What it asks for. Article 9 requires financial entities to continuously monitor and control the security and functioning of ICT systems and to use appropriate security tools, policies and procedures to minimise the impact of ICT risk. It covers information security policies, network management, access control, strong authentication, patching and change management.
In practice. The entity maintains information security policies, segments networks, restricts access on a need to know basis, uses strong authentication, protects data in transit and at rest, and runs documented patch and change management. Controls are monitored for effectiveness. Evidence includes policies, network design documents, access reviews, change records and patch reports.
Common gaps. Change management often has gaps for cloud and emergency changes. Strong authentication may not extend to all privileged or third party access.