{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-06-25","gaps":[],"covered":["2024/1774 — RTS — ICT Risk Framework [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/7","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/7","title":"Article 7 — Cryptographic key management","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","view_of":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 25 June 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","valid_from":"2024-07-15","valid_until":null,"content_id":"c01d184e95ac2e36","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/7/versions/2024-07-15","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/7/versions/2024-07-15/rev/c01d184e95ac2e36","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/7/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/7/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1774-ict-risk-management-framework#art-7","source_line":"Commission Delegated Regulation (EU) 2024/1774 · binding · OJ L, 2024/1774, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1774 work_date_document","published_on":"CELLAR 32024R1774 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1774 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","name":"Commission Delegated Regulation (EU) 2024/1774","number":"2024/1774","celex":"32024R1774","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"7","index":7,"articles":42,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/6","key":"6","title":"Article 6 — Encryption and cryptographic controls"},"next":{"path":"/dora/level-2/rts/2024-1774-ict-risk-management-framework/articles/8","key":"8","title":"Article 8 — Policies and procedures for ICT operations"},"act_anchor":"#art-7"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1774-20240625","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework.md","unit_text_sha256":"3a071e307e1efb118e73b81fc8febc3fbdabac714835591e63d679e2c245c473","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework/art-7","kind":"article","key":"7","heading":"Article 7 — Cryptographic key management","text":"## <a id=\"art-7\"></a>Article 7 — Cryptographic key management\n\n1. <a id=\"art-7-p-1\"></a>Financial entities shall include in the cryptographic key management policy referred to in Article 6(2), point (d), requirements for managing cryptographic keys through their whole lifecycle, including generating, renewing, storing, backing up, archiving, retrieving, transmitting, retiring, revoking, and destroying those cryptographic keys.\n2. <a id=\"art-7-p-2\"></a>Financial entities shall identify and implement controls to protect cryptographic keys through their whole lifecycle against loss, unauthorised access, disclosure, and modification. Financial entities shall design those controls on the basis of the results of the approved data classification and the ICT risk assessment.\n3. <a id=\"art-7-p-3\"></a>Financial entities shall develop and implement methods to replace the cryptographic keys in the case of loss, or where those keys are compromised or damaged.\n4. <a id=\"art-7-p-4\"></a>Financial entities shall create and maintain a register for all certificates and certificate-storing devices for at least ICT assets supporting critical or important functions. Financial entities shall keep that register up to date.\n5. <a id=\"art-7-p-5\"></a>Financial entities shall ensure the prompt renewal of certificates in advance of their expiration.\n\n**Section 5 — ICT operations security**\n\n","marks":[],"text_hash":"3a071e307e1efb118e73b81fc8febc3fbdabac714835591e63d679e2c245c473","revision":1}}