<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-06-25","gaps":[],"covered":["2024/1774 — RTS — ICT Risk Framework [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/29","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/29","title":"Article 29 — Information security policy and measures","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","view_of":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 25 June 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","valid_from":"2024-07-15","valid_until":null,"content_id":"5cf9f51359c383f5","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/29/versions/2024-07-15","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/29/versions/2024-07-15/rev/5cf9f51359c383f5","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/29/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/29/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework#art-29","source_line":"Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1774 work_date_document","published_on":"CELLAR 32024R1774 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1774 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","name":"Commission Delegated Regulation (EU) 2024/1774","number":"2024/1774","celex":"32024R1774","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"29","index":29,"articles":42,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/28","key":"28","title":"Article 28 — Governance and organisation"},"next":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/30","key":"30","title":"Article 30 — Classification of information assets and ICT assets"},"act_anchor":"#art-29"}}} -->
# Article 29 — Information security policy and measures

**Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]**

*In force · Consolidated version of 25 June 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625)*

1. <a id="art-29-p-1"></a>The financial entities referred to in [Article 16(1)](../../articles/16.md) of Regulation (EU) 2022/2554 shall develop, document, and implement an information security policy in the context of the simplified ICT risk management framework. That information security policy shall specify the high-level principles and rules to protect the confidentiality, integrity, availability, and authenticity of data and of the services those financial entities provide.
2. <a id="art-29-p-2"></a>Based on their information security policy referred to in paragraph 1, the financial entities referred to in paragraph 1 shall establish and implement ICT security measures to mitigate their exposure to ICT risk, including mitigating measures implemented by ICT third-party service providers.

    The ICT security measures shall include all of the measures referred to in Articles 30 to 38.