In this act Article 31 of 42
Article 31 — ICT risk management
Financial servicesLevel 2RTSDORAIn forceOfficial source
31(1)Copy link
1.The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall include in their simplified ICT risk management framework all of the following:
31(1)(a)
a)a determination of the risk tolerance levels for ICT risk, in accordance with the risk appetite of the financial entity;
Copy link31(1)(b)
b)the identification and assessment of the ICT risks to which the financial entity is exposed;
Copy link31(1)(c)
c)the specification of mitigation strategies at least for the ICT risks that are not within the risk tolerance levels of the financial entity;
Copy link31(1)(d)
d)the monitoring of the effectiveness of the mitigation strategies referred to in point (c);
Copy link31(1)(e)
e)the identification and assessment of any ICT and information security risks resulting from any major change in ICT system or ICT services, processes, or procedures, and from ICT security testing results and after any major ICT-related incident.\
Copy link31(2)Copy link
2.The financial entities referred to in paragraph 1 shall carry out and document the ICT risk assessment periodically commensurate to the financial entities’ ICT risk profile.
31(3)Copy link
3.The financial entities referred to in paragraph 1 shall continuously monitor threats and vulnerabilities that are relevant to their critical or important functions, and information assets and ICT assets, and shall regularly review the risk scenarios impacting those critical or important functions.