DORA, Artikkel 8, EU

1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.

2. Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them.

3. Financial entities, other than microenterprises, shall perform a risk assessment upon each major change in the network and information system infrastructure, in the processes or procedures affecting their ICT supported business functions, information assets or ICT assets.

4. Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets.

5. Financial entities shall identify and document all processes that are dependent on ICT third-party service providers, and shall identify interconnections with ICT third-party service providers that provide services that support critical or important functions.

6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.

7. Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.

Offisiell kilde

Versjon: dd6a95e2d19bac9c

SHA-256: sha256:dd6a95e2d19bac9ccf70991e37d3047d30bb472734b63ebe7881297d5fa739a2

• Artikkel 1
• Artikkel 2
• Artikkel 3
• Artikkel 4
• Artikkel 5
• Artikkel 6
• Artikkel 7
• Artikkel 9
• Artikkel 10
• Artikkel 11
• Artikkel 12
• Artikkel 13
• Artikkel 14
• Artikkel 15
• Artikkel 16
• Artikkel 17
• Artikkel 18
• Artikkel 19
• Artikkel 20
• Artikkel 21
• Artikkel 22
• Artikkel 23
• Artikkel 24
• Artikkel 25
• Artikkel 26
• Artikkel 27
• Artikkel 28
• Artikkel 29
• Artikkel 30
• Artikkel 31
• Artikkel 32
• Artikkel 33
• Artikkel 34
• Artikkel 35
• Artikkel 36
• Artikkel 37
• Artikkel 38
• Artikkel 39
• Artikkel 40
• Artikkel 41
• Artikkel 42
• Artikkel 43
• Artikkel 44
• Artikkel 45
• Artikkel 46
• Artikkel 47
• Artikkel 48
• Artikkel 49
• Artikkel 50
• Artikkel 51
• Artikkel 52
• Artikkel 53
• Artikkel 54
• Artikkel 55
• Artikkel 56
• Artikkel 57
• Artikkel 58
• Artikkel 59
• Artikkel 60
• Artikkel 61
• Artikkel 62
• Artikkel 63
• Artikkel 64

Geografiske artikkelagenter

Source: NovaCopilot