Laws and regulations
DORA technical standard on ICT risk management
Delegated Regulation (EU) 2024/1774, which details the ICT risk management framework DORA requires.
Official source Published by European Commission. EU law, free to reuse.
What it is
Commission Delegated Regulation (EU) 2024/1774 is the regulatory technical standard that specifies the tools, methods, processes and policies financial entities must have as part of the DORA ICT risk management framework. It also details the simplified ICT risk management framework for the smaller entities that DORA Article 16 allows to use it. It exists to turn the high-level DORA obligations into concrete, harmonised requirements.
Who it applies to
- All financial entities in scope of DORA that must apply the full ICT risk management framework
- Entities eligible for the simplified framework under DORA Article 16, such as small and non-interconnected investment firms and certain small payment and electronic money institutions, through a separate, lighter title
- ICT providers are affected indirectly, because financial entities must apply these requirements to the ICT services they use
- Status
- Binding EU delegated regulation, adopted by the Commission on 13 March 2024 on the basis of technical standards developed by the European Supervisory Authorities. It applies, like DORA itself, from 17 January 2025.
- Enforcement
- Supervised by the same national competent authorities that supervise DORA compliance, as part of their review of the ICT risk management framework. Shortcomings are DORA infringements and fall under the national DORA penalty regimes.
Key points
- Requires documented ICT security policies, approved and periodically reviewed, that are consistent with the overall ICT risk management framework
- Expects a complete inventory of ICT assets and information assets, including those provided by third parties, with their classification and dependencies
- Sets out requirements on encryption and key management, including protection of data at rest, in transit and, where relevant, in use
- Covers ICT operations such as capacity management, vulnerability and patch management, logging and secure configuration, plus network segmentation and protection
- Requires identity and access management based on least privilege and need to know, with strong authentication and regular access reviews
- Requires business continuity and ICT response and recovery plans that are tested, including scenarios such as severe cyber attacks and the failure of a critical provider
Where to start
- 1Determine whether you fall under the full framework (Title I) or the simplified one (Title II)
- 2Map existing policies and controls to each requirement in the relevant title and record gaps with owners and dates
- 3Bring your asset inventory, access control and business continuity testing up to the level the regulation describes, as these are frequent gaps
How it is structured
| Title I, general principle | Proportionality: how size, risk profile and complexity are taken into account |
|---|---|
| Title I, ICT security policies, procedures, protocols and tools | ICT risk management, asset management, encryption and cryptography, ICT operations security, network security, project and change management, physical and environmental security |
| Title I, human resources policy and access control | Staff and third-party security duties, identity management and access control |
| Title I, incident detection and response | Detecting anomalous activity, incident response processes |
| Title I, ICT business continuity management | Business continuity policy, response and recovery plans and their testing |
| Title I, review report | Format and content of the report on the review of the ICT risk management framework |
| Title II | The simplified ICT risk management framework for entities covered by DORA Article 16 |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.