DORA Article 9: Obligations, Deadlines & Penalties

Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4 to ensure the security of the means of transfer of data. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall use ICT solutions and processes that minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall use ICT solutions and processes that prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall use ICT solutions and processes that ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall establish a set of policies, procedures and controls that address access rights and ensure a sound administration thereof. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall implement protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall have appropriate and comprehensive documented policies for patches and updates. Regulation (EU) 2022/2554, Article 9, Article 9

Financial entities shall design the network connection infrastructure in a way that allows it to be instantaneously severed or segmented in order to minimise and prevent contagion. Regulation (EU) 2022/2554, Article 9, Article 9

The ICT change management process shall be approved by appropriate lines of management and shall have specific protocols in place. Regulation (EU) 2022/2554, Article 9, Article 9