art_6__para_8

8. The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by: explaining how the ICT risk management framework supports the financial entity’s business strategy and objectives; establishing the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions; setting out clear information security objectives, including key performance indicators and key risk metrics; explaining the ICT reference architecture and any changes needed to reach specific business objectives; outlining the different mechanisms put in place to detect ICT-related incidents, prevent their impact and provide protection from it; evidencing the current digital operational resilience situation on the basis of the number of major ICT-related incidents reported and the effectiveness of preventive measures; implementing digital operational resilience testing, in accordance with Chapter IV of this Regulation; outlining a communication strategy in the event of ICT-related incidents the disclosure of which is required in accordance with Article 14.

← art_6__para_7 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.