art_1__para_1

1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities as follows: requirements applicable to financial entities in relation to: information and communication technology (ICT) risk management; reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the competent authorities; reporting of major operational or security payment-related incidents to the competent authorities by financial entities referred to in Article 2(1), points (a) to (d); digital operational resilience testing; information and intelligence sharing in relation to cyber threats and vulnerabilities; measures for the sound management of ICT third-party risk; requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities; rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities; rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.

← Article 1 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.