third-party service providers means an undertaking providing ICT services; using or accessing ICT assets means a software or hardware asset in the network and information systems used by the financial entity; of the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; to:
1. be informed about, and adhere to, the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;’s ICT security policies, procedures, and protocols;
2. be aware of the reporting channels put in place by the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; for the detection of anomalous behaviour, including, where applicable, the reporting channels established in line with Directive (EU) 2019/1937 of the European Parliament and of the Council (¹¹)Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (OJ L 305, 26.11.2019, p. 17, ELI: http://data.europa.eu/eli/dir/2019/1937/oj).;
3. for the staff, to return to the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;, upon termination of employment, all ICT assets means a software or hardware asset in the network and information systems used by the financial entity; and tangible information assets means a collection of information, either tangible or intangible, that is worth protecting; in their possession that belong to the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;.