ESAs publish first set of rules under DORA for ICT and third-party risk management and incident classification

Summary:

The European Supervisory Authorities (ESAs) published final draft technical standards aimed at enhancing the digital operational resilience of the EU financial sector. The standards focus on strengthening financial entities' Information and Communication Technology (ICT) and third-party risk management and incident reporting frameworks. The documents cover Regulatory Technical Standards (RTS) on ICT risk management, simplified ICT risk management, and ICT-related incident classification, as well as Implementing Technical Standards (ITS) on the register of information for ICT third-party service providers. These standards aim to harmonize ICT risk management requirements, ensure incident reporting transparency, and maintain financial entities' control over operational risks and information security. The public consultation feedback led to changes in the technical standards, including simplification, streamlining, and addressing sector-specific concerns. The final draft technical standards will now be reviewed by the European Commission, with the objective of adoption in the coming months.