Agent · dora-2022-2554-16

DORA artikel 16: Simplified ICT risk management framework

Strukturelt tre: artikkelens egne punkter, ordrett.

CELEX 32022R2554 · 2026-08-18 · Vekt 86 · minimal-risk

ExtendedOperational weight but lower priority. Metered by volume, not per call, once metering is switched on.

DORAOffisiell kilde

Inndata

• in_scopeThe article applies to the situationboolean
• punktParagraph of the articleenum (1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14)

Regeltre

1. Hvis: alla(in_scope = true, punkt = 1)

   Paragraph 1 applies

   1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive 2009/110/EC;…

   Punkt 1

2. Hvis: alla(in_scope = true, punkt = 2)

   Paragraph 2 applies

   Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:

   Punkt 2

3. Hvis: alla(in_scope = true, punkt = 3)

   Paragraph 3 applies

   (a)

   Punkt 3

4. Hvis: alla(in_scope = true, punkt = 4)

   Paragraph 4 applies

   put in place and maintain a sound and documented ICT risk management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT risk, including for the protection of relevant physical components and infrastructures;

   Punkt 4

5. Hvis: alla(in_scope = true, punkt = 5)

   Paragraph 5 applies

   (b)

   Punkt 5

6. Hvis: alla(in_scope = true, punkt = 6)

   Paragraph 6 applies

   continuously monitor the security and functioning of all ICT systems;

   Punkt 6

7. Hvis: alla(in_scope = true, punkt = 7)

   Paragraph 7 applies

   (c)

   Punkt 7

8. Hvis: alla(in_scope = true, punkt = 8)

   Paragraph 8 applies

   minimise the impact of ICT risk through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systems;

   Punkt 8

9. Hvis: alla(in_scope = true, punkt = 9)

   Paragraph 9 applies

   (d)

   Punkt 9

10. Hvis: alla(in_scope = true, punkt = 10)

    Paragraph 10 applies

    allow sources of ICT risk and anomalies in the network and information systems to be promptly identified and detected and ICT-related incidents to be swiftly handled;

    Punkt 10

11. Hvis: alla(in_scope = true, punkt = 11)

    Paragraph 11 applies

    (e)

    Punkt 11

12. Hvis: alla(in_scope = true, punkt = 12)

    Paragraph 12 applies

    identify key dependencies on ICT third-party service providers;

    Punkt 12

13. Hvis: alla(in_scope = true, punkt = 13)

    Paragraph 13 applies

    (f)

    Punkt 13

14. Hvis: alla(in_scope = true, punkt = 14)

    Paragraph 14 applies

    ensure the continuity of critical or important functions, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;

    Punkt 14

Hvis ingen regel treffer: The article is not stated to apply, or no paragraph is selected. The agent abstains rather than guesses.

Artikkelteksten som ble lest

1. 11. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive 2009/110/EC; and small institutions for occupational retirement provision.
2. 2Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:
3. 3(a)
4. 4put in place and maintain a sound and documented ICT risk management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT risk, including for the protection of relevant physical components and infrastructures;
5. 5(b)
6. 6continuously monitor the security and functioning of all ICT systems;
7. 7(c)
8. 8minimise the impact of ICT risk through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systems;
9. 9(d)
10. 10allow sources of ICT risk and anomalies in the network and information systems to be promptly identified and detected and ICT-related incidents to be swiftly handled;
11. 11(e)
12. 12identify key dependencies on ICT third-party service providers;
13. 13(f)
14. 14ensure the continuity of critical or important functions, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;

Ingen rådgivning. Deterministisk regeluppslagning. Ingen juridisk rådgivning, inget efterlevnadsbeslut, ingen bedömning av ett enskilt ärende.

Sitering: 32022R2554 art. 16, Simplified ICT risk management framework. ExploreWorld Legal, https://legal.exploreworldai.com/agent/dora-2022-2554/artikel-16 (hämtad 2026-08-18, bevis sha256:4c720bedee50466c, bygge legal-2026-08-25).