<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-06-25","gaps":[],"covered":["2024/1774 — RTS — ICT Risk Framework [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/31","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/31","title":"Article 31 — ICT risk management","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","view_of":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 25 June 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","valid_from":"2024-07-15","valid_until":null,"content_id":"e8e967185911789c","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/31/versions/2024-07-15","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/31/versions/2024-07-15/rev/e8e967185911789c","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/31/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/31/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework#art-31","source_line":"Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1774 work_date_document","published_on":"CELLAR 32024R1774 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1774 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","name":"Commission Delegated Regulation (EU) 2024/1774","number":"2024/1774","celex":"32024R1774","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"31","index":31,"articles":42,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/30","key":"30","title":"Article 30 — Classification of information assets and ICT assets"},"next":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/32","key":"32","title":"Article 32 — Physical and environmental security"},"act_anchor":"#art-31"}}} -->
# Article 31 — ICT risk management

**Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]**

*In force · Consolidated version of 25 June 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625)*

1. <a id="art-31-p-1"></a>The financial entities referred to in [Article 16(1)](../../articles/16.md) of Regulation (EU) 2022/2554 shall include in their simplified ICT risk management framework all of the following:\
   <a id="art-31-p-1-a"></a>a) a determination of the risk tolerance levels for ICT risk, in accordance with the risk appetite of the financial entity;\
   <a id="art-31-p-1-b"></a>b) the identification and assessment of the ICT risks to which the financial entity is exposed;\
   <a id="art-31-p-1-c"></a>c) the specification of mitigation strategies at least for the ICT risks that are not within the risk tolerance levels of the financial entity;\
   <a id="art-31-p-1-d"></a>d) the monitoring of the effectiveness of the mitigation strategies referred to in point (c);\
   <a id="art-31-p-1-e"></a>e) the identification and assessment of any ICT and information security risks resulting from any major change in ICT system or ICT services, processes, or procedures, and from ICT security testing results and after any major ICT-related incident.\
2. <a id="art-31-p-2"></a>The financial entities referred to in paragraph 1 shall carry out and document the ICT risk assessment periodically commensurate to the financial entities’ ICT risk profile.
3. <a id="art-31-p-3"></a>The financial entities referred to in paragraph 1 shall continuously monitor threats and vulnerabilities that are relevant to their critical or important functions, and information assets and ICT assets, and shall regularly review the risk scenarios impacting those critical or important functions.
4. <a id="art-31-p-4"></a>The financial entities referred to in paragraph 1 shall set out alert thresholds and criteria to trigger and initiate ICT-related incident response processes.