ICT third-party risk management (DORA)

Article 13 of Commission Delegated Regulation (EU) 2024/1774 provides the requirement for financial entities to develop, document and implement policies procedures protocols and tools on network security management, including (c) the use of a separate and dedicated network for the administration of ICT assets. The decision on whether to use a physically or logically separated network is to be taken by financial entities taking into account the provisions of Article 4(1), Article 6(8), Article 7, Article 9(4) point (c) of Regulation (EU) 2022/2554 and Article 1 of Commission Delegated Regulation (EU) 2024/1774. Furthermore, in the context of said Article 13, “administration of ICT assets” should be interpreted with a broad spectrum including both manual and automated activities and processes. Furthermore, for completeness on a similar subject, please refer to: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7178.