In this act Article 2 of 42
Article 2 — General elements of ICT security policies, procedures, protocols, and tools
Financial servicesLevel 2RTSDORAIn forceOfficial source
2(1)Copy link
1.Financial entities shall ensure that their ICT security policies, information security, and related procedures, protocols, and tools as referred to in Article 9(2) of Regulation (EU) 2022/2554 are embedded in their ICT risk management framework. Financial entities shall establish the ICT security policies, procedures, protocols, and tools laid down in this Chapter that:
2(1)(c)
c)preserve the availability, authenticity, integrity, and confidentiality of data, including via the use of cryptographic techniques;
Copy link2(1)(d)
d)guarantee an accurate and prompt data transmission without major disruptions and undue delays.\
Copy link2(2)Copy link
2.Financial entities shall ensure that the ICT security policies referred to in paragraph 1:
2(2)(a)
a)are aligned to the financial entity’s information security objectives included in the digital operational resilience strategy referred to in Article 6(8) of Regulation (EU) 2022/2554;
Copy link2(2)(b)
b)indicate the date of the formal approval of the ICT security policies by the management body;
Copy link2(2)(c)(i)
i)monitor the implementation of the ICT security policies, procedures, protocols, and tools;
Copy link2(2)(c)(iii)
iii)ensure that the digital operational resilience of the financial entity is ensured in case of exceptions as referred to in point (ii);
Copy link2(2)(d)
d)specify the responsibilities of staff at all levels to ensure the financial entity’s ICT security;
Copy link2(2)(e)
e)specify the consequences of non-compliance by staff of the financial entity with the ICT security policies, where provisions to that effect are not laid down in other policies of the financial entity;
Copy link2(2)(g)
g)specify the segregation of duties arrangements in the context of the three lines of defence model or other internal risk management and control model, as applicable, to avoid conflicts of interest;
Copy link2(2)(h)
h)consider leading practices and, where applicable, standards as defined in Article 2, point (1), of Regulation (EU) No 1025/2012;
Copy link2(2)(i)
i)identify the roles and responsibilities for the development, implementation and maintenance of ICT security policies, procedures, protocols, and tools;
Copy link2(2)(k)
k)take into account material changes concerning the financial entity, including material changes to the activities or processes of the financial entity, to the cyber threat landscape, or to applicable legal obligations.\
Copy linkSection 2