◷
New version applies from 25/06/2024.
73 provisions change.
Later versions: 15/07/2024.
Commission Delegated Regulation (EU) 2024/1774
25/06/2024 → 15/07/2024: 0 inserted · 0 removed · 41 amended · 0 moved · 0 renamed · 32 unchanged
Position-only shifts inside the same heading are not changes. Amended = the printed text changed.
Preamble
Preamble · 1 unchanged
Recitals
Recitals · 30 unchanged
Recital 1 · Recital 2 · Recital 3 · Recital 4 · Recital 5 · Recital 6 · Recital 7 · Recital 8 · Recital 9 · Recital 10 · Recital 11 · Recital 12 · Recital 13 · Recital 14 · Recital 15 · Recital 16 · Recital 17 · Recital 18 · Recital 19 · Recital 20 · Recital 21 · Recital 22 · Recital 23 · Recital 24 · Recital 25 · Recital 26 · Recital 27 · Recital 28 · Recital 29 · Recital 30
Title I - GENERAL PRINCIPLE
- amended Article 1 - Overall risk profile and complexity Title I
Title II - FURTHER HARMONISATION OF ICT RISK MANAGEMENT TOOLS, METHODS, PROCESSES, AND POLICIES IN ACCORDANCE WITH ARTICLE 15 OF REGULATION (EU) 2022/2554
- amended Article 2 - General elements of ICT security policies, procedures, protocols, and tools Title II › Chapter I › Section 1
- amended Article 3 - ICT risk management Title II › Chapter I › Section 2
- amended Article 4 - ICT asset management policy Title II › Chapter I › Section 3
- amended Article 5 - ICT asset management procedure Title II › Chapter I › Section 3
- amended Article 6 - Encryption and cryptographic controls Title II › Chapter I › Section 4
- amended Article 7 - Cryptographic key management Title II › Chapter I › Section 4
- amended Article 8 - Policies and procedures for ICT operations Title II › Chapter I › Section 5
- amended Article 9 - Capacity and performance management Title II › Chapter I › Section 5
- amended Article 10 - Vulnerability and patch management Title II › Chapter I › Section 5
- amended Article 11 - Data and system security Title II › Chapter I › Section 5
- amended Article 12 - Logging Title II › Chapter I › Section 5
- amended Article 13 - Network security management Title II › Chapter I › Section 6
- amended Article 14 - Securing information in transit Title II › Chapter I › Section 6
- amended Article 15 - ICT project management Title II › Chapter I › Section 7
- amended Article 16 - ICT systems acquisition, development, and maintenance Title II › Chapter I › Section 7
- amended Article 17 - ICT change management Title II › Chapter I › Section 7
- amended Article 18 - Physical and environmental security Title II › Chapter I › Section 8
- amended Article 19 - Human resources policy Title II › Chapter II
- amended Article 20 - Identity management Title II › Chapter II
- amended Article 21 - Access control Title II › Chapter II
- amended Article 22 - ICT-related incident management policy Title II › Chapter III
- amended Article 23 - Anomalous activities detection and criteria for ICT-related incidents detection and response Title II › Chapter III
- amended Article 24 - Components of the ICT business continuity policy Title II › Chapter IV
- amended Article 25 - Testing of the ICT business continuity plans Title II › Chapter IV
- amended Article 26 - ICT response and recovery plans Title II › Chapter IV
- amended Article 27 - Format and content of the report on the review of the ICT risk management framework Title II › Chapter V
Title III - SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK FOR FINANCIAL ENTITIES REFERRED TO IN ARTICLE 16(1) OF REGULATION (EU) 2022/2554
- amended Article 28 - Governance and organisation Title III › Chapter I
- amended Article 29 - Information security policy and measures Title III › Chapter I
- amended Article 30 - Classification of information assets and ICT assets Title III › Chapter I
- amended Article 31 - ICT risk management Title III › Chapter I
- amended Article 32 - Physical and environmental security Title III › Chapter I
- amended Article 33 - Access Control Title III › Chapter II
- amended Article 34 - ICT operations security Title III › Chapter II
- amended Article 35 - Data, system and network security Title III › Chapter II
- amended Article 36 - ICT security testing Title III › Chapter II
- amended Article 37 - ICT systems acquisition, development, and maintenance Title III › Chapter II
- amended Article 38 - ICT project and change management Title III › Chapter II
- amended Article 39 - Components of the ICT business continuity plan Title III › Chapter III
- amended Article 40 - Testing of business continuity plans Title III › Chapter III
- amended Article 41 - Format and content of the report on the review of the simplified ICT risk management framework Title III › Chapter IV