Article 9Protection and prevention
1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.
2. Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.
3. In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall:
(a) ensure the security of the means of transfer of data;
(b) minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity;
(c) prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data;
(d) ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error.
4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall:
(a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;
(b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;
(c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;
(d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;
(e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;
(f) have appropriate and comprehensive documented policies for patches and updates.
For the purposes of the first subparagraph, point (b), financial entities shall design the network connection infrastructure in a way that allows it to be instantaneously severed or segmented in order to minimise and prevent contagion, especially for interconnected financial processes.
For the purposes of the first subparagraph, point (e), the ICT change management process shall be approved by appropriate lines of management and shall have specific protocols in place.
DORA, the European Union regulation on digital operational resilience, Article 9
Protection and prevention, built on continuous monitoring and control of the security and functioning of ICT systems.
Security policies, procedures and tools must support resilience, continuity and availability, especially for systems behind critical or important functions, and keep high standards of availability, authenticity, integrity and confidentiality of data at rest, in use and in transit. The solutions must secure data transfer, limit corruption, loss, unauthorised access and technical flaws, and guard against risks from data management, including poor administration and human error.
Within the framework entities must: document an information security policy; take a risk-based approach to network and infrastructure management, which may include automated isolation of affected assets, and design connections so they can be severed or segmented instantly to limit contagion; limit physical and logical access to what legitimate, approved functions require, with sound administration of access rights; apply strong authentication and protect cryptographic keys, with encryption driven by data classification and risk assessment; run documented, risk-based ICT change management that records, tests, assesses, approves, implements and verifies every change, with the process itself approved by appropriate lines of management; and keep documented patch and update policies.
Much of the article states what policies and tools must achieve. Further detail, for example on managing access rights, comes from the technical standards under Article 15.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-14: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items RM-05 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Risk Management Framework Document TemplateWord
in DORA ICT Risk & Resilience Readiness
Statement FW-26 on the information security policy and the protection policy areas.
Security Policy Document TemplateWord
in Security Policy Management
A template for the documented information security policy that the Article's protection and prevention provisions refer to.
in User Access Review
The decision criteria limit access to what the job needs, which its reference list ties to limiting access to approved functions.
in Joiner-Mover-Leaver & Access Provisioning
The access principles limit access to what the job needs.
Privileged Access StandardWord
in Privileged Access Management
Principles limit privileged access to approved functions; PA-05 and PA-10 cover phishing-resistant sign-in and the vault.
Information Classification & Handling PolicyWord
in Information Classification & Handling
The handling rules protect confidentiality, integrity and availability of data at rest, in use and in transit, as part of the information security policy set.
in Patch Management
PM-03 to PM-12 record, test, approve, deploy and verify patches as changes, and the standard as a whole is the patch policy.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.