[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F9":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","9","Article 9","Protection and prevention",1,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Article 9 requires financial entities to continuously monitor and control the security and functioning of ICT systems and to use appropriate security tools, policies and procedures to minimise the impact of ICT risk. It covers information security policies, network management, access control, strong authentication, patching and change management.\n\n**In practice.** The entity maintains information security policies, segments networks, restricts access on a need to know basis, uses strong authentication, protects data in transit and at rest, and runs documented patch and change management. Controls are monitored for effectiveness. Evidence includes policies, network design documents, access reviews, change records and patch reports.\n\n**Common gaps.** Change management often has gaps for cloud and emergency changes. Strong authentication may not extend to all privileged or third party access.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_9","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"dora-regulation-mandates-strong-credential-management-for-eu-financial-institutions","DORA Regulation Mandates Strong Credential Management for EU Financial Institutions","2026-04-25T11:09:49.689+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":28,"name":29,"problem":30,"stories":9},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":32,"name":33,"problem":34,"stories":9},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[36,41,46,50],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","6","Control 6","Access Control Management",{"family":42,"item":43,"code":44,"title":45,"together":9},"nist-800-53","ac-2","AC-2","Account Management",{"family":42,"item":47,"code":48,"title":49,"together":9},"ia-2","IA-2","Identification and Authentication (Organizational Users)",{"family":51,"item":52,"code":53,"title":54,"together":9},"pci-dss","requirement-8","Requirement 8.2","Requirement 8: Identify Users and Authenticate Access to System Components"]