Article 17 — ICT-related incident management process
Financial servicesLevel 1RegulationDORAApplies from 17 Jan 2025In force, but its rules apply only from the date shown.VerifiedIdentical to the official source.Official source
17(1)Copy link
1.Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.
17(2)Copy link
2.Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.
17(3)(b)
(b)establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);
Copy link17(3)(c)
(c)assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;
Copy link17(3)(d)
(d)set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;
Copy link17(3)(e)
(e)ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;
Copy link17(3)(f)
(f)establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.
Copy link