What Commission Delegated Regulation (EU) 2024/1774 - Regulatory Technical Standards Specifying ICT Risk Management Tools, Methods, Processes, and Policies and the Simplified ICT Risk Management Framework (DORA Level 2 RTS, Articles 15 and 16(3)) requires
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplements DORA (Regulation (EU) 2022/2554) by setting out regulatory technical standards on the harmonised ICT risk management framework that financial entities must implement (Title II, under DORA Article 15) and the simplified ICT risk management framework for entities listed in DORA Article 16(1) (Title III, under DORA Article 16(3)). Adopted under DORA Article 15 fourth subparagraph and Article 16(3) fourth subparagraph and published in the Official Journal on 25 June 2024 (entering into force 20 days after publication), the RTS imposes proportionality (Article 1 - five elements: encryption/cryptography, ICT operations security, network security, ICT project and change management, impact on data confidentiality/integrity/availability and continuity). Title II Chapter I covers ICT security policies, procedures, protocols and tools (Article 2), the ICT risk management framework (Article 3), ICT asset management policy and procedure (Articles 4-5), encryption and cryptographic controls including post-quantum considerations (Article 6) and cryptographic key management (Article 7), policies and procedures for ICT operations (Article 8), capacity and performance management (Article 9), vulnerability and patch management with responsible disclosure (Article 10), data and system security (Article 11), logging (Article 12), network security management (Article 13), securing information in transit (Article 14), ICT project management with reporting to the management body (Article 15), ICT systems acquisition, development and maintenance including source-code review (Article 16), ICT change management with separation of approval/request/implementation duties and fall-back procedures (Article 17), physical and environmental security (Article 18), human resources policy (Article 19), identity management with unique identification (Article 20), and access control (Article 21). Chapter II adds ICT-related incident management policy (Article 22) and anomalous activities detection criteria (Article 23). Chapter III sets ICT business continuity policy components (Article 24), business continuity plan testing (Article 25), and ICT response and recovery plans (Article 26). Article 27 specifies the format and content of the management body's annual report on the ICT risk management framework review. Title III (Articles 28-41) sets the simplified framework for Article 16 entities, covering governance, information security policy, classification of information assets, ICT risk management, physical and environmental security, access control, ICT operations security, data/system/network security, ICT security testing, ICT systems acquisition/development/maintenance, ICT project and change management, business continuity components, and business continuity plan testing. Article 42 sets entry into force at 20 days after OJ publication.
Pillar: Banking & Global Finance · Authority: European Commission (delegated regulation under DORA Article 15 fourth subparagraph and Article 16(3) fourth subparagraph, based on draft RTS by the Joint Committee of the European Supervisory Authorities - EBA, EIOPA, ESMA) · Version: 1.0.0 · Last updated:
Primary source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1774
SHA-256 integrity: 099d73654ce2c9a0ef1d1f4719aab5290a6df61f8af09549a0d8a73624667e59
Primary Citations — 15 traced to source
- Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024, Article 1: Overall risk profile and complexity - five enumerated elements (a) encryption and cryptography, (b) ICT operations security, (c) network security, (d) ICT project and change management, (e) impact of ICT risk on data confidentiality/integrity/availability and continuity
- Commission Delegated Regulation (EU) 2024/1774, Article 2: General elements of ICT security policies, procedures, protocols, and tools - four required protections (a)-(d) including network security, intrusion safeguards, data CIA via cryptography, and prompt data transmission; Article 2(2) on roles, responsibilities and consequences of non-compliance
+ 13 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/eu-dora-rts-ict-risk-management-framework-2024-1774.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/eu-dora-rts-ict-risk-management-framework-2024-1774.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/eu-dora-rts-ict-risk-management-framework-2024-1774
- Back to registry: Browse all 10,099 compliance nodes