Governance and organisation (Art. 5–6)

The management body must approve the ICT risk strategy, allocate an appropriate ICT budget and ensure the ICT function has qualified staff. An internal control function (second line) and internal audit function (third line) must independently assess ICT risks. The CISO (or equivalent) reports directly to the management body at least annually.

ICT asset management (Art. 8)

A complete, up-to-date inventory of all hardware and software ICT assets is mandatory. Assets must be classified by criticality to business functions. The RTS on ICT risk management tools (Commission Delegated Regulation 2024/1774) specifies the minimum fields for the asset register and the review frequency (at least annually, or after any significant change).

Protection and prevention (Art. 9)

Minimum controls include: network segmentation, multi-factor authentication for privileged accounts, encryption of data in transit and at rest (AES-256 or equivalent), patch management with defined SLAs by criticality, and an information security management policy formally approved by the management body.

Detection (Art. 10)

Financial entities must implement mechanisms to promptly detect anomalous ICT activities — including activities at third-party access points. This typically requires a SIEM (Security Information and Event Management) system with defined alert thresholds and an on-call escalation process. The RTS requires documented baseline normal behaviour for critical systems.

Response, recovery and learning (Art. 11–13)

A documented Business Continuity Plan (BCP) and ICT Disaster Recovery Plan (DRP) with defined RPO and RTO targets are required. Plans must be tested annually (or after a major change). Post-incident reviews must be conducted for all major incidents and shared with the management body within 3 months.