Article 8 — Policies and procedures for ICT operations · Delegated Regulation (EU) 2024/1774 | DORA

8(1)

1.As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement policies and procedures to manage the ICT operations. Those policies and procedures shall specify how financial entities operate, monitor, control, and restore their ICT assets, including the documentation of ICT operations.

Copy link

8(2)

2.The policies and procedures for ICT operations referred to in paragraph 1 shall contain all of the following:

Copy link

8(2)(a)

a)an ICT assets description, including all of the following:

Copy link

8(2)(a)(i)

i)requirements regarding secure installation, maintenance, configuration, and deinstallation of an ICT system;

Copy link

8(2)(a)(ii)

ii)requirements regarding the management of information assets used by ICT assets, including their processing and handling, both automated and manual;

Copy link

8(2)(a)(iii)

iii)requirements regarding the identification and control of legacy ICT systems;

Copy link

8(2)(b)

b)controls and monitoring of ICT systems, including all of the following:

Copy link

8(2)(b)(i)

i)backup and restore requirements of ICT systems;

Copy link

8(2)(b)(ii)

ii)scheduling requirements, taking into consideration interdependencies among the ICT systems;

Copy link

8(2)(b)(iii)

iii)protocols for audit-trail and system log information;

Copy link

8(2)(b)(iv)

iv)requirements to ensure that the performance of internal audit and other testing minimises disruptions to business operations;

Copy link

8(2)(b)(v)

v)requirements on the separation of ICT production environments from the development, testing, and other non-production environments;

Copy link

8(2)(b)(vi)

vi)requirements to conduct the development and testing in environments which are separated from the production environment;

Copy link

8(2)(b)(vii)

vii)requirements to conduct the development and testing in production environments;

Copy link

8(2)(c)

c)error handling concerning ICT systems, including all of the following:

Copy link

8(2)(c)(i)

i)procedures and protocols for handling errors;

Copy link

8(2)(c)(ii)

ii)support and escalation contacts, including external support contacts in case of unexpected operational or technical issues;

Copy link

8(2)(c)(iii)

iii)ICT system restart, rollback, and recovery procedures for use in the event of ICT system disruption.\

Copy link

For the purposes of point (b)(v), the separation shall consider all of the components of the environment, including accounts, data or connections, as required by Article 13, first subparagraph, point (a).

For the purposes of point (b)(vii), the policies and procedures referred to in paragraph 1 shall provide that the instances in which testing is performed in a production environment are clearly identified, reasoned, are for limited periods of time, and are approved by the relevant function in accordance with Article 16(6). Financial entities shall ensure the availability, confidentiality, integrity, and authenticity of ICT systems and production data during development and test activities in the production environment.