<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-06-25","gaps":[],"covered":["EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards","title":"EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards","status":"rejected question","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 June 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"20579ad3c2035c7d","change_date":null,"nearest_versions":["2025-06-25"],"first_text_date":null,"correction_applies":false,"versions":["2025-06-25"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/versions/2025-06-25","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/versions/2025-06-25/rev/20579ad3c2035c7d","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7369-exist-a-definition-of-information-security-standards/relations","source_line":"Question published in the EBA Q&A tool · no answer · not legislation · published 25 Jun 2025 [Rejected question]","attribution":{"prepared_by":"not stated in the document","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-06-25","question_submitted_on":"2025-03-06","locators":{"published_on":"EBA Q&A register entry 2025_7369, field 'Rejected publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7369, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question]"
shortTitle: "EBA Q&A 2025_7369 — Q&A — Exist a definition of information security [Rejected question]"
answer_id: EBA_QA_2025_7369
status: "Rejected question"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: withdrawn
regulation: "DORA"
dora_level3: true
mica_level2: false
legal_basis: "Article 28(5) DORA"
date: 25 June 2025
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369
lifecycle: "Rejected question"
text_version: "EBA Q&A register, 25 June 2025"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "not stated in the document"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Credit institution"
    locator: "EBA Q&A register entry 2025_7369: no answer; the register names only the 'Type of submitter'"
document_type: "qa_question"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2025-06-25"
  question_submitted_on: "2025-03-06"
  locators:
    published_on: "EBA Q&A register entry 2025_7369, field 'Rejected publishing date'"
    question_submitted_on: "EBA Q&A register entry 2025_7369, field 'Submission date'"
lifecycle_label: "Rejected question"
---

**Question published in the EBA Q&A tool · no answer · not legislation · published 25 Jun 2025 [Rejected question]**

*Rejected question · EBA Q&A register, 25 June 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369)*

| | |
|---|---|
| **Full title** | EBA Q&A 2025_7369 — Q&A — Exist a definition of information security \[Rejected question\] |
| **Prepared by** | Not stated in the document |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2025_7369 |
| **Document type** | Q&A |
| **Legal nature** | No answer · not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 25 June 2025; question submitted 6 March 2025 |
| **Legal basis** | [Article 28(5)](https://www.headlesslaw.com/dora/articles/28) DORA |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Exist a definition of information security standards**

### Question

In DORA Article 28 (5), reference is made to "appropriate information security standards" and "of the most up-to-date and highest quality information security standards". Is There a definition of which standards are applicable here, or can credit institutions define the desired requirements themselves?"

### Background

So far, the term "standard" has been equated with ISO27xx. Before DORA for ICT service providers, selected security requirements have previously been defined by the Sparkasse. For small service providers in particular, certification according to ISO27001 would be an exclusion criterion.

***

### Answer

This question has been rejected because the matter it refers to has is in the process of being answered in Q&A DORA188 (ESMA Q&A 3200).

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7369)

## Related Level 1 articles

- [Article 28 — General principles](../../../articles/28.md)