Elaboration on the meaning of a separated and dedicated network for ICT asset administration

DORA regulation and the corresponding technical standards are principle-based ( Delegated regulation - EU - 2024/1774 - EN - EUR-Lex ) and technology agnostic and thus they do not identify specific configurations to ensure they can remain future-proof and that financial entities can decide on the specific arrangements based on their needs, their bespoke environment and their ICT risk assessment.  In this context, logical (e.g. using of virtual-LAN (vLAN) or a cloud-based solution), physical separation or a combination of both may or may not serve as adequate controls to meet the requirement of “(c)the use of a separate and dedicated network for the administration of ICT assets” (RTS on ICT risk management Article 13(c)). The decision on which controls to implement to ensure such separation would need to be taken in accordance with Article 13 point (a) and in compliance with Article 13 as a whole for network security management aspects. For example, in the case of isolating an administrative network, where ensuring sufficient separation is key, it is also important to stress that a virtual LAN (vLAN) alone may not be sufficient to ensure effective isolation of the administrative network. In this case, the financial entity should assess whether the logical segregation alone is sufficient and in the case of opting for a VLAN at least consider complementing vLAN with additional controls (e.g. a firewall with an appropriate filtering policy, or implementing appropriate routing, etc). Furthermore, it is important to note that any decision on the use of the regular production-LAN with other systems, would need to consider also at a minimum the requirements under Article 8(2)(b), and Recital 10.