In this act Article 22 of 42

Article 22 — ICT-related incident management policy

Financial servicesLevel 2RTSDORAIn forceOfficial source

As part of the mechanisms to detect anomalous activities, including ICT network performance issues and ICT-related incidents, financial entities shall develop, document, and implement an ICT-related incident policy through which they shall:

22(a)

a)document the ICT-related incident management process referred to in Article 17 of Regulation (EU) 2022/2554;

Copy link

22(b)

b)establish a list of relevant contacts with internal functions and external stakeholders that are directly involved in ICT operations security, including on:

Copy link

22(b)(i)

i)the detection and monitoring of cyber threats;

Copy link

22(b)(ii)

ii)the detection of anomalous activities;

Copy link

22(b)(iii)

iii)vulnerability management;

Copy link

22(c)

c)establish, implement, and operate technical, organisational, and operational mechanisms to support the ICT-related incident management process, including mechanisms to enable a prompt detection of anomalous activities and behaviours in accordance with Article 23 of this Regulation;

Copy link

22(d)

d)retain all evidence relating to ICT-related incidents for a period that shall be no longer than necessary for the purposes for which the data are collected, commensurate with the criticality of the affected business functions, supporting processes, and ICT and information assets, in accordance with Article 8(2) of Commission Delegated Regulation (EU) 2024/1772 and with any applicable retention requirement pursuant to Union law;

Copy link

22(e)

e)establish and implement mechanisms to analyse significant or recurring ICT-related incidents and patterns in the number and the occurrence of ICT-related incidents.\

Copy link

For the purposes of point (d), financial entities shall retain the evidence referred to in that point in a secure manner.