{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-06-25","gaps":[],"covered":["EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards","title":"EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards","status":"rejected question","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 June 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"20579ad3c2035c7d","change_date":null,"nearest_versions":["2025-06-25"],"first_text_date":null,"correction_applies":false,"versions":["2025-06-25"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/versions/2025-06-25","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/versions/2025-06-25/rev/20579ad3c2035c7d","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/relations","source_line":"Question published in the EBA Q&A tool · no answer · not legislation · published 25 Jun 2025 [Rejected question]","attribution":{"prepared_by":"not stated in the document","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-06-25","question_submitted_on":"2025-03-06","locators":{"published_on":"EBA Q&A register entry 2025_7369, field 'Rejected publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7369, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards.md","body_sha256":"c11d4030db88b745bc8ed846830a50e218d65f61ec0bd16e9f22a9190b0b3444"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question]\"\nshortTitle: \"EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question]\"\nanswer_id: EBA_QA_2025_7369\nstatus: \"Rejected question\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: withdrawn\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"Article 28(5) DORA\"\ndate: 25 June 2025\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369\nlifecycle: \"Rejected question\"\ntext_version: \"EBA Q&A register, 25 June 2025\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"not stated in the document\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Credit institution\"\n    locator: \"EBA Q&A register entry 2025_7369: no answer; the register names only the 'Type of submitter'\"\ndocument_type: \"qa_question\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2025-06-25\"\n  question_submitted_on: \"2025-03-06\"\n  locators:\n    published_on: \"EBA Q&A register entry 2025_7369, field 'Rejected publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2025_7369, field 'Submission date'\"\nlifecycle_label: \"Rejected question\"\n---\n\n**Question published in the EBA Q&A tool · no answer · not legislation · published 25 Jun 2025 [Rejected question]**\n\n*Rejected question · EBA Q&A register, 25 June 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2025_7369 — Q&A — Exist a definition of information security \\[Rejected question\\] |\n| **Prepared by** | Not stated in the document |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2025_7369 |\n| **Document type** | Q&A |\n| **Legal nature** | No answer · not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 25 June 2025; question submitted 6 March 2025 |\n| **Legal basis** | [Article 28(5)](https://www.headlesslaw.com/dora/articles/28) DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Exist a definition of information security standards**\n\n### Question\n\nIn DORA Article 28 (5), reference is made to \"appropriate information security standards\" and \"of the most up-to-date and highest quality information security standards\". Is There a definition of which standards are applicable here, or can credit institutions define the desired requirements themselves?\"\n\n### Background\n\nSo far, the term \"standard\" has been equated with ISO27xx. Before DORA for ICT service providers, selected security requirements have previously been defined by the Sparkasse. For small service providers in particular, certification according to ISO27001 would be an exclusion criterion.\n\n***\n\n### Answer\n\nThis question has been rejected because the matter it refers to has is in the process of being answered in Q&A DORA188 (ESMA Q&A 3200).\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369)\n\n## Related Level 1 articles\n\n- [Article 28 — General principles](../../../articles/28.md)\n"}