<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-06-25","gaps":[],"covered":["2024/1774 — RTS — ICT Risk Framework [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/26","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/26","title":"Article 26 — ICT response and recovery plans","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","view_of":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 25 June 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","valid_from":"2024-07-15","valid_until":null,"content_id":"82844249f3e5da62","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/26/versions/2024-07-15","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/26/versions/2024-07-15/rev/82844249f3e5da62","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/26/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/26/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework#art-26","source_line":"Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1774 work_date_document","published_on":"CELLAR 32024R1774 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1774 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","name":"Commission Delegated Regulation (EU) 2024/1774","number":"2024/1774","celex":"32024R1774","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"26","index":26,"articles":42,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/25","key":"25","title":"Article 25 — Testing of the ICT business continuity plans"},"next":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/27","key":"27","title":"Article 27 — Format and content of the report on the review of the ICT risk management framework"},"act_anchor":"#art-26"}}} -->
# Article 26 — ICT response and recovery plans

**Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]**

*In force · Consolidated version of 25 June 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625)*

1. <a id="art-26-p-1"></a>When developing the ICT response and recovery plans referred to in [Article 11(3)](../../articles/11.md) of Regulation (EU) 2022/2554, financial entities shall take into account the results of the financial entity’s business impact analysis (BIA). Those ICT response and recovery plans shall:\
   <a id="art-26-p-1-a"></a>a) specify the conditions prompting their activation or deactivation, and any exceptions for such activation or deactivation;\
   <a id="art-26-p-1-b"></a>b) describe what actions are to be taken to ensure the availability, integrity, continuity, and recovery of at least ICT systems and services supporting critical or important functions of the financial entity;\
   <a id="art-26-p-1-c"></a>c) be designed to meet the recovery objectives of the operations of the financial entities;\
   <a id="art-26-p-1-d"></a>d) be documented and made available to the staff involved in the execution of ICT response and recovery plans and be readily accessible in case of emergency;\
   <a id="art-26-p-1-e"></a>e) provide for both short-term and long-term recovery options, including partial systems recovery;\
   <a id="art-26-p-1-f"></a>f) lay down the objectives of ICT response and recovery plans and the conditions to declare a successful execution of those plans.\

    For the purposes of point (d), financial entities shall clearly specify roles and responsibilities.
2. <a id="art-26-p-2"></a>The ICT response and recovery plans referred to in paragraph 1 shall identify relevant scenarios, including scenarios of severe business disruptions and increased likelihood of occurrence of disruption. Those plans shall develop scenarios based on current information on threats and on lessons learned from previous occurrences of business disruptions. Financial entities shall duly take into account all of the following scenarios:\
   <a id="art-26-p-2-a"></a>a) cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups, and redundant facilities;\
   <a id="art-26-p-2-b"></a>b) scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails, and duly consider the potential impact of the insolvency, or other failures, of any relevant ICT third-party service provider;\
   <a id="art-26-p-2-c"></a>c) partial or total failure of premises, including office and business premises, and data centres;\
   <a id="art-26-p-2-d"></a>d) substantial failure of ICT assets or of the communication infrastructure;\
   <a id="art-26-p-2-e"></a>e) the non-availability of a critical number of staff or staff members in charge of guaranteeing the continuity of operations;\
   <a id="art-26-p-2-f"></a>f) impact of climate change and environment degradation related events, natural disasters, pandemics, and physical attacks, including intrusions and terrorist attacks;\
   <a id="art-26-p-2-g"></a>g) insider attacks;\
   <a id="art-26-p-2-h"></a>h) political and social instability, including, where relevant, in the ICT third-party service provider’s jurisdiction and the location where the data are stored and processed;\
   <a id="art-26-p-2-i"></a>i) widespread power outages.\
3. <a id="art-26-p-3"></a>Where the primary recovery measures may not be feasible in the short term because of costs, risks, logistics, or unforeseen circumstances, the ICT response and recovery plans referred to in paragraph 1 shall consider alternative options.
4. <a id="art-26-p-4"></a>As part of the ICT response and recovery plans referred to in paragraph 1, financial entities shall consider and implement continuity measures to mitigate failures of ICT third-party service providers of ICT services supporting critical or important functions of the financial entity.

**CHAPTER V — Report on the ICT risk management framework review**