What DORA's ICT risk management standard (Delegated Regulation (EU) 2024/1774) requires for specific security measures: encryption and keys, logging, vulnerability and patch management, networks, access and identity, change, secure development, operations, endpoints and physical security.
What Articles 6 and 7 of the ICT risk management RTS require: an encryption policy driven by data classification, data at rest, in transit and in use, updating cryptography as cryptanalysis develops, the key lifecycle and a certificate register.
What DORA expects of logs: the events Article 12 of the RTS names, retention set by the entity's own risk assessment, tamper protection, logging failure alerts, clock synchronisation and how long incident evidence is kept.
The vulnerability and patch rules in Article 10 of the RTS: weekly automated scans for assets supporting critical or important functions, tracking third-party and open-source libraries, provider vulnerability handling, patch testing and deadlines.
Network requirements under Article 13 of the RTS: segmentation by criticality, documented connections and data flows, a dedicated administration network, yearly architecture review, six-monthly firewall rule checks and the ability to sever connections.
What Articles 20 and 21 of the RTS require for identities and access: unique accounts, lifecycle records, least privilege, segregation of duties, access reviews every 6 or 12 months, strong authentication and physical access logging.
The change management procedure Article 17 of the RTS requires: security checks on every change, separation of approvers from implementers, documentation, fall-back plans, emergency changes and post-change stress testing for CCPs and CSDs.
How DORA governs building and buying software: testing before use, static and dynamic code review, anonymised data in test environments, protecting source code, analysing open-source code before production and user-built systems.
Operational requirements in Articles 8 and 9 of the RTS and Article 7 of DORA: documented operating procedures, separating production from non-production, controlled testing in production, and capacity for peak volumes and stressed conditions.
What Articles 11 and 14 of the RTS require for data and devices: secure configuration baselines, approved software and media, malware protection, remote wipe for portable and private devices, secure deletion, data loss prevention and teleworking rules.
The people and premises side of DORA: the physical and environmental security policy, clear desk and screen rules, the human resources policy for staff and contractors, reporting channels, asset return on leaving and compulsory training.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.