{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-06-25","gaps":[],"covered":["2024/1774 — RTS — ICT Risk Framework [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/14","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/14","title":"Article 14 — Securing information in transit","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","view_of":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 25 June 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","valid_from":"2024-07-15","valid_until":null,"content_id":"d32963c510f90ac9","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/14/versions/2024-07-15","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/14/versions/2024-07-15/rev/d32963c510f90ac9","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/14/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/14/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework#art-14","source_line":"Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1774 work_date_document","published_on":"CELLAR 32024R1774 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1774 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","name":"Commission Delegated Regulation (EU) 2024/1774","number":"2024/1774","celex":"32024R1774","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"14","index":14,"articles":42,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/13","key":"13","title":"Article 13 — Network security management"},"next":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/15","key":"15","title":"Article 15 — ICT project management"},"act_anchor":"#art-14"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework.md","unit_text_sha256":"029292791d6215bb93c7f928ca6b902f9d879e328574062c439f60971c911599","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework/art-14","kind":"article","key":"14","heading":"Article 14 — Securing information in transit","text":"## <a id=\"art-14\"></a>Article 14 — Securing information in transit\n\n1. <a id=\"art-14-p-1\"></a>As part of the safeguards to preserve the availability, authenticity, integrity and confidentiality of data, financial entities shall develop, document, and implement the policies, procedures, protocols, and tools to protect information in transit. Financial entities shall in particular ensure all of the following:\\\n   <a id=\"art-14-p-1-a\"></a>a) the availability, authenticity, integrity and confidentiality of data during network transmission, and the establishment of procedures to assess compliance with those requirements;\\\n   <a id=\"art-14-p-1-b\"></a>b) the prevention and detection of data leakages and the secure transfer of information between the financial entity and external parties;\\\n   <a id=\"art-14-p-1-c\"></a>c) that requirements on confidentiality or non-disclosure arrangements reflecting the financial entity’s needs for the protection of information for both the staff of the financial entity and of third parties are implemented, documented, and regularly reviewed.\\\n2. <a id=\"art-14-p-2\"></a>Financial entities shall design the policies, procedures, protocols, and tools to protect the information in transit referred to in paragraph 1 on the basis of the results of the approved data classification and of the ICT risk assessment.\n\n**Section 7 — ICT project and change management**\n\n","marks":[],"text_hash":"029292791d6215bb93c7f928ca6b902f9d879e328574062c439f60971c911599","revision":1}}