In this act Article 4 of 42
Article 4 — ICT asset management policy
Financial servicesLevel 2RTSDORAIn forceOfficial source
4(1)Copy link
1.As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a policy on management of ICT assets.
4(2)(a)
a)prescribe the monitoring and management of the lifecycle of ICT assets identified and classified in accordance with Article 8(1) of Regulation (EU) 2022/2554;
Copy link4(2)(b)(iii)
iii)the classification of all ICT assets, as referred to in Article 8(1) of Regulation (EU) 2022/2254;
Copy link4(2)(b)(vi)
vi)the ICT business continuity requirements, including recovery time objectives and recovery point objectives;
Copy link4(2)(b)(vii)
vii)whether the ICT asset can be or is exposed to external networks, including the internet;
Copy link4(2)(b)(viii)
viii)the links and interdependencies among ICT assets and the business functions using each ICT asset;
Copy link4(2)(b)(ix)
ix)where applicable, for all ICT assets, the end dates of the ICT third-party service provider’s regular, extended, and custom support services after which those ICT assets are no longer supported by their supplier or by an ICT third-party service provider;
Copy link4(2)(c)
c)for financial entities other than microenterprises, prescribe that those financial entities keep records of the information necessary to perform a specific ICT risk assessment on all legacy ICT systems referred to in Article 8(7) of Regulation (EU) 2022/2554.\
Copy link