What changes on 16/01/2023

The text in force from 01/07/2016 compared with the text from 16/01/2023.

Read the act as of 16/01/2023 · other versions:

Chapter I

• inserted Article 1 - Subject matter
• inserted Article 2 - Scope
• inserted Article 3 - Definitions
• inserted Article 4 - Proportionality principle

Chapter II › Section I

• inserted Article 5 - Governance and organisation

Chapter II › Section II

• inserted Article 6 - ICT risk management framework
• inserted Article 7 - ICT systems, protocols and tools
• inserted Article 8 - Identification
• inserted Article 9 - Protection and prevention
• inserted Article 10 - Detection
• inserted Article 11 - Response and recovery
• inserted Article 12 - Backup policies and procedures, restoration and recovery procedures and methods
• inserted Article 13 - Learning and evolving
• inserted Article 14 - Communication
• inserted Article 15 - Further harmonisation of ICT risk management tools, methods, processes and policies
• inserted Article 16 - Simplified ICT risk management framework

Chapter III

• inserted Article 17 - ICT-related incident management process
• inserted Article 18 - Classification of ICT-related incidents and cyber threats
• inserted Article 19 - Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
• inserted Article 20 - Harmonisation of reporting content and templates
• inserted Article 21 - Centralisation of reporting of major ICT-related incidents
• inserted Article 22 - Supervisory feedback
• inserted Article 23 - Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions

Chapter IV

• inserted Article 24 - General requirements for the performance of digital operational resilience testing
• inserted Article 25 - Testing of ICT tools and systems
• inserted Article 26 - Advanced testing of ICT tools, systems and processes based on TLPT
• inserted Article 27 - Requirements for testers for the carrying out of TLPT

Chapter V › Section I

• inserted Article 28 - General principles
• inserted Article 29 - Preliminary assessment of ICT concentration risk at entity level
• inserted Article 30 - Key contractual provisions

Chapter V › Section II

• inserted Article 31 - Designation of critical ICT third-party service providers
• inserted Article 32 - Structure of the Oversight Framework
• inserted Article 33 - Tasks of the Lead Overseer
• inserted Article 34 - Operational coordination between Lead Overseers
• inserted Article 35 - Powers of the Lead Overseer
• inserted Article 36 - Exercise of the powers of the Lead Overseer outside the Union
• inserted Article 37 - Request for information
• inserted Article 38 - General investigations
• inserted Article 39 - Inspections
• inserted Article 40 - Ongoing oversight
• inserted Article 41 - Harmonisation of conditions enabling the conduct of the oversight activities
• inserted Article 42 - Follow-up by competent authorities
• inserted Article 43 - Oversight fees
• inserted Article 44 - International cooperation

Chapter VI

• inserted Article 45 - Information-sharing arrangements on cyber threat information and intelligence

Chapter VII

• inserted Article 46 - Competent authorities
• inserted Article 47 - Cooperation with structures and authorities established by Directive (EU) 2022/2555
• inserted Article 48 - Cooperation between authorities
• inserted Article 49 - Financial cross-sector exercises, communication and cooperation
• inserted Article 50 - Administrative penalties and remedial measures
• inserted Article 51 - Exercise of the power to impose administrative penalties and remedial measures
• inserted Article 52 - Criminal penalties
• inserted Article 53 - Notification duties
• inserted Article 54 - Publication of administrative penalties
• inserted Article 55 - Professional secrecy
• inserted Article 56 - Data Protection

Chapter VIII

• inserted Article 57 - Exercise of the delegation

Outside any heading

• inserted Recital 1
• inserted Recital 2
• inserted Recital 3
• inserted Recital 4
• inserted Recital 5
• inserted Recital 6
• inserted Recital 7
• inserted Recital 8
• inserted Recital 9
• inserted Recital 10
• inserted Recital 11
• inserted Recital 12
• inserted Recital 13
• inserted Recital 14
• inserted Recital 15
• inserted Recital 16
• inserted Recital 17
• inserted Recital 18
• inserted Recital 19
• inserted Recital 20
• inserted Recital 21
• inserted Recital 22
• inserted Recital 23
• inserted Recital 24
• inserted Recital 25
• inserted Recital 26
• inserted Recital 27
• inserted Recital 28
• inserted Recital 29
• inserted Recital 30
• inserted Recital 31
• inserted Recital 32
• inserted Recital 33
• inserted Recital 34
• inserted Recital 35
• inserted Recital 36
• inserted Recital 37
• inserted Recital 38
• inserted Recital 39
• inserted Recital 40
• inserted Recital 41
• inserted Recital 42
• inserted Recital 43
• inserted Recital 44
• inserted Recital 45
• inserted Recital 46
• inserted Recital 47
• inserted Recital 48
• inserted Recital 49
• inserted Recital 50
• inserted Recital 51
• inserted Recital 52
• inserted Recital 53
• inserted Recital 54
• inserted Recital 55
• inserted Recital 56
• inserted Recital 57
• inserted Recital 58
• inserted Recital 59
• inserted Recital 60
• inserted Recital 61
• inserted Recital 62
• inserted Recital 63
• inserted Recital 64
• inserted Recital 65
• inserted Recital 66
• inserted Recital 67
• inserted Recital 68
• inserted Recital 69
• inserted Recital 70
• inserted Recital 71
• inserted Recital 72
• inserted Recital 73
• inserted Recital 74
• inserted Recital 75
• inserted Recital 76
• inserted Recital 77
• inserted Recital 78
• inserted Recital 79
• inserted Recital 80
• inserted Recital 81
• inserted Recital 82
• inserted Recital 83
• inserted Recital 84
• inserted Recital 85
• inserted Recital 86
• inserted Recital 87
• inserted Recital 88
• inserted Recital 89
• inserted Recital 90
• inserted Recital 91
• inserted Recital 92
• inserted Recital 93
• inserted Recital 94
• inserted Recital 95
• inserted Recital 96
• inserted Recital 97
• inserted Recital 98
• inserted Recital 99
• inserted Recital 100
• inserted Recital 101
• inserted Recital 102
• inserted Recital 103
• inserted Recital 104
• inserted Recital 105
• inserted Recital 106
• inserted Preamble

Chapter IX › Section I

• inserted Article 58 - Review clause

Chapter IX › Section II

• inserted Article 59 - Amendments to Regulation (EC) No 1060/2009
• inserted Article 60 - Amendments to Regulation (EU) No 648/2012
• inserted Article 61 - Amendments to Regulation (EU) No 909/2014
• inserted Article 62 - Amendments to Regulation (EU) No 600/2014
• inserted Article 63 - Amendment to Regulation (EU) 2016/1011
• inserted Article 64 - Entry into force and application